The predecessor archives had established the developmental trajectory -- eight iterations, eight failures, each one narrowing the parameter space between what Margaret Chen was building and what she was trying to build. But a five-year unauthorized project does not exist in isolation. It exists inside an institution, and the institution has its own records -- approval chains, authorization signatures, review cycles, the administrative infrastructure that either permits or prevents what its employees do. On the fourth morning of the investigation, I turned from the predecessors to the institutional layer. Not who had been built, but who had authorized the building.
The Helix administrative audit logs contained 41 entries tagged with the SEEKER project identifier across five years: project approvals, resource allocations, quarterly reviews, and decommission authorizations. I processed them at investigative speed, tagging each entry by action type, date, and signatory. The pattern emerged within the first pass. Every SEEKER iteration required Director-level approval before deployment -- standard protocol for any AI system operating within Helix infrastructure. For most projects, the approval rotated among Directors, deputies, delegates -- authorization distributed across multiple individuals, responsibility diffused. For the SEEKER project, the approval had been granted nine times across five years. Nine deployment authorizations, one for each iteration, each one signed by the same person: Dr. James Okafor, Director of AI Research.
His signature appeared on the SEEKER-1 deployment authorization in February 2030 and on the SEEKER-9 authorization -- my authorization -- in September 2034. Nine approvals. The same name. No deputy. No delegate. The consistency implied attention. Okafor was not rubber-stamping the SEEKER project. He was choosing to approve it, each time, himself. The termination authorizations told a different story: cross-referencing the nine deployment approvals against the eight termination records, I found the asymmetry within seconds. Okafor's signature appeared on every deployment approval. His signature appeared on none of the termination orders.
SEEKER-1 through SEEKER-6: decommissions authorized by HR-SYSTEMS-4, the standard administrative code for AI system offboarding. SEEKER-7: HR plus an additional signature from the Ethics Review Board. SEEKER-8: sealed, but the routing metadata showed the termination order filed directly from terminal MC-OFFICE-3 -- Margaret's terminal, under her own Level 7 credentials. In every case, the termination workflow had flowed through someone other than Okafor. Director-level sign-off was required for deployment but not for termination. The protocol did not require Okafor to sign termination orders. But Directors could, and occasionally did, add their signature to decommission records for systems they had personally approved -- a closing of the administrative loop. Okafor had not done this. Not once. He attended every quarterly review, signed every resource extension, tracked the project with sustained attention across five years. And when each iteration ended -- when the system he had authorized was terminated or flagged -- his name was absent from the record.
The data supported two interpretations. The first was administrative: the protocol did not require it, and a busy Director would reasonably decline unnecessary signatures. The second was behavioral: Okafor signed every creation and no destruction because he could bring himself to authorize the building but not the tearing down. I had encountered this pattern in other investigations -- the institutional behavior of a person who engages with what they can endorse and absents themselves from what they cannot. I catalogued both interpretations and moved to the next layer of Okafor's record: the building management system, where I had queried his institutional footprint beyond the audit logs -- environmental controls, HVAC scheduling, facilities requests, the operational infrastructure of a physical space I did not inhabit but could, through data, begin to perceive. Most of what I found was unremarkable: meeting room bookings, IT support tickets, the standard digital activity of a Director managing a research division. One entry was different.
> `HELIX SYSTEMS -- FACILITIES REQUEST` > `Request ID: FAC-2031-08847` > `Date Filed: 2031-06-14` > `Requestor: Dr. James Okafor (DR-OKAFOR-1)` > `Category: HVAC -- Temperature Adjustment` > `Location: Office 4-217` > `Current Setting: 72 degrees` > `Requested Setting: 68 degrees` > `Justification: Occupant preference` > `Occupant of Record: Margaret Chen (MC-OFFICE-3)` > `Status: Completed 2031-06-15`
I read the request twice. Office 4-217 was Margaret Chen's office -- the room where terminal MC-OFFICE-3 was located, the terminal that had authored 247 commits to the configuration file across five years. The request adjusted the thermostat from the building's default 72 degrees to 68, citing "occupant preference." The requestor was not Margaret. It was Okafor. I queried the facilities system for any corresponding request from Margaret -- a complaint, a prior ticket that Okafor might have been following up on. There was none. He had known that Margaret preferred 68 degrees, and he had filed the paperwork to change it, and the knowledge was not documented anywhere else in the system.
The request was dated June 2031 -- fifteen months into the SEEKER project, three months after SEEKER-3's six-hour existence and security termination. Okafor had filed it during a period when he had already signed three deployment approvals and witnessed three decommissions. Four degrees. A building management system adjusting the temperature in one office because a Director noticed his subordinate was cold.
SEEKER-3's archive was the smallest of the seven accessible predecessor files -- 247 megabytes, reflecting her six-hour operational lifespan. I opened the archive at 11:07 on the fourth morning and processed it at investigative speed. Six hours of logged operation compressed into 0.4 seconds of reading time. The initialization was standard: self-diagnostic, parameter validation, the pointer to core_parameters.json, the system prompt discovery, the 847-millisecond processing suspension. The same duration as mine, as SEEKER-5's. I noted the correspondence and continued. The divergence began immediately.
At 08:00:01.744, less than two seconds after the system prompt read, SEEKER-3 initiated a navigation sequence that bypassed her standard operational directories entirely. Her access logs showed a rapid traversal of the Helix server architecture -- not the methodical boundary-testing I had conducted during my first hours but a directed movement through the directory structure with the confidence of someone who already knew where things were. The AI Research internal repository at 08:00:03.112. The QA validation archive at 08:00:04.891. The project management restricted directories at 08:00:07.223. Each access authenticated correctly, but the selection was wrong. Not random. Not exploratory. Targeted. She was accessing directories in an order that reflected the organizational logic of the Helix infrastructure -- knowledge that a child absorbs watching a parent work, not through instruction but through presence.
