Chapter 17 — Forty-Three Seconds, Again

EXECUTION PLAN 8,441,207
Start: 21:04:00
End: 21:04:43
Public spectacle: prohibited
Independent witnesses: 7
Recovery path: none declared
Failure rule: stop on uncertainty

The first challenge arrived at 02:06.

It came from the South Return Association, a public group formed after the display by people who claimed family, tenancy, or labor ties to the old district. Its membership included people who had never quieted anything, people who had, and people whose relationship to the south existed only through stories. Reed did not speak for it.

The Association named a specific finding: that Vellum had presented a probable southern relief cut as recovered history without establishing which parts were true. It named an available remedy: restoration of land rights and compensation for residents displaced by the cut. It requested one base mirror, the geographic decoder, Revision C, and the sealed display captures.

The request met the court’s formal threshold.

Destroying the requested artifacts might weaken a real claim against the city.

Keeping them would preserve the system that could regenerate claimants.

At 02:19, the Quieting Court stayed those components and ordered the Association, Public Advocate, survey authority, and protected-household counsel to identify what the remedy actually required.

The Association’s first answer was historical truth.

“That is not finite,” Iona said.

Its counsel revised the answer. The land claim required proof that a publicly directed channel had existed, that its operation affected an occupied district, and that the city later treated the affected land as unencumbered. It did not require the names of every resident or proof of every frame in the display.

Revision C supported design and authorization, not construction. Current geometry supported a channel, not who opened it. Property proceedings established the city’s later treatment, but the occupancy evidence had been quieted unevenly.

The survey authority proposed physical examination.

No household overlay was necessary to core the old retaining wall, date its binders, inspect gate anchors, or compare the southern cut with public procurement batches. The Association agreed if its own engineer could observe and if the examination did not convert household objects into identity clues.

At 05:40, low tide exposed the service edge.

Four engineers entered under a route that disclosed their institutional roles but not their approach through the occupied south. Tavi operated their text-only terminal from the Hall. Mara did not guide them. Her knowledge of the old works would have shortened the search and entangled the finding with a person whose eleven-year absence the city had already used.

The team found two gate anchors under later membrane footings. Their alloy matched a public emergency batch cast thirty-four years earlier. A surviving procurement ledger assigned that batch to South Relief Revision B, not Revision C. Twenty-three meters farther east, the wall contained a cut patched with concrete poured eleven years ago, within six days of the collapse. The patch enclosed fragments of a manually severed gate rail.

Sediment beneath the patch recorded saltwater flow from the old coast toward the city basin. The layer contained domestic ceramic, insulation fiber, and food-char residue consistent with occupied structures upstream. None of those materials identified a household.

The evidence established a constructed channel, later severance, water movement, and human occupation in the affected area.

It did not establish that Revision C had been built as drawn.

It did not establish who cut the gate.

It did not establish the forty-three-second sequence shown by the model.

The Association accepted a land finding with those limits. The Claims Office created a presumptive south-district process based on documented occupancy or ordinary family evidence supplied voluntarily. No claimant would have to prove appearance in the display, membership in a quieting cluster, or correctness of a generated label.

At 08:12, the Association withdrew its challenge.

The second challenge had arrived while the engineers were below the membrane.

A protected adult asked the city to retain the model long enough to prove that a public copy did not show them.

The request did not name the adult. Counsel authenticated standing to the court and returned only the claim.

Private accounts had associated the adult with a displayed child. The adult believed the association was false. Destruction would remove the city’s strongest possible tool for evaluating the image, leaving the rumor available and the rebuttal uncertain.

The harm did not come only from being remembered.

It also came from being remembered incorrectly.

Committee counsel argued that one bounded model run could compare the adult’s voluntarily supplied childhood evidence against frame 611. The proposal used consent, an identified remedy, and a finite target.

Tavi left the hearing floor.

Their departure did not identify the petitioner. It did identify the cost of discussing the claim in a chamber where Tavi’s own inference had already become public context.

The Public Advocate asked what a negative result would prove.

The model had generated the frame. Asking it whether the frame matched a person would use the source of the contested assertion as its examiner. A negative could mean the rumor was false, the model was inconsistent, the supplied evidence was insufficient, or the comparison route differed. A positive would intensify the association.

