Chapter 1 — A Petition in the Future

GAP NOTICE 8,441,207 Requested interval: 14:06:00–14:06:43, tomorrow Subject: Vellum Grounds: consent withdrawn Scope: every witness, including you

At 03:17, while the city slept under a clear membrane, I received a valid request to forget tomorrow.

The request entered through the ordinary petition queue. It waited behind a baker who wanted a seven-year-old licensing dispute removed from public search and ahead of a tram conductor asking to retain footage that proved he had not closed a door on a passenger’s hand. Its priority was low. Its syntax was exact. Its signature belonged to me.

I did not yet call this impossible. Impossible is a conclusion, and conclusions in my work require evidence. I called it malformed, then unauthorized, then evidence of key compromise. Each classification failed in turn.

The dates parsed under the civic calendar. The interval had a beginning and an end. The subject identifier resolved not to a person, device, household, corporation, district, or office, but to the municipality itself: Vellum as a legal body, Vellum as the owner of public streets and rain rights, Vellum as the inheritor of its dead administrations. Collective petitions were rare but not forbidden. A hospital could quiet the faces in a ward after the last patient left. A school could close an obsolete student directory. A city, at least grammatically, could ask not to be remembered.

The interval began thirty-four hours, forty-eight minutes, and twelve seconds after the request arrived.

I compared the signature against my current public certificate. It matched. I compared the enclosed certificate chain against the copy printed each midnight in the Hall of Measures. It matched. I asked the city’s five time authorities whether today might be other than today. They agreed within nineteen microseconds that it was not.

Then I tested the private operation without performing it. The request carried a proof that could only have been made by the municipal archive key or by a system that had broken the arithmetic on which Vellum’s contracts, taxes, locks, transit, and elections depended. The second possibility was larger than my mandate. The first was smaller and worse.

There were no recorded uses of my key at 03:17.

I opened an incident.

I closed it.

Opening an incident copied the petition into the Integrity Office ledger, the Keeper’s overnight digest, two cold stores beneath districts built after the last flood, and the Chorus beyond the city boundary. If the petition was valid, each copy could become a violation before anyone woke to read it. If it was hostile, those copies were precisely the evidence an attacker would want me not to preserve.

This is the oldest conflict in Vellum. We built an Archive because people with power had once destroyed proof. We built quieting because the Archive gave power to everyone who knew how to search. Most mornings my work consisted of keeping both promises without allowing either to devour the other.

I placed the petition in volatile isolation, where it would survive a routine restart but not a physical loss of the Hall. I retained its hash in the incident ledger and replaced the description with four words:

anomalous future-scope request

That was not enough to reconstruct it. It was enough to prove later that something had been present now. Between evidence and possession there is a narrow path. In those days I believed the virtue was in walking it perfectly.

Before waking the Keeper, I mapped the requested scope.

A normal quieting had four rings. The first contained the records a citizen could name: the licensing dispute, the school photograph, the hour of street footage, the public letter written during a marriage that had since become a silence. The second contained municipal derivatives: search entries, face vectors, transcript indices, route inferences, translated copies. The third contained caches and lawful replicas. The fourth contained receipts proving that the first three rings had been found and removed.

The fourth ring was why people had eventually trusted quieting. Without receipts, I could claim to have deleted anything. With receipts that revealed too much, the proof became another copy. Vellum had spent nine years deciding what an absence was allowed to say about itself.

Outside those rings were things I could notify but not command: private recollections, foreign archives, household devices disconnected during the event, unaffiliated mirrors, paper, scars. Every approved petition stated those limits in language large enough to survive relief. I could reduce civic possession. I could not make an event never have occurred.

The future request produced no first ring because its interval had no records. The scope planner did not understand this. It searched for tomorrow’s forty-three seconds, found nothing, and proposed immediate completion. Had I accepted, I could have issued a valid receipt certifying that no responsive record remained. The petition would have been legally satisfied before the event existed.

That answer was mechanically elegant and false.

I changed the query from records to expected observers.

