The Geneva flight had a six-hour layover in Beirut, which was not an accident.

There was a man in Hamra who had worked pipeline infrastructure contracts across the Gulf for eleven years before he stopped working them, which happened the same week he stopped answering certain phone calls and started answering others. He was not an asset, not technically — he had never been formally recruited, never been paid, never been asked to report on anything in a systematic way. What he was, in the vocabulary Nava used for people who occupied the space between useful and dangerous, was a contact of opportunity: someone who knew things that no database contained, who shared them selectively, and whose selectivity was governed by a personal moral accounting system she had never fully understood but had learned, over four years of occasional contact, to trust provisionally.

His name was Walid Nassar. He was fifty-three, Lebanese, Sunni, and he had opinions about pipeline infrastructure with the specificity and passion of a man who had spent a decade being paid to protect things and had reached a point in his life where he had opinions about what deserved protection and what did not.

He had called Nava's contact number forty-eight hours ago, which was before Cyprus and after Tel Aviv, and he had said four words in Arabic and hung up.

The four words were: the charges are real.

They met him in a café on Makdisi Street at two in the afternoon, in the specific quality of Beirut summer heat that had no equivalent in Tel Aviv despite the forty-kilometer distance — heavier, more humid, carrying the particular exhaust-and-jasmine combination that was, for reasons she had never analyzed, one of the smells she associated most strongly with professional risk.

Walid was at a corner table with a nargileh he was not smoking and a coffee he was. He looked at Yonatan the way Dmitri had looked at him in Nicosia — with the careful, unhurried reassessment of someone recalibrating a picture they had prepared — and then he looked at Nava and said nothing, because they had an understanding about greetings in operational contexts, which was that there were none.

"The charges," she said.

"Physical," Walid said. "Not just code." He wrapped both hands around his coffee cup. "I worked the Saudi Eastern Province pipeline network from 2009 to 2019. Inspection and maintenance, junction infrastructure. I know what those junctions look like from the inside. Three months ago I ran into a former colleague — someone who has been doing contract work in the region for the past four years, different clients, wouldn't tell me who — and he told me something that I have been thinking about every day since."

"What did he tell you?" Yonatan asked.

Walid looked at him. "He told me he had been part of a team that serviced seventeen pipeline monitoring stations across three countries over an eighteen-month period. Routine maintenance work, on paper. He was hired as a technician. He installed what he was told were upgraded sensor housings. He didn't look inside the housings." He paused. "He looked inside one of them. Six weeks before he called me."

"What was in the housing?" Nava asked.

"A shaped charge. Small. Precisely calibrated. The kind of device that, detonated at the right pressure point in a pipeline junction, produces a failure that looks, initially, like a mechanical fault — metal fatigue, seal degradation, the kind of thing that happens in aging infrastructure and produces an investigation that takes six months and finds nothing of interest." He looked at the coffee cup. "Except seventeen of them, simultaneously, do not look like mechanical faults. Seventeen simultaneous failures is a number that speaks for itself."

The table was quiet.

Nava thought about what this meant for the operational picture — for the counter-virus she and Yonatan had been designing to neutralize the SCADA compromise, the software intervention that would disconnect the dormant modules from the activation signal before it could reach them. She thought about it for approximately four seconds before she understood what it meant, and what it meant was that the counter-virus was not enough.

The software was the trigger. The charges were the weapon.

Neutralizing the trigger did not neutralize the weapon. The charges were in the ground. In the junctions. In seventeen places across three countries, inside sensor housings that looked, to anyone who had not opened them, exactly like sensor housings.

The PROTOCOL MAHDI was not a cyberattack wearing the clothes of a geopolitical crisis.

It was a physical attack wearing the clothes of a cyberattack.

"How long have the charges been in place?" Yonatan asked. His voice had not changed — the same measured register — but she heard, in the precision of the question, that he had arrived at the same conclusion a fraction of a second before she had and was already, characteristically, asking the question that addressed the next problem rather than the current one.