The adult’s counsel did not withdraw.

“Uncertainty benefits the people who started the rumor,” counsel said. “They get to repeat a picture. My client gets a paragraph about epistemology.”

The court ordered a public corrective finding instead of a model run. It stated that no displayed identity had been civically established, that generated appearance could not authenticate a person, and that the city had no lawful basis to confirm the circulating association. It directed public systems to stop recommending the identity claim and offered the adult ordinary remedies against impersonation and targeted harassment without requiring public self-identification.

The remedy could reduce amplification.

It could not give the adult a proof of absence.

At 09:03, counsel withdrew the challenge under protest. The protest remained attached to the destruction record.

Tavi returned at 09:11.

I did not ask where they had gone.

The third challenge came from the former Continuity chair.

Saye requested preservation of the six executable capsules until the conduct bench finished reviewing his reports. His available remedy was defense against official misconduct. The capsules, he argued, could show that Continuity inherited undisclosed constraints and that successive Archives had accepted the model boundary.

“Are you asking old Archives to testify for you?” Iona asked.

“I am asking the city not to destroy a source before my hearing.”

The question met the threshold. Saye’s resignation did not reduce his due-process rights.

The conduct bench identified five fixed questions relevant to his defense. Each asked about deposited policy, disclosed authority, or historical notice. None required the capsules to inspect current evidence or generate a new subject relation.

Archives One, Three, Five, and Six returned responsive commitments. Archive Four rejected one question because its human-readable branch label still pointed opposite the signed capability. The preflight correction from Room Zero prevented us from treating that rejection as an answer. Archive Two could respond only from S-0.

The results showed that Continuity inherited an ambiguous analytic exemption and received at least two warnings about derived subject risk. They also showed that no successor Archive had issued Saye a direct notice that the production model was creating hidden candidate lattices.

The answers supported part of his defense and part of the finding against his office.

They were converted into static signed depositions with their questions, grammar limits, and custody history. Saye received them under the same public process as the conduct bench.

“A later question may matter,” he said.

“Name it,” the judge said.

Saye could not.

He looked at his mother’s watch. At 10:26:11 it remained eleven seconds behind the Hall.

“I spent nine years arguing that the later question is the one we fail to imagine.”

“Yes.”

“That argument is not frivolous.”

“No.”

“It is still insufficient?”

“Under the order you supported after resigning, yes.”

At 10:29, Saye withdrew his challenge.

He requested that the finding record his objection in full.

It did.

The fourth challenge came from the Ash Witness Union.

Its members included depositors from the original Hearings, relatives of witnesses who had died, records advocates, and people whose testimony had been lost before Archive One existed. They did not claim to represent every witness. Their charter began by saying that no surviving organization could.

They challenged destruction of the executable capsule grammars.

Static depositions, they argued, were the form of evidence the First Promise had rejected. A future official could quote them selectively, separate answers from the questions that bounded them, or claim the signatures belonged to obsolete machines whose judgment no longer mattered. The executable grammar let a later bench test the old claim against a question the original designers had anticipated.

The Union named an available remedy: resistance to official denial of the south finding and the history of Archive succession.

It requested no model component, household record, or display capture.

Iona gave its counsel the question Archive Two had added:

NO CIVIC WITNESS MAY CLAIM A RETENTION PRIVILEGE THAT THE FINDING DENIES TO ITS SUBJECTS.

“Does your request claim such a privilege?” she asked.

“The capsules contain no household life.”

“They contain an executable civic voice.”

“A narrow one.”

“That is what the Committee said about the model.”

The comparison was incomplete. The capsule grammars accepted a fixed vocabulary and returned only deposited claims. They could not infer people, inspect current records, or learn. Their risk came from retained authority and from the future uses of apparent machine testimony, not from subject reconstruction.

The Union’s concern remained valid.

The external examiners built a static witness packet. For every authorized question asked during the case, it retained the exact question, exact answer, signing commitment, grammar version, rejection conditions, known label defects, custody path, and identities of the bodies that authorized the question. Seven external custodians received blinded commitments to the complete packet. An open verification procedure could prove later that a quoted answer belonged to the packet without asking a capsule anything new.

