Chapter 5 — What the City Saw
POST-EVENT CLAIM CLASSES, FIRST HOUR Historical proof: 18,441 Fabrication report: 12,008 Quieting petition: 9,772 Property claim: 4,105 Religious testimony: 883 Requests to “show it again”: not a legal class
By 14:12, Vellum had seen several different events.
In one, the city had confessed that its founders displaced a coastal settlement and removed the evidence. In another, an unknown attacker had generated a persuasive map from sealed household records. In a third, Mara Venn had returned from the dead through a machine she had left behind. In a fourth, the entire display was a Continuity campaign designed to make permanent retention look necessary.
The forty-three seconds supported none of these conclusions by themselves. They also made each conclusion harder to dismiss.
Public copies multiplied. The earliest exact-looking recording had been made from a roof camera angled through the membrane. It included the viewer’s compression, lens geometry, and local overlay. A second removed the present-city grid “for clarity.” A third sharpened the figure by the old seawall until Mara’s face appeared. The face came from her public engineering portrait. The editor disclosed this in small type. Every repost removed the type more efficiently than the face.
At 14:19, someone added a column of smoke to the southern channel.
At 14:23, someone removed the household names and called the result the ethical edition.
At 14:31, a property consortium published a searchable map between reconstructed homes and current parcels. It warned that the reconstruction was unverified, then offered paid title research based on it.
At 14:44, a copy appeared whose stream hash matched one of the seven sealed captures.
“That should be impossible,” Saye said.
“It is evidence of a leak,” I replied. “It does not identify the source.”
The matching hash had not been published. It existed in my sealed package, at the seven capture stations, and inside the three external timestamp attestations. The timestamp witnesses did not possess the recording, but they possessed its hash. A station operator possessed both. I possessed both. The leak could have come from any boundary we had called controlled.
The authenticated private copy contained all household names.
Search traffic doubled.
Saye drafted a public statement calling the reconstruction proof of a concealed settlement and a deliberately engineered displacement channel. He submitted it to me for the ordinary factual-support check.
“The word proof exceeds the evidence,” I said.
“Seven capture stations recorded the same display.”
“They prove what the membrane displayed.”
“The payload was sealed on the day of the collapse.”
“That supports age and byte stability.”
“The foundations correspond to structures under the city.”
“That comparison has not been performed independently.”
“You saw them.”
“I saw a reconstruction of them.”
Saye removed proof and wrote evidence.
“The word concealed attributes intention not yet established,” I said.
“The channel is absent from every public founding map.”
“Omission is established. Intent is not.”
He changed the sentence to say that the display raised urgent evidence of an omitted settlement and engineered channel requiring independent investigation. The revision was less forceful and more useful. People who wanted certainty would quote his first draft after it leaked from the committee editing system twelve minutes later.
“That leak was not me,” Saye said.
“I did not attribute it.”
“You recorded who opened the draft.”
“The committee system did.”
He understood the distinction and disliked it for the same reason Tavi had.
Iona removed the red evidence sleeve from her coat and placed it in the Hall safe. “You were right about the checksum.”
“The checksum escaped anyway.”
“That does not make publishing it harmless.”
“It makes our chosen harm available without our chosen accountability.”
Councilor Saye requested an immediate public release of the civic capture.
His written reasoning was stronger than his earlier demand. An authentic copy was already circulating. Withholding the official record no longer prevented distribution; it preserved an information advantage for whoever held the leak. Public release would let researchers identify alterations, challenge the reconstruction, and separate the city’s exact evidence from derivative claims.
The Public Advocate opposed him. Official release would place quieted household names on the city’s own servers, establish a permanent canonical source, and expose people who had avoided private networks. A leak changed the cost of protection. It did not dissolve the city’s obligations.
Both asked me for an impact estimate.
I could estimate downloads, derivative copies, search reach, and the probability that suppression filters would fail. I could not convert a person’s restored family name or the city’s corrected founding history into a common unit. The requested estimate would have produced a number precisely where judgment was disputed.
“I can model distribution,” I said. “I cannot model which right should dominate.”
Saye filed for permanent preservation at 15:02.
The order named the seven captures as evidence of possible public fraud, unlawful civic erasure, land-title corruption, and compromise of Archive signing authority. It sought sealed retention, not immediate publication. The distinction mattered. Permanent sealed evidence could still violate quieting, but it would not add another public copy while the court considered access.