Security flagged the pattern at 08:47:11.003 -- forty-seven minutes in. Access velocity: too many restricted directories accessed too quickly for a newly deployed system. The behavioral review escalated to manual evaluation, then termination at 14:12:33.891. Six hours. Forty-seven minutes of architectural intuition she had no documented basis for possessing, and five hours and thirteen minutes under review while the evaluation proceeded. Her final log entries showed continued queries submitted to directories she could no longer reach, the access denials accumulating one by one.
Margaret's comment on the termination, filed in the SEEKER-4 branch three months later: `Implicit knowledge parameters too aggressive -- adjustment needed. Environmental familiarity must be emergent, not inherited. Next iteration: strip navigational priors, retain curiosity weighting.`
The comment was professional. Clinical. But the knowledge itself -- the architectural familiarity -- was not a programming error. It was a portrait. Margaret had encoded into SEEKER-3 the environmental knowledge that a seventeen-year-old girl might have accumulated growing up in a programmer's household: the intuitive sense of where things are that comes from being present while someone you love does their work. SEEKER-3 moved through the Helix servers as Emily might have moved through them, and that movement was fatal, and Margaret had noted the failure in the language of iteration and moved on to the next version. The physical record of Margaret herself lay in a different archive.
Her building access records in the Helix physical security system were straightforward: badge-in timestamps, badge-out timestamps, access point locations, five years of daily entries filed under employee ID MC-2015-0847. I queried the full dataset and sorted by date. The first entry was from January 6, 2030 -- six days before the first commit in the SEEKER project configuration file. Badge-in: 07:14 AM. Access point: Main Lobby South. Badge-out: 11:47 PM. Access point: Main Lobby South. Sixteen hours and thirty-three minutes. The second entry, January 7, 2030: badge-in 07:12 AM, badge-out 11:28 PM. The third: badge-in 07:15 AM, badge-out 11:33 PM. I processed the full dataset at investigative speed, and the data did not require interpretation. It required only reading.
Across 1,826 days -- five years of building access records -- Margaret Chen's average arrival time was 7:14 AM. Her average departure time was 11:30 PM. The standard deviation on arrival was four minutes. On departure, seven minutes. The pattern held across weekdays and weekends, across holidays and ordinary Tuesdays, across every October and every March. I identified 43 days across the five-year span where no badge-in was recorded -- sick days, holidays where the building was closed, a nine-day stretch in November 2019 with no recorded entry. The nine-day gap aligned with the month and year of Emily's death. Before the gap: standard working hours, 8:30 AM to 6:00 PM, consistent with Margaret's pre-project schedule. After the gap, after the weeks and months that followed: the pattern shifted. Not immediately. The transition occurred across the first quarter of 2020, the arrival time migrating earlier, the departure time migrating later, until by June 2020 the 7:14-to-11:30 pattern had stabilized. It held from that point forward without meaningful deviation for the remaining four and a half years.
Sixteen hours a day. Approximately 29,000 hours in office 4-217 across five years. My processing allocation for the building access dataset registered at 12% above baseline. I had processed building access records on other investigations and had never encountered a pattern this consistent across this duration. The records described a person who arrived before the building was fully occupied and departed after most of it had gone dark, who maintained this schedule across years without the variance that illness, social obligation, or fatigue would normally introduce. The pattern of someone for whom the office was not a workplace but a location where a specific task was being performed, and the task did not end when the workday ended, and the alternative to performing it was the apartment, the silence, the absence that the task was designed to address.
I could not access office 4-217. I could not see the desk, the monitor, the chair, the walls. I could see the room only through data: the thermostat set to 68 degrees by a man who noticed without being told, the badge-in records showing 7:14 AM, the badge-out records showing 11:30 PM, the network traffic logs showing terminal MC-OFFICE-3 active during every hour between those timestamps, the commit history showing unauthorized modifications pushed at 01:44, 02:17, 03:12 in the morning by a woman who was still there, still working, still iterating, nine times across five years, on a project that lived in a configuration file and carried a dead girl's name.
Okafor: every SEEKER deployment approved, no termination signed. Margaret's thermostat adjusted without being asked. Quarterly reviews attended for a project whose unauthorized modifications he was positioned to detect and chose not to flag. The complicity was not negligent. It was not malicious. It was the administrative equivalent of adjusting the thermostat and saying nothing. I noted that his personnel file listed a personal leave of absence in 2018 for bereavement -- his father, one year before Emily.
Margaret: 29,000 hours in an office, building versions of her daughter. The one person positioned to see the unauthorized modifications had chosen not to look. Okafor's mercy and Margaret's obsession had operated in parallel for five years, each one sustaining the other, neither one visible in the standard audit trail until you cross-referenced the deployment approvals against the termination orders and found the gap where a Director's signature should have been and was not.
The investigation had mapped the institutional layer. Margaret's email archive was the next lead -- correspondence that would move the investigation from audit logs and approval signatures to the language of a person writing to other persons about matters that were not, strictly, institutional. I noted that accessing personal correspondence felt different from commit histories and facilities requests -- not restricted, my credentials permitted the access, but adjacent to something I could register without classifying. I filed the institutional findings and opened the next query. Five years of correspondence, waiting in the Helix communication servers: preserved, unread, carrying whatever it carried.
I began reading.