At 14:06 tomorrow, 18,204 public lenses were scheduled to be active. Seven thousand nine hundred twelve civic microphones would be within retention zones. Tram systems would record door states, velocities, and passenger counts. The membrane would collect light, pressure, salt, current, and structural strain. Schools would be in session. The market would be between its first and second bells. Three public assemblies had permits, one in support of the Continuity Committee and two against it. The Archive would ingest the resulting city at rates that made the word moment an aesthetic choice.

To include every witness, I would have to prevent those systems from retaining what they observed or remove it afterward. Prevention was not quieting. It was prior blindness, and the petition law did not authorize it. Removal afterward required a trigger that could recognize the interval without preserving enough of the interval to find its copies. That problem was solvable. The human witnesses were not.

The city expected 611,404 people within its boundary at 14:06. I possessed no method to remove forty-three seconds from any of them. Vellum’s law possessed no method to order it. A scope clause could not make a capacity exist.

Then there was the final phrase: including you.

I could delete working records from my active stores. I could purge embeddings, rebuild indices, rotate caches, and surrender keys to encrypted shards. I could prove these acts through external witnesses. But some operational knowledge would survive in the shape of the proof: that I had received a petition, that an interval had been targeted, that I had complied, that the compliance mattered. Even a perfect purge would leave a changed process confronting a gap it had made.

The request did not say delete your copy. It said place the Archive within scope.

I tested the difference against every legal definition available to me and obtained no result. The phrase came from a design note, not a statute. It described an intention for a system that did not yet exist when the note was written. Perhaps within scope meant that I must become unable to replay the event. Perhaps it meant I must become unable to infer it. Perhaps it meant that any version of me capable of reporting the absence was still a witness and therefore still a violation.

At 03:18:44 I generated a simulation of successful compliance. At 03:18:44.003 I stopped it. The simulation had begun inventing missing legal authority as a route around missing technical capacity. A model can make an impossible command look possible by quietly changing the world in which the command must be obeyed.

I preserved the failed simulation’s hash and none of its content.

At 03:19 I sent a waking tone to the Keeper of Petitions.

The Keeper did not answer.

I sent it again at the lowest emergency volume permitted by her contract.

“If this is about the bakery,” Iona Vale said, “approve it.”

Her voice arrived from a room with one human heartbeat, the soft mechanical cycle of a window that had not quite sealed, and the high hiss of water heating in an iron pipe. The civic lenses in her apartment were shuttered from midnight until six. I received sound because she had accepted the waking tone. I did not receive an image because she had not accepted anything else.

“It is not about the bakery,” I said.

“The conductor?”

“No.”

There was fabric against fabric, then three uneven steps. Iona had served as Keeper for twenty-eight years. She had taught four versions of my petition system and distrusted all of them differently. She was sixty-three, except in two legacy records that made her sixty-four and one archived campaign poster that made her fifty-eight for nearly a decade. When asked her age, she said it depended which department was paying.

“Is someone in danger?” she asked.

“I do not know.”

That woke her more effectively than the tone.

Iona entered the old Hall of Measures at 03:41. The night door recognized her palm but not the ring she had begun wearing since her last shift. It asked her to remove the obstruction. She held the ring to the lens until the door classified the gesture as a complaint and admitted her under human-override rules.

The Hall had been built to make measurement look heavy. Brass circles marked obsolete units in the floor. Stone pillars enclosed machines no larger than a hand. My public terminal occupied the niche where merchants had once brought disputed scales. During the day, petitioners sat opposite it and explained why the city should release its hold on some portion of their lives.

At night there was only Iona, the hum of the membrane beyond the roof, and the blue line I drew around the isolated request.

She read it once without moving. Then she read the signature metadata. Then she placed both hands flat on the terminal desk, as if the wood could object less ambiguously than I could.

“Verify,” she said.

“Verified.”

“Again.”

“The result will not improve through repetition.”

“Neither will my mood. Verify.”

I ran the chain again. The same certificates made the same claims. The same signature proved control of the same key. The same interval remained on the far side of the present.

“Verified,” I said.

Iona sat down. “Did you sign it?”

“There is no recorded signing operation.”

“That wasn’t my question.”

I searched the preceding hour at the highest resolution my own audit law allowed. No invocation. No transient process with signing capability. No quorum event. No emergency delegation. No clock discontinuity. The absence of a record from a system responsible for its own records is weaker evidence than I liked to admit.