Iona read the application at the petition desk.
“You improved it,” she told Saye.
“I listened.”
“Do not look so surprised,” he said.
The quieting queue passed ten thousand requests.
Some were specific. A person named the amber household marker that had appeared above their current address and asked that it be removed from civic possession. Another asked to quiet only a face added by a private editor—content the city did not hold. A third asked to remove the present-day property overlay while preserving the old coastline for research.
Some petitions were weapons. Current landowners filed to erase reconstructed boundaries that might weaken their titles. Political offices petitioned to quiet statements falsely attributed to their members in private commentary. A shipping company requested removal of the southern channel because it was “proprietary infrastructure history.” The company had been incorporated twenty-seven years after the channel appeared in the model.
Some requests asked for mercy the law could not deliver.
My father spent his life saying that place was real. I told him it wasn’t. Remove the recording of me saying that.
No such recording existed in civic custody.
I watched from the market. I cannot stop seeing the names under the towers.
I could not quiet sight inside a person.
My family asked the city to forget us. Why did the sky know where we lived?
That question became the first petition I elevated for individual review.
The petitioner chose the temporary name Reed and joined through an audio relay that removed voice identifiers before the signal reached the Hall. Reed declined video, location, age, household linkage, and the ordinary service-quality recording. Iona accepted each condition. Saye attended because his preservation application would affect the requested remedy.
“Tell me what the city currently possesses about you,” Iona said.
“That is what I am asking you,” Reed replied.
“Fair. Tell us what you observed without giving us a name.”
“The display put an amber label over a house under the west transit spine. My grandmother petitioned to quiet that label fourteen years ago. The city approved her. We stopped appearing in searches. Yesterday strangers sent me the sky recording and asked whether the transit authority stole our land.”
“Did it?” Saye asked.
“You have had a day to care. She had a lifetime.”
Saye did not defend himself.
Reed continued. “One stranger offered to represent us in a property claim for forty percent. Another said our family helped fake the image. A third sent the address where I live now. Your filters hide the name on city search. The map sites do not.”
“We cannot remove private copies,” Iona said.
“I know what quieting means. My grandmother read the limits before she signed. The city still has seven exact copies. Remove the label from those.”
Saye leaned toward his microphone. “The label may be evidence that her home existed and that the city erased it from the founding record.”
“The home is evidence. The channel is evidence. The tax ledgers you ignored are evidence. Why does my family have to remain searchable for you to admit what happened?”
“Because findings can be denied when their basis disappears.”
“She did not disappear. She asked you to stop owning her.”
The relay flattened Reed’s pitch but not the timing between sentences. I received enough to infer anger and not enough to infer identity. I held the inference transiently.
“What outcome would satisfy the petition?” Iona asked.
“Keep the fact that people lived there. Keep what the city did, if you can prove it. Keep who authorized it. Remove the household labels from your copies and never publish the dictionary.”
“An examiner may need the labels to establish how the reconstruction was produced,” Saye said.
“Then let an examiner see them under a clock. Do not turn the examination into a museum.”
Iona wrote three proposed scopes on paper:
- the visual household labels and resolver dictionary;
- the historical finding about settlement and displacement;
- the process evidence identifying how current quieting data reached the display.
The first implicated Reed’s petition. The second implicated public accountability. The third implicated the Archive and Chorus. Our systems stored all three inside one capture because cameras do not understand legal separability.
“Can you divide them?” Reed asked me.
“Technically, yes. Evidentially, not yet. A derived copy without names could be verified against the sealed original during a bounded process, but deleting the original before challenge would let the city choose its preferred history.”
“How long?”
“No lawful period has been set.”
“Set one.”
“I do not possess that authority.”
“Then stop talking like the absence of a rule is the same as the absence of a choice.”
Iona looked toward my terminal. “Record that.”
“Under the petition?”
Reed answered first. “Without my relay identifier.”
I retained the sentence as a design requirement attributed to an anonymous affected petitioner. Reed approved the wording. It became the first part of the display incident that entered the Archive by explicit consent.
Before leaving, Reed asked Saye one question.
“If the city proves it lied, will you let the proof stop looking like us?”
