Chapter Two: An Eighteen-Hour Chain of Evidence

For Hanhai's investigators to “discover” the repository, they had to make sure he opened an entry point. A week before his suspension, his manager ordered everyone to test an internal code-search extension. It claimed to improve productivity and requested permission to scan local directories. Chen asked the notary to inspect his browser cache. The package was gone, but the download address remained. Its domain belonged to Hanhai, while the path led to a temporary object-storage bucket that had since been closed. “Closed doesn't mean erased,” Tang said after joining by video, keyboard clattering behind his voice. “Public transparency logs preserve certificates and domain changes. Give me twenty minutes.”