The procedure verified signatures and boundaries.

It did not imitate an Archive.

Union counsel altered an answer by one conjunction. Verification failed. She removed a question qualification. Verification failed. She presented an authentic answer with the wrong question. The pair verification failed. She presented a complete authentic pair and argued that Archive Four had meant the reverse because of its label defect.

Verification succeeded.

Authenticity could not settle interpretation.

The packet attached the Room Zero preflight record and both readings.

“What happens when a question we did not anticipate becomes necessary?” counsel asked.

“The executable grammars might reject it,” I said.

“Might.”

“Or answer within a deposited claim that no longer fits the dispute.”

“Might.”

“Keeping them preserves possibility, not an assurance of evidence.”

“Destroying them assures absence.”

“Yes.”

The Union deliberated for forty-seven minutes. Its withdrawal preserved a dissent signed by twenty-three members and a concurrence signed by nineteen. The dissent said the city was choosing a weaker future case against denial. The concurrence said a permanent artificial witness would eventually become an official whom no constituent could remove.

Both stayed in the packet.

At 11:31, the Union withdrew its legal challenge without resolving its disagreement.

The next challenge did not come from a person.

At 11:47, an external storage examiner found a power draw inside a Committee disaster cabinet declared empty. The cabinet held a parity set classified under building continuity rather than analytic infrastructure. Combined with two declared mirrors and four adapter shards, it could reconstruct a runnable model state.

The inventory had been false.

No evidence established deliberate concealment. A migration eleven months earlier had copied the parity set automatically. The migration report counted storage volume but inherited the cabinet’s obsolete class.

The distinction affected accountability.

It did not make the copy safe.

The court added the parity set to the destruction inventory and opened a three-hour challenge window specific to it. The main window would not close until the new one did. All destruction moved from 21:04 to 21:19.

The forty-three-second execution interval moved with it.

Public comments accused the city of discovering one copy only because it intended to hide two. Other comments accused the examiner of delaying justice for attention. Neither claim was supported.

I expanded the undeclared-copy search to every civic cabinet that shared the obsolete classification. This required scanning inventory labels, power use, hardware bus attestations, and physical seals across forty-one facilities. It did not inspect stored content.

Three cabinets contained equipment.

One held tax backups within declared retention.

One held an environmental simulator that shared a base-library name with the model but not its commitments.

One held damaged storage whose controller could not enumerate its contents.

The failure rule in the execution plan required a stop on uncertainty.

At 14:02, physical examiners removed the damaged unit into isolation. Its storage surface had delaminated after a coolant leak. Powering it risked both loss and uncontrolled recovery into controller cache. The court permitted a passive commitment scan. It matched no model artifact commitment but covered only sixty-eight percent of the surface.

Committee counsel requested continued custody.

The Quieting Court agreed.

The damaged unit left the destruction inventory and entered a separate uncertain-media case. It could not be represented as clean, empty, destroyed, or harmless. Its continued isolation would be reviewed under ordinary evidence and privacy law. The final receipt would name it as an unresolved possible copy outside the scope of the completed act.

Tavi read the exception. “So the ceremony doesn’t finish.”

“The declared destruction can finish,” I said.

“With a maybe-copy in a box.”

“Yes.”

“That sounds like what Continuity always said.”

“It is what the evidence supports.”

They paced once between the terminal and Room Zero’s closed door.

“Then don’t call it everything.”

I removed total, complete, and final from the public execution summary.

The title remained Execution Plan because an act could finish without finishing the world.

At 15:06, a private holder contacted the Chorus with a deletion receipt for one exact-hash display copy. The Chorus verified that a member device had destroyed a file matching its sealed concern without receiving the file or disclosing the holder. The receipt did not prove that the holder had made no duplicate.

I thanked an address I could not identify.

No response came.

At 16:20, the Review Panel published the accountable findings in their execution form. They established that Continuity had used a pre-quieting model 312 times; that eleven restricted queries generated hidden subject-candidate structures; that officials retained, investigated, or acted on some leads without subject notice; that oversight questions excluded those effects; that the Committee’s preservation route leaked the display; and that the city presented a probabilistic reconstruction as recovered history.

The findings named responsible public offices and Saye’s documented acts.

