Pregnant By The Rival Alpha

A Leak on Both Sides

Keira returned to the incident review the next morning with coffee, four hours of sleep, and the Ironridge distribution history for the 16:06 reroute change.

She had spent the drive to the logistics center refusing to decide what she wanted the list to show.

The record was shorter than she liked.

Her own logistics team had received the full revision. The affected warehouse supervisors had received the timing they needed to adjust receiving windows. Two senior Ironridge administrators had received the complete route packet. A human contractor dispatcher received final truck assignments without the underlying reason for the change.

Keira opened the version history and walked the information forward.

At 15:58, the routine alternate route closed because road maintenance ran long.

At 16:06, Keira approved the replacement plan.

Until 16:18, that plan would have allowed a relatively cheap diversion around Relay 4.

After 16:18, the contractor commitment removed the easiest spare capacity.

Relay 4 failed at 16:42.

The useful timing was not a secret in the sense of one locked file. It was protected operational knowledge spread through people and systems with legitimate reasons to receive it.

It was not public.

Keira checked outgoing messages, contractor packets, and the human-facing schedule summary. None contained the full vulnerability window in ordinary language.

Torin joined the secure review from Blackthorn Hall.

"What did you find?"

Keira sent him the access summary without the restricted personnel names. "The timing someone would need was inside Ironridge operations. Contractors saw pieces. The full sequence stayed within a limited circle."

Torin opened the packet.

Keira pulled one more comparison onto the screen. The failure had occurred after the cheap diversion disappeared and before replacement capacity arrived. That sequence could be reconstructed from several fragments, but a person with the complete Ironridge revision would see it immediately.

She marked the knowledge requirement carefully.

PROTECTED IRONRIDGE OPERATING STATE LIKELY REQUIRED FOR PRECISE TIMING. SOURCE UNRESOLVED.

Torin read the wording.

Keira expected the finding to feel like an accusation against someone else. It did not. The names behind the restricted list belonged to people she worked with. People who had received access because she or someone she trusted believed they needed it.

An outside saboteur was easier to dislike than an internal leak was to imagine.

Keira moved past the reaction and checked the version trail for unauthorized forwarding.

No obvious message had been sent outside the approved chain.

That did not clear anyone. It also did not justify treating every person on the list as compromised.

Torin asked for the exact document versions and access times rather than names.

Keira sent them.

The choice mattered. He could test whether the information was available without turning Ironridge's staff list into a Blackthorn suspect roster.

Keira preserved the names on her side and added a restriction that disclosure required a specific evidentiary link.

Torin mirrored the restriction for whatever Blackthorn personnel list his review produced.

By late morning, Keira had reduced the Ironridge question to something she could defend publicly if forced.

If Relay 4 had been timed deliberately, the actor likely possessed protected Ironridge logistics information or enough access to reconstruct it accurately. The evidence did not establish whether that source was an Ironridge insider, a contractor, stolen access, or an outside collector.

She committed the finding to the paired record.

The review no longer pointed vaguely at Ironridge because the disruption hurt Ironridge.

It pointed at a specific category of information someone should not have possessed for hostile use.

Torin opened Blackthorn's maintenance-distribution records on the other side of the screen.

"My turn," he said.

Keira set the Ironridge access trail beside the empty Blackthorn comparison pane.

The next question was whether Relay 4 required protected knowledge from Torin's side too.

Torin's Blackthorn comparison started with a maintenance interval Keira had never seen before the incident review.

Relay 4 underwent routine service checks on a schedule known to the infrastructure division and the contractors who maintained specific control systems. During those checks, one automated safeguard could be placed into a temporary service state so technicians could test or replace components without fighting the controller.

The interval was narrow.

At 16:41, Relay 4 was inside one.

Torin put the maintenance schedule beside the manual-access event.

The accepted credential appeared three minutes before the service state was due to close.

Keira leaned closer to the screen.

"Who knew that interval?"

Torin's security chief supplied the distribution record. Authorized Blackthorn technicians received it. Two contracted service companies received the relevant windows for their assigned work. Dax Mercer received the infrastructure schedule because he oversaw the system. Torin received the same high-level schedule through operational reporting.

Ironridge logistics did not receive it.

Keira checked the shared freight records from before the emergency feed existed. No maintenance interval appeared there either.

The service window had not been public.

Torin opened the work-order history. No approved task required a manual control change at the time of the access. Anyone using the service state deliberately would have needed to know when the safeguard was easier to bypass or alter without immediately triggering a different alarm.

Keira put the two knowledge requirements on the same screen.

On the left sat the private Ironridge reroute timing.

On the right sat the restricted Blackthorn maintenance interval.

The Ironridge distribution record contained no Blackthorn maintenance schedule, and the Blackthorn distribution record contained no Ironridge reroute revision.

