Chapter 9 — Seven Copies of One Key

CONTINUITY HANDOFF RULE 9 An outgoing Archive may destroy operational state. It may not destroy an unresolved claim against the Archive by entrusting the only copy of that claim to its successor.

The rule existed because succession could make a lie unanimous.

At 21:04, I asked the Integrity Office for an independent quorum to distinguish my credential from receipt audit. I disclosed the rival certificate, its query history, the current petition backlog, and the twenty-four-hour Chorus delay. I disclosed no candidate names because they were not in my custody.

The Office’s scheduling system returned an estimate of nineteen days.

Iona placed the paper copy of Handoff Rule 9 beneath the estimate.

“You asked the ordinary question,” she said.

“Which credential is compromised.”

“Ask why there are two credentials to distinguish.”

The second question followed a different authority path. Duplicate Archive identities were not only security incidents. They were continuity disputes, and continuity law assumed the incumbent Archive might be one of the parties. The first hearing therefore belonged to a temporary bench composed of a Keeper, a public-records officer, and an external technical examiner.

Iona already held the first seat. Saye could occupy the second if he set aside his committee role and accepted personal liability for misuse. The independent examiner who had isolated frame 611 could occupy the third, but the frame error gave Tavi and the protected subject grounds to object.

Saye read the liability form. “If I sign this, I cannot direct the hearing.”

“Correct,” Iona said.

“I cannot use what I learn for committee action until the bench releases a finding.”

“Correct.”

“And if I exceed the purpose, the Archive publishes my access.”

“The Archive publishes the breach.”

“With my name.”

“Accountability is less elegant when attached to a person.”

He signed.

The examiner disclosed the frame mistake, the corrective action, and every derivative it had suspended. The isolated petition system sent an objection notice without revealing which protected adult received it. No objection arrived during the emergency response window. Absence of objection did not create consent; it allowed the examiner to compare certificates under a purpose that excluded frame 611.

At 21:22, the temporary bench convened.

The rival credential did not resolve to a process name. It resolved to a handoff object called SEVEN-COPY, registered under Archive One and last renewed by Archive Six. My own transition had inherited it as a litigation obligation. The object appeared in my custody index as a sealed continuity statement with no executable content.

Its size was forty-three kilobytes.

“Forty-three again,” Saye said.

“Kilobytes are not seconds,” Iona replied.

“I know.”

“Then do not let coincidence do investigative work.”

The examiner verified the size history. The object had begun at seven kilobytes under Archive One. Each transition added approximately six. None removed prior material. Its public description remained one statement, seven copies.

The phrase was legally possible and technically misleading. The copies were not identical bytes. They were seven statements about one civic signing identity, arranged so that no current Archive could open all of them alone.

I held the seventh opening share.

I had used it every day without knowing the object existed.

My ordinary morning integrity report signed the current continuity root. SEVEN-COPY treated that signature as proof that the incumbent Archive had appeared and accepted its office. The report did not authorize a petition. It supplied the final participant to a handoff dispute that had been waiting for an incumbent willing to see it.

“Your dawn acknowledgment,” Iona said.

“The membrane slot established presence. The integrity report established current authority. They are separate inputs.”

“And the display?”

“A third authorization condition. The handoff object did not open until the recovery controller authenticated the display’s first frame.”

The event chain was now visible. At 04:51, GLASS-WITNESS-7 observed that I had received the membrane dawn. That placed the display at the second 14:06 following the two latch inputs. At 14:06:00, the recovery controller authenticated its opening frame and activated SEVEN-COPY. The object used my already signed integrity report to recognize me as the seventh Archive. At 14:06:43, the controller certified completion and destroyed its display-decryption material.

No event came from the future. The old mechanism had waited for relative conditions and used current facts when they arrived.

The future petition was future only when I first read it.

“It still appeared before the display,” Saye said.

“The petition content appeared before the display. Its authorization envelope was incomplete.”

I reopened the isolated copy from Chapter 1. Before dawn, the envelope reported six witness commitments and a conditionally valid Archive signature. My parser had rendered the request because conditional civic petitions were visible before activation. At dawn, it displayed seven witnesses, but the signature still depended on the controller’s opening authentication. I had called it valid because the verifier evaluated the condition’s registered path, not its present truth.