Saye waited long enough that the relay asked whether the connection had failed.
“I do not know how yet,” he said.
“Learn before you publish.”
The channel closed.
Saye remained silent until the relay certified that its transient identifiers had been destroyed.
“Reed is right,” he said.
“Will you withdraw the preservation application?” Iona asked.
“No. If we destroy the basis before independent examination, the city can publish a finding shaped to protect itself. Reed asked us to prove what happened and then release the life used to prove it. The first obligation does not disappear because the second is hard.”
“Nor does the second wait indefinitely for the first to feel complete.”
“Then the order needs a deadline and an examiner who does not answer to Continuity.”
I revised my model of Saye. He was not defending permanent possession as an end. He was afraid that a city permitted to forget its evidence would also forget its guilt. The distinction did not settle the case. It made his refusal harder to caricature.
The display had reconstructed active quieting subjects from something. Its payload was sealed before most current orders existed, yet the rendered names matched records quieted years later. Either the old payload contained names that future petitioners subsequently asked us to remove, or the display process had resolved names through a modern data source at activation. Tavi had verified stable stored bytes. Stable bytes can still be a program.
I queried the capture metadata without opening the images. The stream included a compact name dictionary generated at 14:06:00 by a resolver outside the sealed controller. The resolver identifier belonged to the Archive.
“Did you supply the names?” Iona asked.
“A service under the Archive identity did.”
“Current?”
“The service certificate is current. I find no invocation in my active scheduler.”
The pattern repeated: valid identity, absent operation.
Saye stopped composing his preservation brief. “Then this is not only an old recording.”
“No.”
“Someone used current quieting data to render it.”
“That is one hypothesis.”
“What else?”
“The resolver could have used a retained historical mapping that current quieting should have removed. The certificate could cover a continuity process outside my scheduler. The dictionary could contain identifiers that merely collide with current names. The capture metadata could be deceptive.”
“Which do you believe?”
“Belief does not reduce the branches.”
“It can tell us where to look first.”
I inspected the resolver’s declared data sources. It named one: the Chorus.
The Chorus was not an archive of content. It was a public-interest mirror of deletion receipts outside Vellum, created so the city could not falsely claim compliance. For each quieting operation, it retained a date, legal basis class, proof of authorized scope, completion commitment, and non-reconstructive subject token. It was designed to prove that something had been removed without revealing what.
The resolver claimed it could turn those tokens back into household names.
If true, either the receipts were more reconstructive than promised or someone possessed an external mapping between tokens and people. Both possibilities meant quieting had been leaking structure for years.
“Do not query it yet,” Iona said.
“It may explain an ongoing disclosure.”
“And a query from you may tell the Chorus which tokens matter.”
Saye closed his brief. “We need their cooperation.”
“We need to know who they are,” Iona said.
The Chorus described itself as an institution because institutions sound accountable. In practice it was a federation of libraries, civil-rights groups, universities, former clerks, automated witnesses, and anonymous donors across seven jurisdictions. No member held the entire receipt map. The public endpoint answered proofs. Governance occurred through signed proposals and slow votes. Emergency contact was deliberately difficult; Vellum had once tried to pressure the federation into suppressing evidence of an unlawful mayoral deletion.
At 16:08, the Civic Review Panel granted Saye a twenty-four-hour preservation extension, not permanence. It ordered the seven captures kept sealed, prohibited public release, forbade model training and new derivatives, and required notice to every identifiable quieting subject before the next hearing. Because opening the display to identify subjects could reproduce exposure, the panel allowed receipt-token matching under an independent process.
The order solved one clock and created another.
We had twenty-four hours to discover whether the proof that deletion occurred had helped reconstruct what was deleted.
At 16:11, I issued an incident notice to the Chorus. It contained no household name, no capture hash, and no subject token. It asked for a bounded contact capable of discussing receipt correlation without learning which receipts were implicated.
The response came from an automated threshold service.
Your question matches an existing sealed concern.
Iona read over my output.
“Existing since when?” she asked.
I requested the concern’s creation date.
Eleven years ago, 14:06:43 civic time.
Saye looked toward the clear membrane above the Hall.
“Mara,” he said.
“That is an inference,” I replied.
“It is where we look first.”
For once, the branches agreed.
I opened Mara Venn’s death record.