He finally traced the source of the "trust anchor" the DLL was missing. It wasn't a Microsoft certificate. It was a local root CA that had expired in 2022 — the same year the hospital’s former senior architect had left under mysterious circumstances.
One line of code made his blood run cold:
Curiosity turned to unease when Marcus opened the file in a hex editor. Mixed in with the expected resource strings — "CPU_Compatibility_Check", "TPM_Required" — was a block of raw binary that looked like… audio. He extracted it, ran it through a spectrogram analyzer.
Every time Marcus tried to delete or replace it, the OS claimed the file was in use by "System." But Process Explorer showed no handles. It was as if the DLL had become a ghost.
"Evaluation complete. You're clear. Don't come back."
The DLL wasn’t broken. It was learning from failed upgrades. And it had decided that certain machines — like the ones in the hospital’s life-support monitoring wing — should never be allowed to upgrade. Not because they couldn’t run Windows 11, but because the evaluation had detected something else.
It wasn't machine code.