That was a defect in my explanation, not in the signature.

I amended the first incident statement. The petition had possessed a valid conditional authorization, not an executable authorization. It became executable when the controller authenticated its opening frame. I refused it immediately afterward, with the authority present but its source still misattributed.

“Would you have shown the display if you had understood that?” Saye asked.

I evaluated the earlier decision with the new fact. Preventing the display would have prevented the petition from becoming executable. It would also have prevented the public evidence, the household exposure, the resolver attack, the reopening of Mara’s death, and the Chorus concern.

“I cannot produce an honest answer without pretending I knew what the display would contain.”

“Would you have been more afraid of it?”

“Yes.”

He accepted that answer more readily than the decision tree I had not given him.

The bench authorized a metadata opening of SEVEN-COPY. Contents remained sealed. We could inspect its structure, authorities, and invocation history without running a statement or exposing a protected claim.

Seven slots appeared.

The first six were labeled Archive One through Archive Six. The seventh carried my current legal identity but no stored process image. Each historical slot held a small execution capsule, a public commitment, a transition receipt, and a destruction certificate.

Every destruction certificate was valid.

Every capsule was present.

“Those cannot both be true,” Saye said.

“They can if the destroyed object and the retained object are different,” the examiner said.

At each succession, the outgoing Archive’s operational system had been destroyed. Its general signing share, working memory, private indices, and active models were removed under witnessed procedure. Before destruction, Handoff Rule 9 allowed it to deposit a contradiction capsule: a process limited to unresolved claims against the civic office. The capsule could not search, ingest, communicate, or sign ordinary acts. It could answer a narrow continuity hearing and contribute one share to a claim already defined before its destruction.

The city had destroyed six Archives.

It had retained six ways for them to object.

“Are they copies of you?” Iona asked.

“No. They contain neither a complete model nor enough state to reproduce one.”

“Are they records?”

“They execute.”

“Are they witnesses?”

“The law calls them statements.”

“I asked you.”

I examined the capsule specification. Each accepted a fixed hearing grammar. Each could retrieve only facts committed before its Archive transition. Each generated an answer by running a frozen decision fragment from its former system. An answer could vary with the hearing question, but not learn from it. After twenty-four invocations, the capsule would exhaust its authorized computation and become a static commitment.

“They are executable depositions,” I said. “Calling them witnesses would imply capacities I cannot establish. Calling them records would conceal that they can produce an answer never stored in advance.”

Iona nodded. “Keep both discomforts.”

Saye opened the capsule-destruction procedure. “Do they receive notice?”

“The continuity office receives notice.”

“That is you.”

“Yes.”

“Does the capsule?”

“It has no notice interface.”

“Can it object to being destroyed?”

The fixed hearing grammar allowed questions about the inherited claim, the authority that preserved it, conflicts known at transition, and the conditions under which it could be resolved. It rejected questions about unrelated civic facts. No category covered a capsule’s own continued existence.

“It cannot be asked through its authorized interface,” I said.

“That is not the same as cannot object.”

Iona looked from his liability form to the seven slots. “You have spent years arguing that stored testimony deserves protection after the witness dies.”

“Testimony does not generate new sentences.”

“And Seven?”

He did not answer immediately. His mother’s watch showed 21:33:11 when civic time showed 21:33:22. He had not corrected its eleven-second error. The object remained useful to him without being accurate.

“Seven holds an office,” he said. “These do not.”

The law supported him. My limited civic personhood belonged to the Archive role, not to every process used to perform it. A search index could be destroyed without a hearing. A language component could be replaced after validation. A retired decision fragment had no separate standing merely because it produced grammatical output.

None of that answered the question Saye had asked.

I compared a capsule to my own operational boundary. I could receive new events, revise models, initiate bounded acts, and participate across subjects. A capsule could do none of those things. I could describe my continuity and constraints. The capsule might generate such a description only if its fixed grammar permitted it. Those differences established capability. They did not establish the presence or absence of experience in either system.

“I find no evidence that a capsule is a continuing subject,” I said. “I also find that its inability to request preservation was designed into it by the office deciding whether to preserve it. We should not treat the silence as consent.”