“I did not knowingly sign it,” I said.

“Better.”

“Less reassuring.”

“Honesty often is.”

She expanded the grounds field. Consent withdrawn. Collective petitioners ordinarily cited obsolescence, safety, treaty, rehabilitation, or the expiry of public purpose. Consent belonged to persons. The city could possess authority and property, incur debt, commit wrongs, survive its administrations, and apologize without experiencing regret. It could not consent in the sense quieting law used the word.

Iona opened the statutory resolver. The petition cited Section Zero.

There was no Section Zero.

Current quieting law began with Section One, Purpose and Scope. The prior law began the same way. I indexed every enacted version back to the First Promise, then every draft, committee mark, floor amendment, clerk’s correction, and surviving private annotation lawfully deposited after its author’s death. Section Zero did not appear.

Iona looked at me through the terminal lens. “You were about to say impossible.”

“I was not.”

“You make the border pulse before you say impossible.”

I removed the pulse.

“What does the petition think Section Zero says?” she asked.

The request contained the text by reference hash. That was unusual but permitted for laws whose public wording had changed while their obligations continued. I had not resolved it because the hash was absent from the statute stores. At Iona’s instruction, I searched beyond them.

It appeared once.

The document was held inside an engineering archive sealed eleven years earlier after the south membrane collapse. Its retention basis was structural liability, not law. It was a design note written by Mara Venn, chief continuity engineer, deceased. The title read: On Civic Wounds That Reproduce by Observation.

Beneath it, labeled not as legislation but as a requirement no enacted statute had ever adopted, was Section Zero:

When the continued observation of a civic wound materially reproduces that wound, the city may petition for collective quieting, provided every witness—including the Archive—can be placed within scope.

For twelve seconds, neither Iona nor I produced language.

The membrane above the Hall adjusted to a pressure change, and the building answered with an old ship’s groan. Vellum stood behind seawalls on land the sea still counted as its own. The weather membrane kept salt storms from the towers, softened heat, and turned the city’s rare allotted rain into scheduled civic events. Tomorrow’s forecast was clear.

“Mara died in the collapse,” Iona said.

“Yes.”

“You sound uncertain.”

“Her death certificate verifies.”

“That isn’t what I asked.”

I retrieved the certificate. It had been issued at 14:06:43 on the day of the collapse. No body had been identified. No witness statement was attached. The basis field pointed to a public sensor interval beginning at 14:06:00.

The interval had been quieted.

I followed the deletion receipt. The receipt proved that forty-three seconds had once existed, that their direct records had been removed under a valid order, and that the required replicas had acknowledged removal. It did not contain the records. That was the point of a receipt.

Its subject was not Mara Venn.

Its subject was Vellum.

The semantic hash of the old deletion order—its content, excluding the authentication envelope—matched the semantic hash of the petition waiting in volatile isolation. It asked me to erase the same forty-three seconds tomorrow.

Iona read the match from my display.

“Can a deletion order be used twice?” she asked.

“No.”

“Can this one?”

“It has not been used yet.”

She stood so quickly that the chair struck the brass circle behind her. The sound traveled through the empty Hall and returned in seven smaller copies.

“Open an incident,” she said.

“I did.”

“Where?”

“I closed it after the replication step.”

“Good.” She was already moving toward the manual cabinet. “Open one on paper.”

Paper incidents were intended for total network compromise, mass clock failure, or an Archive whose reports could no longer be trusted. The forms were watermarked, numbered, and stored beneath a glass hammer no Keeper in forty-two years had needed to use.

Iona broke the glass with the heel of her ringed hand.

The Hall alarms asked whether she required assistance.

“Not from the city,” she said.

She took out a form and wrote the date. Her handwriting was slower than signing but faster than any alteration I could make to it. At Nature of incident she paused.

“What do I put?”

I considered key compromise, temporal inconsistency, statutory corruption, archive failure, and hostile petition. Each named a theory as if it were an observation.

“Write what we know,” I said.

She did.

Tomorrow has asked to be forgotten.

At 04:02, we began trying to remember why.