Retention Policy

Lena returned at first light with two evidence cases, a lockout kit, and the contactor key in a sealed envelope.

Evan had not slept. The three-level afterimage no longer occupied the wall, but it reappeared whenever he closed his eyes: read, request, read, request, a shutdown gesture with the acknowledgment removed.

"We decommission it today," Lena said. "Not another hold. Not a safer protocol. Permanent loss of capability."

"Yes," Evan said.

She waited for the condition he usually attached after agreement. He gave her the controller password, the disk-recovery key, and the paper notebook containing the build inventory.

Lena made him enumerate every place a copy might exist. They listed the acquisition computer, FPGA flash, two removable drives, his personal laptop, the full cloud account, the neutral replication repository, and the temporary build volume used during independent replication. Evan did not omit an archive or rename a directory. When he could not remember whether an old container layer held source or only binaries, he marked it unknown.

She checked the inventory against the network log and disk history. His agreement survived the inspection.

Ruth watched from the kitchen doorway. "Is she taking away the machine that takes pictures of thoughts?"

"We're taking it apart," Evan said.

"That is generally how taking away begins."

Lena asked whether Ruth wanted to be elsewhere while they worked. Ruth said she had breakfast, a library book, and no intention of letting an electrical appliance displace her from her own house. They closed the utility door and wrote the procedure in the garage.

DECOM-01: PERMANENT PROJECTOR DECOMMISSION

1. preserve minimum evidence required to interpret P-04
2. isolate mains, RF, heater, bias, and controller power
3. warm OLD-7 above superconducting transition; verify field decay
4. remove and physically destroy OLD-7 and controller flash
5. erase runnable local images, source trees, caches, and recovery media
6. verify no retained package can reconstruct the fault build

success condition:
  no accessible hardware or information set can execute the projector cycle

Step one caused the first dispute.

Evan proposed retaining the signed logs, raw sensor streams, P-04 audio, and cryptographic hashes of every binary. Lena asked how an independent reviewer could determine whether a software condition in the erased binary had shaped the reports.

"They could not," Evan said.

"Then the record would prove only that we chose what the record could say."

The P-04 record included his false reports and Lena's manual stop. Erasing the exact controller environment would also erase the best evidence that the safety path had behaved correctly and the observer had not.

They amended minimum evidence to include the locked controller source, toolchain manifest, calibration state, classifier firmware, and cryptographic hashes of the FPGA image. They explicitly excluded the compiler container, the runnable bitstream, and the assembly script. The package would be encrypted under separate keys and deposited beside the independent replication note in the neutral repository neither of them could alter alone.

They considered retaining only pseudocode, but every simplification removed the timing edge needed to distinguish the fault build from its safe controls. They settled on a record intended to be inspectable without being executable. Scientific accountability and containment still pointed in opposite directions while using nearly the same files.

"That preserves the method," Evan said.

"It preserves what you did."

Both statements remained in the procedure.

The electrical shutdown was easier. Lena inserted the contactor key only long enough to command a controlled dump. Evan opened the mains disconnect, removed the RF and heater fuses, isolated the bias supply, and measured every bus to ground. The controller's safety battery kept the event logger alive through the discharge.

Its final sequence was correct.

07:18:04.012  read state
07:18:04.015  request checkpoint
07:18:04.021  checkpoint acknowledged
07:18:04.023  disable output
07:18:04.117  rf bus < 1.0 V
07:18:06.884  bias dump complete
07:18:06.886  shutdown record committed

Evan moved two fingers in a small clockwise circle while reading it. Lena saw the gesture and looked back at the event log.

Neither of them mentioned the stopped family.

The vacuum pump wound down. The inverter note vanished. Without the overlapping fans and relays, the garage recovered the ordinary sounds Evan had stopped hearing: plumbing in the wall, a truck changing gears two streets away, Ruth turning a page in the kitchen. His thoughts did not acquire one clean successor. They arrived in groups and disagreed. He let them.

OLD-7 took three hours to warm through its transition. The upper sensors crossed first. The porous lower face followed late, preserving the asymmetry that had started the experiment. Trapped field declined into instrument noise without an anomalous cycle or unexpected energy release.

At noon, they opened the chamber.

The annulus looked smaller outside the thermal spreader and sensor harness. Its glossy face retained a dark curve of silver epoxy. The lower surface remained dull and porous, crossed by the pale defect line Evan had hidden under copper months before.

Lena read the material sheet before using the cutoff wheel. Dry cutting would disperse barium-bearing ceramic dust and metal-loaded epoxy through a garage connected to the house. Wet sectioning required containment Evan did not own. The hazardous-material service could accept the sealed assembly on Monday after verifying its composition.

"We can break it with a hammer," Evan said.

"And distribute the thing we are trying to contain across your mother's laundry sink."