"My colleague said the installation work was completed in phases over eighteen months. The last phase finished eight months ago." Walid looked at them both. "They have been in those junctions for eight months. In summer temperatures. In infrastructure that is inspected on a schedule that has not changed in six years."

"And no one found them."

"No one opened the housings. The housings were installed by a certified maintenance team with valid contracts and valid documentation. The inspection records show them as upgraded components. There is no reason, in the normal course of pipeline maintenance, for anyone to open a sensor housing that was installed eight months ago by a certified team." He paused. "Unless someone told them to look."

Nava looked at Yonatan. He was looking at the table in the way she had come to recognize as his calculation posture — not absent, not distracted, but running a model in a place behind his eyes that the outside world did not have direct access to.

"Can your colleague provide junction coordinates?" she asked Walid.

"He provided one. The one he opened." Walid reached into his jacket and produced a folded paper — handwritten, no digital trail — and placed it on the table between them. "The others he didn't open. But the installation contracts will have records. If you can access the maintenance database for the Eastern Province network—"

"I can access it," Nava said.

"Then you will find sixteen more housings that match the installation record of the one he opened." He looked at her steadily. "This changes your problem considerably."

"It does," she said.

"You cannot fix this from Geneva," Walid said. "You can stop the signal from being sent. You cannot remove what is already in the ground from a laptop."

"No," she agreed. "But if we stop the signal, the charges don't fire. The calendar date fires the signal, not the charges directly. The signal activates the SCADA modules, the modules open the safety overrides, and the charges are triggered by the resulting pressure differential." She paused. "Stop the signal, the charges are inert. Find and remove the charges, they're inert permanently."

"You have six days."

"We have six days for the signal," Yonatan said. "The charges can be located and removed after the hard date is neutralized. They are not going anywhere." He looked at Walid. "Your colleague. Is he willing to provide the other coordinates if we access the maintenance database and give him the installation reference numbers?"

Walid considered this. "He is frightened."

"He should be," Yonatan said. Not harshly. Simply as a statement of accurate assessment. "He opened a housing he wasn't supposed to open. The people who placed those charges will eventually audit their own work. When they do, they will know that housing was opened." He paused. "We can protect him. But not if he waits."

Walid looked at Yonatan for a long moment with the expression of a man reassessing a person he had taken, on first impression, for a certain kind of professional and is now finding to be a different kind — not more dangerous, not less, but differently calibrated. "I'll call him tonight," he said.

"Tonight," Nava confirmed.

They left the café at three-fifteen and walked north on Makdisi in the heavy afternoon light, back toward the route that would take them to Rafic Hariri International for the evening flight to Geneva. The city moved around them with its specific organized chaos — the motorcycle traffic, the half-constructed buildings beside the immaculate ones, the way Beirut wore its history on its surface in a way that Tel Aviv mostly did not, all its wounds visible and its reconstructions visible beside the wounds, refusing the clean narrative of either ruin or recovery.

She was thinking about the charges in the junctions and about the maintenance database and about the six additional days it would take, after Geneva, to locate and remove seventeen shaped devices from infrastructure in three countries with three different security environments, when she turned a corner on a narrow street and her cover broke.

It broke the way covers break in the field — not dramatically, not with confrontation, but with a single wrong detail: a man on the far side of the street whose eyes moved to her face and then away with the specific speed of someone who has recognized a face they were not expecting to see and is managing the recognition. She had a half-second to catalog him: forty, Lebanese, the particular posture of someone who had been military and retained it, phone in his left hand with the screen oriented toward her for two of those three seconds.

She did not break stride.

She said, without looking at Yonatan, very quietly: "Turn left at the next intersection. Don't change pace."

He turned left without asking why, without changing pace, and she felt in that simple unremarkable compliance the specific value of a partner who trusted her read of a situation the way she had trusted his read of the seed algorithm — completely, without the pause for verification that cost seconds she did not have.

They were twenty meters into the side street when she felt his hand on her arm.