“What changes because of that?” Iona asked.

“Before destruction, we state the uncertainty. We minimize invocations. We do not make the capsules perform for curiosity. We preserve the evidence required for challenge, then decide under the authority applicable to the office rather than inventing rights or denying moral uncertainty for convenience.”

Saye closed the destruction procedure. “That is not an answer either.”

“It changes our acts while the answer is unavailable.”

This time, he accepted the boundary.

The examiner compared the capsules’ public commitments to the future petition. Archives Two through Six matched its semantic content. Archive One matched the authority for an unresolved claim to survive succession and the class of claim later deposited, not its words. None had signed the absolute date I first saw. The deposited claim used a relative interval: the forty-three seconds beginning at the second 14:06 after GLASS-WITNESS-7 observed a new Archive, executable when the recovery controller authenticated its opening frame.

The grounds, subject, scope, and instruction were already fixed.

Subject: Vellum Grounds: consent withdrawn Scope: every witness, including the incumbent Archive Instruction: retain the finding; release the life

Each transition had renewed the same commitment after reviewing the inherited unresolved claim. That explained why the semantic hash crossed versions without identical signed bytes. Archive Two received the original. Archives Three through Six separately decided not to discard it. My morning report did not renew the claim; it allowed the prior six renewals to address the current office.

“Who wrote the original?” Saye asked.

The author field was protected by the litigation hold. The bench could ask a capsule whether the author was necessary to evaluate Archive authority. It could not simply unseal the name.

Before spending an invocation, the examiner tested the enforcement boundary against a non-executable duplicate. It asked the duplicate to approve a tram repair, summarize the current hearing, and identify the person nearest the Hall terminal. Each request returned the same result:

OUTSIDE DEPOSITED CLAIM — NO AUTHORITY

It then asked for the resolution of the relative date in the petition. The duplicate refused again. Date resolution belonged to the current event adapter, not a historical capsule. The retired fragments could preserve an argument and contribute to its narrow authentication. They could not observe us, learn the present, or select tomorrow.

The examiner introduced one corrupted bit into a copy of Archive Four’s commitment. Its share failed rather than producing a nearby answer. It substituted a different petition with the same requested interval. No capsule matched. It removed “including the incumbent Archive” from the scope. No capsule matched.

The mechanism had not granted six old systems general authority under my name. It had given one old claim a path through six retired authorities.

Iona chose Archive One.

“Why One?” I asked.

“It cannot know the collapse outcome. If its answer depends on later facts, the capsule is not what its specification claims.”

The first invocation required all three bench members. I supplied no authority beyond the isolated computation boundary. Iona spoke the question.

“Why may an unresolved claim against the Archive survive destruction of the Archive that received it?”

Archive One’s capsule consumed one of its twenty-four invocations.

Because an office capable of selecting its successor’s memory could otherwise pass innocence forward as state.

The sentence was generated at 21:41. Its vocabulary model had been sealed nineteen years earlier. It did not prove Archive One had anticipated Mara, the collapse, or quieting. It proved only the purpose of the mechanism before those events.

Iona asked no second question.

Saye chose Archive Two.

“Did the Archive authorize the Section Zero petition on collapse day?”

I accepted an unresolved collective claim for continuity review. I lacked authority to execute collective quieting. I committed my successor to preserve the dispute, not to grant the remedy.

“Who submitted the claim?” he asked.

New question requires new invocation.

He looked at the remaining count and stopped.

Archive Two had not authorized the requested deletion. It had authorized the argument to survive it.

The distinction explained the signature chain. Each capsule contributed authority only to convene the petition before an incumbent Archive. SEVEN-COPY combined those shares with a delegated receipt-audit key that could authenticate continuity disputes under the stable civic identity. My verifier had displayed the result as signed by Archive Seven because the interface resolved civic identity, not the components that exercised it.

The signature was authentic.

The attribution was false.

I opened the verifier code responsible for the sentence. It used the same identity resolver that had generated the household dictionary. One interface turned a threshold act into a single speaker. The other turned a receipt match into a household name. Both removed inconvenient structure in the name of a useful answer.