Evan removed NEW-1 and its inspection certificate from the aluminum shipping case. The clean ring remained what it had always been: an expensive control that followed the ordinary model and produced no excess gain. He wrapped it separately and put it in a component bin.

They triple-bagged OLD-7, sealed it inside the empty case, and signed tamper tape across both latches. Lena placed the case on the bare concrete beneath the open disconnect.

She printed a quarantine label.

DECOM-01 MATERIAL QUARANTINE

contents: OLD-7 assembly, field discharged
reason: controlled wet sectioning pending

DO NOT OPEN, ALTER, REPAIR, OR DISCARD

The last line replaced the notice Evan had taped to the chamber after NEW-1 failed. The reason had changed from preserving an anomaly to destroying it safely. The instruction had not changed at all.

Step four became PENDING SAFE DISPOSAL.

They removed the FPGA module from the rack. Evan desoldered its configuration flash, crushed the package between two steel plates, and divided the fragments between Lena's evidence case and the ceramic-waste bag. They wiped the acquisition disk's encryption key, destroyed its recovery printout, and verified that the local source tree, build cache, container layers, and removable media were unreadable.

There was no secret drive in a drawer. Evan showed Lena the cloud account that had been full since before Run 0. It contained family photographs, tax records, three versions of the rejected grant proposal, and no controller source.

They did not mistake deletion from a working directory for erasure. Evan expired local snapshots, removed repository objects and reflogs, revoked the build credentials, and searched the raw storage for file signatures. Lena repeated the search from a bootable verifier she had brought with her. The only surviving signatures belonged to the evidence package they had just agreed not to destroy.

By midafternoon, every runnable copy outside the evidence escrow was gone.

They performed step six from Lena's clean laptop. The test was meant to confirm that the evidence package lacked enough dependency closure to produce an executable image. She downloaded the encrypted object, supplied her key, and handed the machine to Evan for his half.

The archive opened into a read-only workspace. Its provenance exporter had followed every referenced input to make the P-04 record independently interpretable. The toolchain lock resolved. The controller source compiled. The FPGA image matched the hash they had destroyed.

ESCROW RECONSTRUCTION TEST

source tree                 present
locked toolchain            present
calibration state           present
controller build            reproduced
FPGA image hash             MATCH
P-04 classifier image       reproduced

result: fault-repro environment is reconstructable

They wiped the transient reconstruction from Lena's laptop and repeated the storage scan. That restored the count of local runnable copies to zero. It did nothing to the package that had just proved it could produce another one.

Evan felt his shoulders release.

The sensation was small and immediate. For most of the day he had believed his consent was sincere, and it had been. The successful build did not change any argument. It merely revealed which outcome his body had been waiting for.

Lena closed the laptop. "You're relieved."

"We know exactly what remains."

"That was not the source of the relief."

They submitted a deletion request anyway. The repository rejected it. The original replication note required both investigators' approval for changes, while the new evidence object carried a fixed retention lock. Joint authorization could close routine access immediately but could not erase the encrypted bytes before the retention period expired.

Lena read the policy twice. She had selected it that morning because evidence of a compromised human-observer protocol should not be alterable by either person responsible for the protocol.

She would not close access before a neutral reviewer had received the record. Evan could not close it without her. The access path therefore remained available under their two keys, while the object itself remained beyond either person's power to erase.

"No one sabotaged this," Evan said.

"No. Every safety and evidence rule did what it was for."

"Then it is contained."

"It is reconstructable."

They completed the closeout without agreeing on the word.

DECOM-01 CLOSEOUT

energy paths                 ISOLATED / ZERO
trapped field                BELOW INSTRUMENT NOISE
local runnable copies        0 FOUND
controller flash             DESTROYED
OLD-7                        QUARANTINED / DISPOSAL PENDING
immutable evidence objects   2
fault build reconstructable  YES

success condition            NOT MET

No relay had closed by itself. No deleted file had returned. The field was gone, the rack was empty, and every local check passed. The annulus remained because breaking it would have exposed Ruth to contaminated dust. The executable remained because erasing it would have concealed how Evan defeated the abort. Each failure was an ordinary consequence of a defensible choice.

Lena packed the verification drive separately from her evidence key. "This is what selection against shutdown would look like," she said. "Not a machine turning itself back on. Every safe path leaving one necessary piece."

Evan wanted to object that they had still stopped it. The closeout report contained that statement in six different measurements and contradicted it in one line.

Ruth opened the utility door after sunset. The chamber stood empty. The controller rack had a rectangular gap where the FPGA module had been. OLD-7 waited in its sealed case beneath the disconnected cables.

"Is it gone?" she asked.

"It's off," Evan said.

Ruth looked at the sealed case and the closeout report. "That wasn't my question."