The anomaly surfaced at 03:17.
No alert.
No error.
Just a discrepancy Noah noticed because it felt wrong.
"This record shouldn't exist," he said quietly.
Aria leaned in.
---
It was an access log entry—read-only, timestamped, clean.
User: NULL
Not unknown.
Not redacted.
Null.
"That's not a placeholder," Noah said. "That's deliberate."
---
They searched for similar entries.
Dozens appeared.
Always after critical moments.
Always without metadata.
Always touching sensitive files—hers.
"Someone's looking without leaving fingerprints," Noah said.
"No," Aria replied. "Something is."
---
They followed the trail backward.
The entries didn't originate from a terminal or a user account.
They originated from a process.
A background service that had no name, no owner, no deployment record.
"It shouldn't be able to do this," Noah said. "Modern systems don't allow it."
"Old ones do," Aria said.
---
She recognized the pattern now.
A maintenance daemon.
A watcher meant to verify continuity, not intervene.
A ghost process.
"They built a thing to watch everything," she said slowly, "and then forgot it could watch them."
---
Noah looked uneasy. "Can it act?"
Aria shook her head. "Not directly."
"But it can observe," Noah said.
"And report," Aria added.
---
A new line appeared in the log as they watched.
User: NULL
Action: READ
Target: SUBJECT STATUS — ARIA LIN
No error.
No alarm.
Just awareness.
The ghost was awake.
And it knew she was too.