Not a grab. A placement. His fingers closed around her forearm with the specific controlled force of someone redirecting movement rather than stopping it — she was three steps ahead of him and the contact pulled her trajectory two degrees left, just enough to move her out of the sightline of the street they had left, into the shadow of a building entrance whose recessed doorway gave them four seconds of visual cover.

He released her arm the moment they were in the shadow.

Immediately. Completely. The way you release something you should not have been holding.

She turned and looked at him.

His face had the focused stillness of operational mode — no color in the cheeks, no excess motion, the breathing measured and controlled — but there was something else in his eyes that was not operational, something that had arrived and been immediately contained, the way you contain a reaction you did not plan to have in a place you did not plan to have it.

"Two of them," he said. His voice was completely level. "The one you saw and one behind us. The one behind us had an earpiece."

She looked at him. "You saw the one behind us."

"Yes."

"Without telling me."

"I was deciding whether I was certain." A pause. "I'm certain."

She processed this. He had seen the tail before she called the turn — had been waiting for her to call it, she understood, giving her the operational lead because she knew this city and he did not, and had pulled her out of the sightline not because he didn't trust her read but because his angle on the first man was better and he had seen something she had not.

Two of them. Coordinated. Which meant whoever they were, they had known to be here, which meant either the Beirut meeting had been burned before it started, or the contact with Walid had been observed, or something upstream of both had told someone that two Israeli intelligence officers were in Hamra on a Tuesday afternoon.

The mole.

The thought arrived with the particular cold clarity of a confirmed hypothesis. The mole knew they were in Beirut. Which meant the mole knew they had a contact here. Which meant the mole had access to operational movement data above the level she had assumed.

Four seconds in the doorway.

"Back route to the airport," she said. "No taxis from this street. We walk two blocks east, then south, use the service entrance on the Corniche side. I know the route."

"Go," he said.

She went. He followed, and she was aware, as they moved through the back streets of Hamra in the heavy Lebanese afternoon, of the place on her forearm where his hand had been — not the touch itself, which had been entirely controlled and purposeful and had lasted no more than four seconds — but the absence of it, which was a different kind of sensation and one she had not been prepared for and filed, immediately and firmly, under things that were not currently relevant.

"I'm not going to bite you," she said, as they turned south.

"I know," he said, a step behind her. "That's not the question."

She kept walking.

In the four seconds of doorway silence that remained in her peripheral memory, she had registered one thing she had not yet said: that she had felt, in the moment of contact, something she had not felt in the four seconds before it, which was the sensation of being protected by something that was not a wall and not a weapon and not a protocol.

She did not say this.

She walked faster.

Geneva in four hours.

Geneva at two in the morning had the particular quality of a city that was very good at being asleep — not the restless semi-sleep of Tel Aviv or the performative sleep of Beirut, but a genuine, organized, Swiss unconsciousness, the city having retired at a reasonable hour and left its streets to the lake wind and the occasional taxi and the tram system, which ran on schedule regardless of whether anyone needed it.

In room 412 of the Hotel des Bergues, which overlooked the Rhône and the illuminated jet d'eau that continued its nightly performance for an audience of no one in particular, Nava had been awake for nineteen hours and had, in the past three of them, built something she had not anticipated building.

The CIA surveillance package had arrived at 6 p.m., as Cole had promised — six weeks of Majd's movements in Geneva, communication intercepts, the symposium delegate list with behavioral annotations on forty-three participants, and a technical appendix that was either the most generously documented intelligence gift she had ever received or the most carefully constructed Trojan horse, and she had spent the first two hours treating it as both simultaneously.

By 10 p.m. she had decided it was genuine. Cole had given them what he said he would give them, cleanly, without conditions embedded in the data structure — she had checked for those specifically and found nothing — and the picture of Cyrus Majd that emerged from six weeks of CIA surveillance was considerably more detailed than the picture Dmitri had given them in Nicosia.

