Chapter 118: The Metadata Leak
The page looked clean until Marcus opened the properties panel and found a witness hiding in the author field.
The KRR demonstration room went silent when Marcus blanked the projected field. The visible statement still showed only the witness designation approved for public use.
Marcus disconnected the public test account from the download folder. A second staff member recorded the cutoff time from the access system.
He did not delete the file or alter its properties.
Samuel marked the derivative unavailable and opened an incident record at 11:51.
The protected original remained inside its existing evidence vault. No one opened it merely to confirm what the leaked username meant.
Its hash matched the value recorded before public-copy preparation.
The leak existed in a derivative's embedded metadata, not in the source record. That distinction protected authentication but did not reduce the privacy failure.
Samuel paused the entire release for forty-eight hours.
The pause covered every PDF, spreadsheet export, image, and index file. It also suspended press credentials and scheduled download links before any invitation left KRR.
It did not depend on whether a document looked harmless on screen.
Marcus preserved the affected download under restricted incident custody.
He recorded its public-copy hash, generation time, workstation, and access log.
Only the test account and authorized KRR staff had accessed it. Marcus attached the account report rather than relying on an oral assurance.
No package had been released to press or the public.
The privacy reviewer notified the witness through the protected attorney channel.
The notice identified the exposed field and the confirmed access boundary. The witness retained the right to challenge both KRR's description and its proposed repair.
It did not promise that a visual review had been enough.
Marcus demonstrated how the old username had survived export.
The original document template had stored an author value outside the visible page. That value followed the file through conversion even though the displayed author line was redacted.
The redaction tool had covered page text but had not cleared that property.
KRR's earlier checklist had tested filenames and visible identifiers. It had also tested text extraction, but the properties panel required a separate inspection.
It had not required a clean-account inspection of every embedded field.
Samuel added that failure to the public correction log.
He did not describe it as a witness error.
The username had entered through KRR's derivative workflow, so KRR owned the repair.
Marcus generated a sterile copy from the protected original inside the controlled workspace.
He removed document properties, comments, revision history, thumbnails, and hidden attachments. The sterile workflow logged each removal category and the tool version used.
The visible redactions stayed exactly as the reviewer had approved them.
The original file and its hash did not change.
The sterile derivative received a new hash because it was a new public copy.
Its mapping entry linked back to the same protected source identifier.
An independent privacy auditor received read-only copies through a separate account.
She would repeat the properties, extraction, filename, and hidden-layer tests.
KRR staff could not mark their own scrub complete.
I remained outside the test folders and witness notification.
My participant account showed only that release had been paused.
Jonah received the same limited notice through Miriam.
Neither of us learned the protected witness's username from KRR.
At 1:18, Marcus finished the first full-package metadata scan.
Most files had been generated from sterile templates and returned clean.
Three older PDFs carried legacy author values in their properties.
All three had been created before the current export checklist.
None of their protected originals had changed or lost authentication.
Marcus produced sterile derivatives and separate public-copy hashes for each.
The independent audit still had to verify them during the pause. Its scope included clean-account downloads, property scans, hidden layers, and extracted text.
Samuel compared the repaired files with the public index.
Their old hash entries still pointed to the withdrawn derivatives.
Only three PDFs were affected, but every original-to-public mapping for those copies now required repair.