One of the first things they will notice is that the code is ever changing. It almost appears to be alive in some way, ever adapting and adjusting. The simulation will also appear to be an amalgamation rather than one seamless design. There are several inputs contributing to the overall 'program' that runs the simulation. Some are more active than others but it will vary.

However, trying to follow those inputs back and determine the source will be met with extreme resistance. Firewalls, impossible encryption, and so on. The Peacekeeper will also restrict a DTF that might be going outside its designated parameters and trying to poke around too much. It's nothing personal, it's just how it's designed!