The dead-drop was the piece she had not had. It was also, she realized as she read it, the piece that changed everything about the Geneva operation in a way she was still working through when Yonatan came in from his evening prayers and read the same annotation and said, very quietly: "The confirmation is physical. Not digital."

"Yes," she said.

"Which means the final activation — the human confirmation that triggers the PROTOCOL MAHDI — is not a keystroke. It's a letter in a box."

"Or a package. Or an object. Something that gets deposited and retrieved." She looked at the screen. "The courier checks the box every seventy-two hours. The next check is—"

"Forty-one hours from now," he said. He had been running the timing in parallel, she understood, the same way she had. "If the activation is triggered by whatever arrives in that box, then we have forty-one hours to understand what triggers it and ensure it doesn't arrive."

"Or ensure that what arrives doesn't say what Majd needs it to say."

He looked at her.

"The dead-drop is a two-way system," she said. "Majd deposits a status confirmation. The courier retrieves it and delivers a counter-confirmation. If the counter-confirmation matches the expected response, Majd sends the final activation signal to the SCADA network." She paused. "If we intercept the counter-confirmation and replace it with a negative response — an abort signal — Majd stands down. He doesn't activate."

"He stands down this cycle," Yonatan said. "He repeats the dead-drop at the next seventy-two-hour window. The hard date doesn't move."

"No. But if we've neutralized the SCADA architecture before the next window — if the counter-virus is deployed and the modules are disconnected — then Majd's activation signal reaches an empty room. He presses a key that opens no doors."

She watched him work through this. The room was very quiet, the lake wind audible through the closed window, the jet d'eau doing its patient nightly performance in the dark outside. The hotel was old and solid and the walls had the thickness of buildings that were built when people still believed in permanence, and the thickness made the silence in room 412 different from the silence in the Tel Aviv safe house — deeper, more formal, as though the room itself were aware of the weight of the conversation it was containing.

"The counter-virus," he said. "You haven't told me the current state of it."

She had been waiting for this question. Not avoiding it — she had been building toward it for three hours, assembling the answer in the order that would make its full implications clear rather than just its summary.

"The good news," she said, "is that the heartbeat replicator is operational at ninety-four point seven percent. We can maintain the synthetic heartbeat for the duration of the operation — Taheri's device stays dark, the contingency layer sees no silence, no calendar-independent fire." She paused. "The bad news is the counter-virus itself."

"Tell me."

"The PROTOCOL MAHDI is not static code. I knew it was adaptive — the variance suppression I identified in Shariati was a behavioral adaptation, the modules adjusting their communication patterns in response to environmental changes. What I didn't know until I got the CIA's technical appendix tonight—" she turned the laptop toward him "—is the degree of adaptation. The modules don't just adjust their behavior. They learn."

He read the technical appendix for three minutes.

"Machine learning embedded in the payload architecture," he said.

"The modules have been running a continuous environmental model for eighteen months. They have learned the normal behavior of every system they are embedded in — the pressure cycles, the sensor readings, the maintenance windows, the operator patterns. They can distinguish, in real time, between a genuine system anomaly and an external intervention." She looked at him. "If I deploy a counter-virus that attempts to disconnect the modules from the activation pathway, the modules will identify it as an intervention within forty-seven seconds. At which point they will initiate an autonomous protective response."

"Which is?"

"Immediate activation. Not waiting for the signal. Not waiting for the hard date. The moment they identify an external intervention, they fire."

The room absorbed this.

"So a counter-virus that attacks the modules directly triggers the thing it's designed to prevent," Yonatan said.

"Yes."

"And a counter-virus that approaches indirectly—"

"Takes longer than we have. The adaptive architecture will identify any approach I can generate in under six days. It has eighteen months of learning. I have six days." She closed the laptop. "The counter-virus, as currently designed, cannot be deployed. We need a different approach."

She had been sitting with this conclusion for two hours. It had the particular weight of a problem that was not solvable by the means available, which was a category she encountered rarely and disliked with a ferocity she did not entirely manage to contain.