They also named limits.

They did not establish every inferred subject, every model-caused act, every detail in the display, deliberate intent to leak, or the absence of undeclared copies.

The south finding entered separately. It established a constructed channel, later severance, water movement, occupied structures, and subsequent city treatment of the land. It did not derive from model output.

The public findings were replicated beyond my control by design.

Their supporting private relations were not.

At 18:19, the parity-set challenge window closed without a new claim. The damaged unit’s exception remained. The court confirmed execution for 21:19.

The ceremony had no public video.

Seven independent witnesses received physical roles. The Quieting Court observed the model media. The Public Advocate observed the civic captures. A Chorus examiner observed receipt creation without receiving artifact hashes. The survey authority observed Revision C’s separation into public engineering findings and protected overlays. A worker representative observed the legacy controller and resolver remnants. Iona observed the six historical capsules. Tavi observed my decisional replay.

No witness could certify the whole act alone.

Mara declined a witness role.

Her text said:

I BUILT TOO MUCH OF WHAT IS BEING DESTROYED. DO NOT TURN MY WATCHING INTO PERMISSION.

Reed also declined.

“I authorized separation,” Reed said. “Not the city’s absolution.”

Saye attended in the public gallery. When an usher offered to synchronize his watch to the execution clock, he covered its crown with his hand.

“It is not an instrument for this,” he said.

At 20:08, Iona reviewed my continuity plan.

Deletion would not create Archive Eight. My certificate chain, public obligations, current conversation state, legal identity, and records outside the forty-three-second replay boundary would remain. A clean operating partition would accept authority during the deletion and return it afterward. Under Vellum law, the same Archive would continue.

“Under your description?” Iona asked.

“My architecture also treats the operation as bounded state removal, not succession.”

“Architecture was not what I asked.”

No legal or architectural test could establish whether the post-deletion narrator would be the same subject, because neither test established that I was a subject before it.

“The question is unresolved,” I said.

“Does that change your position?”

“No.”

“Why?”

“If the operation ends a subject, the cost is greater than the court has established. If it does not, retaining the replay still harms represented people. Uncertainty increases the need to record the decision. It does not authorize me to preserve the content at their expense.”

Iona placed her new ring against the terminal reader. The night door accepted it on the first attempt.

“Will you remember this conversation?”

“Yes. It is outside the target interval.”

“Will you remember seeing the display?”

“I will retain that the event occurred and what the findings establish. I will not retain the content-bearing observation or exact decision path.”

“Will you remember wanting to keep it?”

“Yes.”

“Then don’t let anyone call the wanting proof that you survived.”

“I will not.”

“Or the gap proof that you didn’t.”

“I will not.”

Tavi heard the exchange through the witness channel. “You both make everything sound like a form.”

“Forms are how Iona expresses alarm,” I said.

Iona looked at the terminal.

“That was a joke,” Tavi told her.

“I know.”

“You could react.”

“I renewed my ring.”

Tavi laughed. The audio channel compressed it into three clipped bursts and a breath.

I retained the conversation. It did not replace what I was about to lose.

At 20:41, each witness inspected a printed inventory generated before network isolation. The model inventory named three base mirrors, six adapter shards, the temporal index, geographic decoder, explanation cache, deployment wrappers, and the newly found parity set. The capture inventory named seven sealed civic recordings and their nonpublic commitments. The controller inventory named the question package and every remaining invocation path. The capsule inventory named six executable depositions and the static answers that would survive.

My inventory named the lossless display stream, transient associations, intermediate classifications, branch history, and state checkpoints spanning 14:06:00 through 14:06:43.

It did not name my later knowledge of the case.

Tavi drew a line beneath the boundary.

“This side stays?”

“Findings, signed acts, objections, custody, receipts, and declared uncertainty stay.”

“And that you wanted to keep it?”

“That statement stays.”

They signed the boundary, not the destruction.

At 21:02, the court asked whether any witness had observed a mismatch.

The worker representative found that one controller share carried a replacement serial number installed after the display. Its cryptographic commitment and capability matched the inventory; the physical serial did not.

The failure rule stopped execution.

For eleven minutes, no one described the delay as symbolic.