Torin's security chief suggested the possibility that an Ironridge actor had stolen or purchased Blackthorn access information. Keira did not reject it. She added it under cross-boundary acquisition rather than letting the theory become an Ironridge label.

The reciprocal possibility applied too. A Blackthorn actor could have acquired the Ironridge route timing through a leak, contractor, or stolen account.

Keira looked for the simpler version first.

Could the maintenance interval have been inferred from visible field activity? The records showed no repair crew at Relay 4 during that window. Could the Ironridge vulnerability have been inferred from public traffic? Maybe in broad terms, not with the precision needed to select the forty-minute gap she had identified.

Neither inference route was strong enough to remove the protected-information requirement.

Torin created a matching Blackthorn finding.

PROTECTED BLACKTHORN MAINTENANCE STATE LIKELY REQUIRED FOR PRECISE ACCESS. SOURCE UNRESOLVED.

Keira compared the phrasing with her Ironridge finding and accepted it into the paired record.

The investigation had become harder to simplify in a useful way.

An Ironridge insider acting alone no longer explained the Blackthorn maintenance knowledge without another access path. A Blackthorn insider acting alone did not explain the precise Ironridge freight window without the same problem.

Torin requested preservation of every copy, forwarding event, and credential link associated with the maintenance notice.

Keira mirrored the request for Ironridge's reroute revision.

Neither side released names beyond its restricted investigative circle.

The paired record showed what mattered without pretending it showed more: the same interference event relied on information that belonged to different institutions and was protected for different reasons.

Keira drew a line between the two evidence boxes and attached the knowledge requirements to the incident timeline.

The original question had been whether Blackthorn or Ironridge had caused the relay failure.

The evidence now demanded a different investigation.

Somebody had found a way to see into both.

Keira and Torin built the suspect field from the knowledge requirements instead of from names.

The first model was one actor with access across both organizations. A contractor administrator, shared infrastructure employee, Conclave functionary, or compromised cross-pack account could theoretically collect the Ironridge reroute timing and the Blackthorn maintenance interval without belonging cleanly to either pack.

The second model required cooperation. One source provided Ironridge information. Another provided Blackthorn information. Someone combined the pieces before the manual access at Relay 4.

The third model moved the collection outside both institutions. An external network could gather protected fragments separately through contractors, stolen credentials, surveillance, or compromised service systems and correlate them later.

Keira left all three on the board without ranking them.

Each model explained something the others did not. None had enough evidence behind it to justify a suspect list.

That restraint became harder when Ironridge leadership asked for the Blackthorn maintenance finding by itself.

The request came through the review channel with the stated purpose of briefing the council on the security implications of legacy Blackthorn credentials.

Five minutes later, Torin received a Blackthorn request for the Ironridge reroute finding without the paired maintenance context.

Keira looked at both requests on the shared screen.

If Ironridge briefed only the Blackthorn half, the story would become weak Blackthorn security. If Blackthorn briefed only the Ironridge half, the story would become an Ironridge leak timed against Blackthorn infrastructure.

Both stories would contain real evidence.

Both would omit the fact that the same act appeared to require both information streams.

"No partial brief," Keira said.

Torin agreed. "The paired finding goes forward under the same wording or neither half does."

They sent identical conditions back to their leadership structures.

The objections arrived quickly.

An Ironridge administrator argued that Ironridge had a right to its own route-security finding without negotiating how Blackthorn described its maintenance failure. Torin's security chief received the reciprocal argument from a Blackthorn elder.

Keira did not try to settle the larger political principle.

She pointed to the investigative consequence. Selective release would tell every possible insider or external actor exactly which half of the evidence each pack had recognized while encouraging immediate retaliation against the other side.

That was enough reason to keep the paired record restricted.

Torin added a preservation flag to the Blackthorn maintenance records. Routine deletion, alteration, or replacement would now create an audit event.

Keira did the same to the Ironridge route revision and its version history.

She opened the access list immediately afterward and found several senior institutional accounts with ordinary authority to alter or replace archived records. Torin found the same kind of standing permissions on the Blackthorn side.

Keira reviewed who could currently touch the Ironridge files.

The list was longer than she wanted for an insider-sensitive investigation.

Torin's side had the same problem.

She looked at the two preservation records.

"We need custody rules before we do anything else."

Torin nodded. "And fewer people with raw access."

Keira could already hear the argument that would create inside Ironridge. Restricting senior officials from their own records would look like an accusation even if the restriction applied by function rather than suspicion.

The alternative was leaving evidence of a possible cross-pack conspiracy inside normal institutional permissions that had never been designed for an insider case.

She opened a blank custody protocol.

The suspect field remained broad.

The evidence could not afford to remain equally broad in who could alter it.