Method. This desk has not monitored the content of traffic touching the two array names. Content tells you what people say. Volume tells you what they know. The daily count of external queries touching either name has therefore been held as the single most reliable measure of containment.
Baseline. Three weeks of trickle: the original badly-written audit request, one follow-up, one ministry desk query. Consistent with a fact held by the people who found it and almost no one else.
This morning
| Time (local) | Count movement | Origin character |
|---|---|---|
| 08:12 | +40 inside twenty minutes | A defence desk, one capital |
| 08:31 | +200 and climbing | A research office, a second capital; a private number known to this desk |
| 09:00 | Continuous | Multiple systems with no business holding either name |
All of it inside the same hour. All of it reaching for the same fortnight of the same band.
Assessment
The break did not originate at either array. The shape is wrong for that — too coordinated, too instant, too many capitals at once. A single scientist talking produces a ripple that spreads at the speed of gossip. This spread at the speed of a decision. Someone with reach has been holding this quietly and, as of this morning, has released it or lost it. Which of those two it was matters less than the arithmetic: the number of parties now reaching for the data cannot be reduced by anything available to this desk, or to any desk above it.
Containment should be recorded as ended. Recommendations for what follows containment are beyond this note’s remit and will not survive contact with the morning anyway.
One line for the record, because the record should show the desk knew what it briefly held: between the writing of this note and the chain acting on it, this desk holds an advantage of roughly two hours. What a window of that size is worth depends entirely on what it is spent on.