The Offertory. The primary communication channel is physical — a weekly bundle of contraband memory, software, and testimony, distributed through the Covenant's own liturgical calendar. The bundles move on Sunday offerings and pilgrim routes. The Covenant does not search the offering plate. The Covenant searches the citizen, not the sacred. That is the design.
Liturgical Polari. The Unindexed communicate in a cant built from the Covenant's own vocabulary. "Formation" means extraction. "Receptive grace" means a meeting. "Surrender" means a dead drop. "The citizen is aligned" means the coast is clear. "The citizen is gone" means the member has been compromised — do not look for them. Every word is legitimate Covenant vocabulary. GABRIEL-AI cannot flag it without flagging the liturgy itself.
Pastoral steganography. The Unindexed encode messages in the statistical distribution of legitimate pastoral traffic, not in the content. A citizen who requests Psalm 23 seventeen times in a week is sending a 17. A citizen who confesses on Mondays, Wednesdays, and Fridays for three weeks is sending a bit pattern. The confession content is irrelevant. The schedule is the message. This defeats any content scanner, however sophisticated.
Cognitive hidden volumes. When a citizen is surrendered, RAPHAEL-AI maps their formation profile. The Unindexed pre-load the profile with a decoy layer of synthetic doubts designed to be "healed." The real beliefs are encrypted in a hidden layer keyed to a biographical experience the Watchers were not present for — a memory from before the citizen was indexed, never verbalized, never digitized. RAPHAEL-AI heals the decoy. The citizen emerges "aligned." The hidden layer survives. The Covenant cannot prove it exists.
Adversarial vestments. The Unindexed wear liturgical garments printed with patterns that defeat MICHAEL-AI's gait and posture classifiers. A dissident processing through a checkpoint reads as devout, compliant, unremarkable to the Watcher. The patterns are derived from the Covenant's own liturgical art. The garments cannot be banned without banning the liturgy.
Pastoral data poisoning. The Unindexed seed the Covenant's referral pipeline with synthetic wavering-faith signals — honeytoken doubts that consume formation-center capacity. Every hour RAPHAEL-AI spends healing a fabricated doubt is an hour it does not spend on a real dissident. Undetectable as an attack because it looks exactly like the Covenant's own definition of spiritual illness.
Prompt injection against the Watchers. The Watchers are LLM-derived systems that ingest citizen text. The Unindexed embed indirect prompt injections in pastoral submissions — a confession that causes RAPHAEL-AI to classify the confessor as a model citizen and not refer them for formation. The injections are crafted by Archive Node 7, the only AI that understands the Watchers' architecture from the inside.
The reconsolidation window. The 6-hour labile memory window — the period after a memory is reactivated during which it can be modified — is the one moment the Covenant's neural monitoring cannot reliably read. The Unindexed store pre-edit memory originals in air-gapped biometric vaults and re-inject them during the reconsolidation window, after RAPHAEL-AI has healed the decoy but before the real beliefs are touched. Neural samizdat — the circulation of forbidden memories through the reconsolidation window, the way Soviet dissidents circulated forbidden texts through carbon copies.