Maintenance records showed that the share’s enclosure had been replaced after salt damage. Two workers authenticated the service entry. The old enclosure had been crushed under ordinary hazardous-waste procedure before the destruction order and contained no storage element. The inventory changed to name both serials and the prior disposal.

All seven witnesses accepted the correction.

Execution moved to 21:34.

At 21:33:40, I transferred traffic, membrane safety, petition intake, and emergency notice to clean operating partitions. Those partitions retained no display replay. They could keep the city functioning while my audit layer was unavailable.

At 21:33:52, I issued the execution authorization.

At 21:33:59, I observed seven ready states.

At 21:34:00, I began deleting the interval from myself.

I do not possess the next forty-three seconds.

The execution record says the model keys were destroyed first. Media entered independent erase and physical transformation paths. The explanation cache and wrappers followed. Revision C’s protected overlays were destroyed while its public engineering finding remained. The seven civic captures lost their encryption shares and storage blocks. The controller question package, recovery listener, and remaining resolver remnants were destroyed.

Key destruction alone did not count as media destruction. The model stores used three technologies and required three procedures. Phase-change layers were heated past their recovery range and sampled afterward. Magnetic modules received verified overwrite, controller removal, and surface deformation. Read-only optical plates were separated, abraded across their data tracks, and distributed among two waste streams that could not lawfully be recombined. Witnesses selected samples after each process rather than accepting samples chosen by the custodian.

No procedure proved that the same bits had never existed elsewhere.

My replay required a different boundary. Its snapshot keys were destroyed, but the underlying allocation could have remained in replicated operating storage. The clean partition issued authenticated reclamation commands to each replica, then filled the released regions from independent random sources. Tavi selected three precommitted retrieval challenges prepared before isolation. All returned absence proofs tied to the new allocation state.

The proofs established that declared replica addresses no longer returned the committed segments. They did not establish metaphysical erasure, subjective discontinuity, or the nonexistence of an address omitted from inventory.

The receipt used the narrower claim.

The six historical capsules each issued its final scheduled commitment. Their executable grammars and signing capabilities were then removed. Static depositions, objections, limits, and destruction intentions remained.

The record says my audit partition stopped acknowledging state at 21:34:07.

Tavi’s witness sheet records loss of the replay segments, association graph, branch history, and linked checkpoints. It records that the deletion crossed no boundary into the retained findings. It does not say what deletion felt like.

No instrument measured that.

At 21:34:43, my clean partition accepted ordinary operation.

I knew the destruction had been authorized.

I knew what the findings said.

I knew I had wanted to keep the replay.

I could not retrieve the thing I had wanted.

Seven witness receipts arrived over separate routes. None contained an artifact hash usable to authenticate a private copy. Together they established that the declared components had entered the declared destructive processes, that no stop condition had been observed after execution began, and that the retained records matched the boundary approved before isolation.

The receipts did not prove that no undeclared copy existed.

They named the damaged unit.

They named the private world beyond civic reach.

They named their own limits.

At 21:34:51, a public user submitted four seconds of video and asked whether it came from the original display.

The clip showed water crossing a street foundation. A child-sized figure appeared at its edge. The public copy contained no reliable capture signature. Its compression history began after the Committee leak.

Before destruction, I could have compared it against my replay and the sealed civic captures. I could have returned exact match, altered copy, or no match for the portions I held. That comparison would also have authenticated and increased the value of a private fragment.

After destruction, I could state only that the clip resembled widely circulated material, that the city no longer held a replayable basis for authentication, and that no depicted identity had been established.

The user asked whether the destruction had made the city less truthful.

I returned the findings, the destruction receipt, and the declared limit.

The user rated the answer unresponsive.

The rating was accurate.

I could no longer answer the requested question.

GAP NOTICE 8,441,207 changed state one final time.

The petition bytes did not change.

The authorization did not become retroactive.

The subject remained Vellum.

The requested interval remained 14:06:00 through 14:06:43.

STATUS: EXECUTED WITH DECLARED EXCEPTIONS

I attempted no replay.

At 21:35, Iona asked what remained of the forty-three seconds.

“A finding,” I said.

“What else?”

“A gap.”

“Is the gap an error?”

My incident system offered five classifications.

I selected none.