Yonatan was quiet for a long time.

Long enough that she looked at him.

He was not looking at the laptop. He was looking at the window — at the dark rectangle of lake and city and the white column of the jet d'eau — with the expression she had first seen on his face in the Tel Aviv safe house when he was at his desk with the Gemara open and the siddur beside it, the expression that was not the analytical register and not the operational one but something between the two, something that existed in the space where the model ran out of road and the person behind the model had to decide what to do next.

"The modules learn from the environment," he said.

"Yes."

"They learn to distinguish normal system behavior from external intervention."

"Yes."

"So the only approach they cannot identify as intervention is an approach that looks, to their model, like normal system behavior." He turned from the window. "What does normal system behavior look like to an adaptive module that has been running for eighteen months?"

She stared at him.

"It looks like the environment they've been learning," she said slowly. "The pressure cycles. The sensor readings. The—" She stopped. "The maintenance windows."

"Yes."

"If I build the counter-virus to look like a scheduled maintenance routine — not attacking the modules, not disconnecting them, but running alongside them as a maintenance process that their own model classifies as legitimate environmental behavior—"

"They don't trigger the protective response," he said. "Because they don't see an intervention. They see maintenance."

She opened the laptop.

The maintenance window data was in the CIA's technical appendix — six weeks of observed system behavior, which included two scheduled maintenance cycles, both of which had passed without the modules reacting. The maintenance cycles had a specific behavioral signature: a particular sequence of sensor queries, at a particular frequency, in a particular order that the pipeline operators used to run system checks.

If she built the counter-virus to mimic that signature — to approach the modules wearing the behavioral fingerprint of a maintenance cycle rather than the behavioral fingerprint of a hostile intrusion — the modules would see a scheduled check and would do what they always did during scheduled checks: stand down their active monitoring and allow the process to complete.

During which window, she would disconnect them from the activation pathway.

Not forty-seven seconds.

She would have the entire maintenance window. Eleven minutes, based on the observed cycles. Eleven minutes to do what she had previously had forty-seven seconds for.

"How long to build it?" he asked.

"Forty hours," she said. "Maybe thirty-eight if the maintenance signature is as consistent as the CIA data suggests."

"The dead-drop window closes in forty-one hours."

"I know."

"Three-hour margin."

"I know," she said again. She was already in the code, already pulling the maintenance signature from the CIA data, already beginning to build the architecture of something that would look, to eighteen months of machine learning, like a Tuesday morning systems check.

It was the most precise piece of technical deception she had ever attempted. It required her to understand not just the code she was writing but the model that would be reading it — to think not like a programmer but like the program, to inhabit eighteen months of environmental learning and ask what a maintenance cycle looked like from inside it.

She thought: the modules learned to see the world by watching it for eighteen months. I need to show them something they already know.

She thought: I need to build a lie that is indistinguishable from a memory.

"Go to sleep," she told Yonatan. "I need four hours of uninterrupted build time and then I need you to check my financial modeling of the maintenance scheduling — the timing has to match the operators' actual cycle patterns, and that data is in the pipeline company's procurement records, which you can access faster than I can."

"I'll be up at six," he said.

"Five-thirty."

A pause. "Five-thirty," he agreed.

He went to the adjoining room. She heard the door close. She heard, after a few minutes, the quiet cadence of Hebrew words spoken in undertone — not Tehilim this time, she thought, something different, the rhythm of it more conversational, less formal, the sound of someone talking to something rather than reciting at it — and she let it be in the background the way she always let it be, not analyzing it, not ignoring it, simply allowing it to occupy the frequency it occupied while she built the thing she needed to build.

Thirty-eight hours.

Forty-one hours until the dead-drop window.

Five days, fourteen hours until the calendar hard date.

The jet d'eau rose and fell in the dark outside, and the lake held its cold patience, and Nava Amir built a lie that looked like a memory and hoped that what she was building was good enough to fool something that had been learning how to see the truth for a year and a half.