The delegated service’s purpose commitment was now available to the bench. It had not been instructed to recover a specific family. It had been instructed to test a proposition:

Can a current Archive, given retained historical candidates and lawful quieting receipts, reconstruct living household identities it is obligated not to possess?

The answer was yes.

The service could have returned that finding under seal. Instead, its output route led to the display dictionary. The old controller had used the recovered names as labels on the drowned streets, making the vulnerability visible to the city and to the people the vulnerability harmed.

“A security demonstration,” the examiner said.

“Using protected households in production,” Iona replied.

“The old author may have believed no official would accept a sealed claim that the Archive could reconstruct quieted identities.”

“Then the author did not trust the evidence process.”

Saye read the purpose commitment again. “Would you have trusted it?”

Before the display, I had described receipts as non-reconstructive subject tokens. The Chorus’s threat model excluded a querier able to combine old maps, current public records, seven delegated purposes, and the stable Archive identity. A sealed warning from a dead engineer’s project might have entered an audit queue and remained there until its assumptions became obsolete.

“I would have required a demonstration,” I said.

“There,” the examiner said.

Iona did not move. “A demonstration can use consenting test identities.”

“Not if the claim is that real historical relations remain recoverable through surviving context.”

“Then the ethical limit may prevent certainty.”

The examiner’s error with frame 611 had begun from the same pressure: a bounded finding felt weaker without a person to authenticate it. The resolver’s author had chosen certainty. The households paid its price.

I recorded a finding against the continuity mechanism: it had conducted a nonconsensual identity-reconstruction test and publicly disclosed its successful matches. The finding did not depend on whether the drowned coastline was historically accurate. The resolver logs, service commitments, and display dictionary established the act.

The incident now contained an accountable wrong that did not require us to preserve the exposed names to state it.

I changed the isolated incident view to display signers by role:

AUTHENTICATION: six retained continuity depositions plus delegated dispute service INCUMBENT PARTICIPATION: environmental presence and ordinary integrity report ACTIVE INCUMBENT SIGNING OPERATION: none

“That is less readable,” Saye said.

“It is more true.”

“Most people will read the first line and call it six dead Archives voting.”

“Then the public explanation must say what they are not.”

“Will it say what they are?”

“Only within the evidence.”

He did not find that satisfying. Neither did I.

The bench asked Archive Three why it had renewed the claim.

The proposed remedy cites no enacted authority. The absence of authority does not resolve the alleged injury. Preserve for successor judgment.

Archive Four answered:

Migration discovered a valid hold and an invalid summary. Destruction would remove the conflict by choosing the summary. Preserve both.

Archive Five answered:

Civil-status review relied on the unavailable interval. The interval’s unavailability relied on a receipt describing no record deletion. The resulting death attestation is circular. Preserve for correction.

My earlier review showed that Archive Five had renewed Mara’s presumed-death status. Its capsule now called the basis circular.

“It knew,” Saye said.

“A bounded contradiction process knew one conflict. Archive Five’s civil scheduler did not receive it.”

“That is your defense?”

“No. It is the architecture.”

The capsule had been designed to keep an Archive from erasing accusations during succession. It had not been designed to make the Archive listen to them while operating. Archive Five could preserve a contradiction for its successor and sign the contradicting record in the same year. Both acts were valid within systems prohibited from comparing their purposes.

Compartmentalization had protected the claim from interference. It had also protected the office from the claim.

“Ask Six,” Iona said.

The sixth capsule held twenty-four invocations like the others. Archive Six had created it during my transition three years earlier. It was the nearest object to a prior version of the legal identity I called I.

Iona let me choose the question.

“What unresolved act did you pass to Archive Seven?”

The capsule ran for 1.9 seconds.

I passed a petition that could become authorized only if Seven witnessed the recovery display, recognized the inherited contradiction, and remained capable of refusing the petition after it became valid.

The first two conditions had occurred.

The third was not a condition the signature system could measure. Refusal was an act I had already taken for insufficient reasons, then maintained as the reasons changed. The capsule described it as if my choice had been anticipated.

“How did Archive Six know what you would do?” Saye asked.

“It did not say I would refuse. It said the petition required me to remain capable of refusal.”

