12:45 automated. No human intervention required. Once the timer started, James could stop it, override the automation, inject a cancellation command, but that would mean accessing the system with revoked credentials, deliberately countermanding a supervisor's authorized action career ending, possibly criminal, definitely destroying whatever credibility his incident report still had, or he could trust that Brian would escalate fast enough, that security would review the evidence and halt the restart before it executed. 5 minutes, James made his decision. He closed his laptop.

Connecting from the remote access, Brian, I can't stop this from here. You need to physically go to the operation center and tell Jason to cancel the restart right now. Don't wait for approvals. I'm on my way. The call ended.

James sat in his apartment, staring at his closed laptop. Knowing that in 5 minutes, the company he'd protected for 48 hours was going to fail in exactly the way he'd predicted, and there was nothing he could do except hope. Brian moved fast enough. 12:41 p. m. Aurelius Financial Tech Technologies.

Third floor. Brian Thompson rushed out of the elevator, headed directly for Jason Morrison's console. Jason looked up, surprised. Brian, hey, I was just about to ping you. The restart is cued for 12:45.

Cancel it. Jason blinked. What? Cancel the restart. There's a potential security issue that needs review first.

Jason pulled up the protocol documentation. The restart was approved by infrastructure team last month. It's on the standard maintenance schedule, I understand, but we have new information that requires us to postpone movement in Brian's peripheral vision. He turned Steven Reeves, walking toward them with the calm, purposefulness of someone who had every right to be there. Brian, is there a problem?

Brian felt the political calculus shift. Jason reporting to him was one thing. Contradicting the VP of operations in front of the entire operation center was different. James Mitchell filed a security incident report over the weekend. He's recommending we postpone the restart until defensive measures can be properly reviewed.

Steven's expression remained neutral. Professionally concerned, James Mitchell was terminated this morning for sleeping during critical operating hours. Are we really going to disrupt scheduled maintenance based on a report from someone who was fired? Brian opened his mouth, closed it. The logic was brutal and effective.

Jason looked between them, clearly trying to determine which authority took precedence. The restart is ceued. I can cancel it, but I need to know if this is an actual security concern or if we're just being cautious. Steven pulled out his phone, pulled up James' incident report, scrolled to the summary, look at the language, staged attack, neutralized threat. This reads like someone trying to justify why they were working unauthorized overtime all weekend.

James has a history of seeing critical issues that turn out to be routine anomalies. Not true. But Steven delivered it with enough conviction that it sounded plausible. Brian felt the ground shifting. his certainty eroding under the weight of organizational hierarchy and political optics. I spoke with James 10 minutes ago.

He insisted the restart would cause system failure. Of course, he did because if the system doesn't fail, his dramatic incident report looks like paranoid overreach. He needs the restart to be dangerous to validate his narrative. 12:43 2 minutes. Brian looked at Jason.

Cancel the restart. We can reschedule it after security reviews the report. Jason's hand moved toward the cancellation command. My Michael Cooper stood up from his console three rows away. Walking toward them, tablet in hand, I read James' report.

He documented specific evidence of architectural knowledge being used to probe the 2015 gateway. The access logs show Sreves Abnor downloading legacy diagrams 6 weeks ago. Michael's voice was quiet, but in the suddenly silent operation center, everyone heard Steven's expression didn't change, but something flickered in his eyes. Those diagrams are part of the modernization assessment I'm conducting. Perfectly legitimate business activity.

Then why were they accessed at 2 a. m. on a Saturday? Steven turned to face Michael fully. Are you questioning my authority as your VP? Michael's face pad, but he didn't back down. I'm asking why your access pattern matches the timeline James documented for the attack preparation.

12:44 1 minute. Steven made a tactical decision. He couldn't afford to look defensive. Couldn't let this escalate into an actual investigation right now. Fine.

Cancel the restart. We'll convene a security review this afternoon, but I wanted on record that we're delaying critical maintenance based on accusations from a terminated employee. Jason's hand moved toward the cancellation command again, but the system clock hit 12:45 and the automated restart protocol executed before the cancellation registered. 12:45 p. m. Core payment services initiating restart sequence.

For the first 90 seconds, nothing looked wrong. CV is shutting down in proper order. Memory clearing. processes terminating cleanly. Then the services started coming back online and the system state they loaded was the one that existed before James spent 48 hours building defenses. The temporary redirect rules gone the traffic isolation barriers wiped the monitoring alerts James had configured erased everything reverting to permanent configuration which still contained the backup trigger Steven had embedded 3 weeks ago.

12:47 p. m. Hoff at Thrash and Token synchronization started reporting errors, minor at first, individual transactions showing state mismatches. Jason's console lit up with amber warnings. That's weird. Tokens and complaining about unexpected session states.

Brian leaned over his shoulder, watching the errors multiply. How many transactions are affected? 40. No, 60. Wait, the number kept climbing faster than Jason could refresh the dashboard.

100 transactions reporting errors. 200. The authentication service was losing connection to the payment routing pathway. Exactly the failure mode James had described in his report. Brian felt ice forming in his stomach.

Jason attempt a roll back to pre-ress state. Jason's fingers moved across the keyboard. Executing the roll back procedure error message. Roll back failed. Tked at state not in repo because the state James had created existed only in running memory.

It had never been committed to the permanent configuration repository. 12:49 p. m. High value transaction queue started showing suspended transactions. Payment instructions entering a state that was neither completed nor reversible. Michael pulled up the transaction details.

These are corporate wire transfers. 12 million, 8 million, 15 million. They're stuck in processing limbo. The warnings turned red, cascading across the monitoring dashboard. And buried in the error logs, a small notification that nobody noticed in the chaos mission bypass window active.

The trigger had fired exactly as designed, opening a 90-cond window where fraudulent transaction requests would be processed as legitimate, except the attackers weren't ready. They'd been waiting for the scheduled Monday afternoon restart, not the lunch hour execution. Their prepared batch of fake transactions wasn't ceued. Their receiving accounts weren't positioned, so the bypass window opened and closed. And nothing catastrophic happened, just system instability, transaction failures.

The kind of operational crisis that looked bad but wasn't fatal. 12:51 p. m. Patricia Harrison's office. Fourth floor. Her assistant knocked.

Miss Harrison. Brian Thompson is calling. He says it's urgent. Patricia looked up from the memo she'd been drafting. Irritated by the interruption.

Tell him I'll call back after my 1:00. He says the payment processing system is experiencing critical failures. The words registered slowly. Then their meaning hit. Patricia picked up her phone.

What's happening? Brian's voice came through. Strained. The system restart triggered cascading failures. We're seeing suspended high value transactions.

Authentication errors. Token synchronization breakdown. Everything James Mitchell warned about in his incident report. Patricia stood moving toward her office door. How many transactions are affected?

Current count is 400 and climbing. Exposure is approximately 53 million in suspended corporate transfers. The number made her stop walking. 53 million and growing. We're attempting remediation, but we don't fully understand the failure mode.

James documented the defensive measures he built, but replicating them requires understanding the attack vector he was defending against. Patricia's mind flashed to the morning. James trying to speak her cutting him off. If someone restarts the core payment system, that's what he'd been trying to warn her about. Where is James now?

Terminated. Access revoked. At home, get him on the phone. I tried. He's not answering because James had watched the clock hit 12:45, watched the restart execute remotely through monitoring systems and then closed his laptop.