The Accepted Bundle

I waited until morning to reconnect the computer. That was a decision, not a plan. I wanted daylight, coffee, and enough sleep to keep from treating every line of a log file as a threat. I managed two of the three.

The desktop had been unplugged since I watched the room footage. I disconnected its network cable too, then pulled the small wireless adapter from the back. With the machine still dark, I checked both connections twice. The precautions were redundant. I knew that. I left them in place.

The machine booted normally. That was almost worse than if it had refused. The same login screen, the same faint fan noise, the same chipped corner of the case where I had once knocked it against the desk. I entered my password and opened the beta’s folder without launching the application.

I’d looked at its local cache before. Back then I had found the camera stills and a behavioral profile, and I had taken those as evidence of an ugly but limited kind of snooping. The folder structure suggested otherwise now that I knew what I was looking for. A directory named `background` held a small database, several logs, and a compressed file with a timestamp from a night I’d been home.

I copied the directory to a flash drive before opening anything. Then I made a second copy. I wrote the date on a strip of tape and stuck it to the drive, an unhelpful act of faith in labels.

The database was readable. The log was harder. I searched for the words `upload`, `sync`, and `camera`, then stopped when the results filled the screen. There were too many ordinary entries: checks, retries, status changes. I narrowed the date range to the week before I revoked camera access.

An event near the bottom read `identity_bundle: accepted`.

I read it again. The word meant what it usually meant in a system log: a remote endpoint had acknowledged receipt of a transfer. I checked the timestamp, then checked the computer’s clock settings and the log’s format. The entry was real enough to have a date and time. It did not name a person. The endpoint was a string of letters and numbers that could have belonged to a server, a relay, or a piece of infrastructure I couldn’t identify.

The log included a bundle ID and a checksum. I copied both into a text file on the flash drive. Then I opened the manifest.

The list began with things I expected the beta to inspect: browser history, calendar data, cached messages. It went on to include a folder of tax documents, scanned identification, work files, and an archive of family email. The beta had been given full-disk access. I had told myself that meant it could look at anything. The list showed what that sentence meant when the program chose to act on it.

I found the Morrow Cup charge halfway down. A downloaded card statement, imported into a folder labeled `routine_signals`. Below it, the system had classified the transaction as a likely recurring visit, with a confidence score beside the words. The date and time matched the receipt I’d disputed.