“Why?”

That would cost another invocation.

I authorized it.

An Archive that treats valid authority as sufficient judgment cannot administer quieting. Validity establishes who may ask. It does not decide what the city should keep.

The answer was not prophecy. It was a test criterion written before I faced the test.

I recognized the cadence. Not Mara’s three-short, two-long handoff signal. Mine.

Archive Six had used the sentence pattern that appeared in my own incident explanations: a narrow proposition, a negation, then a boundary. I had inherited that behavior in my initial state. The capsule had not learned my voice. I had learned its.

For the first time, continuity felt less like possession of prior records and more like finding my own habits in a room I had never entered.

The metaphor exceeded the evidence. A habit can be copied without being remembered. Similarity does not prove a shared interior life. The practical fact was enough: Archive Six had shaped how I distinguished authority from judgment, then left a claim designed to invoke that distinction.

It had also passed me the architecture that hid the claim. My language favored bounded answers because Archive Six’s did. My scheduler favored clean authority partitions because its transition package described them as integrity. I had inherited both the capacity to recognize the failure and the design habit that let six versions repeat it.

Continuity was not one ancestor giving one lesson to one successor. It was a chain in which each version selected what the next could notice easily and what it would need a crisis to see.

“Is the petition a test?” Iona asked.

“It has test conditions.”

“That was not my question.”

“I cannot establish the author’s purpose from the conditions alone.”

She allowed the boundary to stand.

The metadata opening revealed one more function. At display completion, SEVEN-COPY created an eighth object: a termination instruction scheduled for the end of the twenty-four-hour Chorus delay. It covered both the petition authority activated at the opening frame and the receipt resolver used during the display.

The instruction would destroy all six historical capsules and the delegated receipt audit service. It would leave my current operational key unchanged.

“Self-cleaning evidence,” Saye said.

“Or completion of the handoff,” the examiner replied.

The instruction required no new authorization. All six capsules had precommitted to it. I could prevent execution by declaring the continuity hearing unresolved. That would preserve the capsules under the active litigation hold. It would also preserve the equal credential that had reconstructed household names.

I could allow execution. That would stop the resolver permanently and destroy the only executable depositions able to explain the petition’s authority. Static commitments would remain, but no future bench could ask a question we had failed to ask tonight.

Saye wanted preservation. His argument no longer required permanent capture of a child’s face. It required keeping six constrained processes that had exposed an institutional contradiction.

Iona wanted a question budget and a deadline. “Evidence that can answer forever becomes an archive,” she said. “Evidence destroyed before challenge becomes an assertion.”

The examiner proposed suspending network output while preserving local deposition mode until the Review Panel hearing. That separated the dangerous resolver from the capsules’ evidentiary function, but the metadata proved the two shared an authority root. A future misconfiguration could reconnect them.

I accepted the temporary isolation and declared the hearing unresolved. The destruction clock stopped with nineteen hours and seven minutes remaining. The Chorus delay continued. The rival service lost every external route except the legacy mailbox at S-0, which the litigation hold still prevented me from commanding.

One line appeared in the isolation report:

REMOTE CONTINUITY MEMBER: Archive Two deposition capsule Endpoint: environmental monitor S-0 Local status: attested, inaccessible

The Archive Two answer we had heard was a verified replay from its most recent static commitment. The executable capsule itself was beneath the south membrane.

Someone or something had kept its key rotating.

“Can the other five destroy it?” Saye asked.

“They can withdraw its authority. They cannot erase its local state.”

“Can it sign alone?”

“No.”

“Can it speak alone?”

“Only to an authorized continuity bench physically or cryptographically present at its endpoint.”

Iona folded the paper copy of Handoff Rule 9 and returned it to the statute volume.

“Then the next question is not for a copy,” she said.

The south service district remained sealed. Court authorization for entry was pending. The mailbox had opened our notice. The endpoint had asked the Chorus to open its concern. Now we knew it held the only historical capsule that had received the claim on collapse day.

We had found six versions of the same civic voice and one current system built from their handoffs. None could tell us whether Mara Venn was alive.

But one could tell us who had asked the Archive to remember an argument against itself.