The Annex After Receipt

The weakness repeats across every row: account logs establish activity attributed to credentials. They do not establish the human being at the keyboard or whether a recipient read a file.

My first upload was a capital forecast created by Vale finance. It included attendance totals by month, not individual employee activity. The file hash in the room matches the finance archive version created at 2:09 on a Tuesday afternoon.

Ellison Ridge's counsel account received it at 2:14.

At 2:37, a revised workbook entered the same room under a nearly identical filename. That version contains the creator attendance annex. The room lists an executive upload account as source but no author name inside the annex.

"Which version did the lender use?" Elliot asks.

The access ledger shows an Ellison Ridge account downloaded both. It does not show whether the named counsel personally opened them. A later downside summary uses three retention assumptions that appear only in the revised workbook.

The lender's later model uses the annex data. We still need to know who added it before transfer.

Tessa reads the annex headings aloud. "These categories came from the mentorship dashboard. Observation hours, prototype access, sponsor visibility. Someone converted them into turnover predictions."

Her recognition is a lead, so Diane obtains the dashboard schema from the employee trust's preserved audit copy. Tessa created the original project labels with her team. The mentorship platform created the attendance export, and the employee trust became custodian when the pilot was suspended. Because some staff used paper sign-in sheets and some after-hours work occurred off-site, the export is incomplete.

The annex selects employees with low promotion scores and high unpaid project hours from the larger export.

"It treats pressure as flight risk," Tessa says. "Then it tells a lender the people most exploited are the least stable."

Elliot asks whether any employee consented to creditor use. Tessa answers before counsel can turn consent into a policy abstraction.

"No. They were told attendance supported safety and project coordination."

I search my memory for the revised workbook. Diane stops me.

"Memory after seeing the file can fill gaps with what is on the screen," she says. "We reconstruct first. You describe second."

She has spent decades making other people's work orderly. Today she refuses to let my confession choose the order.

The examiner compares document properties. The revised workbook was assembled from the finance forecast and a comma-separated attendance export at 2:31. Its internal author field carries a procurement analytics template name. Author fields can be inherited or edited, so we do not treat that as identity.

At 2:33, Jonah's procurement account opened the mentorship dashboard through delegated reporting access. Two minutes later, a procurement file service generated an export matching the rows selected in the annex. At 2:37, the revised workbook entered my refinancing room.

The timing and matching selection establish a route through Jonah's authorized systems. They do not establish whether Jonah personally operated either account.

Diane searches the preserved mail archive for the revised filename. One message appears from Jonah to me at 2:40: Added utilization detail to the lender sensitivity. Better to show labor volatility before they price it for us.

The server confirms his account sent the message. The attachment hash matches the revised workbook. Jonah's own sentence attributes the addition to him, although counsel notes that account compromise remains technically possible and the statement does not identify who assembled the source rows.

I remember the message now.

"I told him the lender needed operating realism," I say. "The phrase utilization detail made me assume department totals, and I did not open the annex."

Tessa looks at me. "You sent it anyway."

"Yes."

"You built a private room, let procurement supply the labor assumptions, and relied on the filename instead of reviewing the workers inside it."

"Yes."

My earlier corrective disclosure admitted I concealed the Sloane warning. At the time, I was ignorant that the same private channel carried employee-level attendance to the lender. That ignorance changes intent while leaving the data exposed.

Elliot asks what the lender could infer from the annex.

Tessa refuses to speculate about their motives. She identifies what the file enables: names can be linked to badge activity, advancement scores, unpaid project participation, and predicted departure. A creditor could use the data to discount reform costs, identify likely witnesses, or pressure staffing decisions. The file does not prove Ellison Ridge did any of those things.

"The workers must be notified," she says. "Before the regulator publishes a request that lets them learn from a headline."

Committee counsel says notification may need to preserve the investigation.

"Then write one that preserves it. Do not use preservation as a second concealment."

We revise the work order at Tessa's demand. Camille receives a limited breach notice for affected staff. The employee trust gets the annex under protected custody. Tessa steps out of the room to help draft plain-language notice, but she does not take a copy or become its custodian.

The first draft calls the annex an unauthorized analytics attachment. Tessa replaces the label with what workers need to know: individual attendance and mentorship records were placed in a creditor forecast without documented consent. She adds that no manager may question employees about whether they plan to leave, and no promotion decision may rely on the annex. Camille accepts the restrictions and adds a protected correction route for anyone whose data is inaccurate.

Tessa removes her own name from the approval line because her prior exception signature is part of the source history. The employee trust approves the notice.

I ask counsel to expand my privilege waiver.

The first waiver covered the Sloane warning thread. The regulator now needs every transfer, comment, draft, call note, and legal instruction concerning the private refinancing room. Some records may contain strategy that weakens Vale in the debt dispute. Some may expose advice given to me personally.

Keeping them protected would let me confess only the part already found.

"Waive the full transfer chain," I say.

Elliot does not thank me. "Do you understand that Ellison Ridge will receive discoverable material it can use against the company?"

"Yes."

"And you understand your succession role remains suspended?"

"Yes."

Tessa returns in time to hear it. "Do the work without treating an apology as a job application."

"Agreed."

I face her because the harm entered through her team. "I concealed the lender route and failed to inspect the file I allowed Jonah to add. That exposed creator attendance and witness risk to a creditor. I am sorry. I will support notice and correction without asking you or the employees to trust me again."

Tessa's face offers me no relief.

"Preserve the files," she says. "Pay for independent review from your own distributions if the trust requests it. Do not contact the affected creators directly."

"Agreed."

Counsel creates the expanded waiver at 8:46. It covers the transfer chain but preserves unrelated personal and third-party legal advice. The independent committee retains the executed original and files it with the regulator. Its vulnerability is scope: disputed documents may require a privilege ruling, and waiver cannot create records that were deleted or moved to other channels.

I sign at 8:53.

The examiner releases the next layer of the activity ledger. Seven uploads entered the room. Six trace to finance, my counsel, or the procurement revision we have reconstructed. The seventh arrived three weeks later, after Ellison Ridge began acquiring notes.

Its attachment is a compressed forecast package containing the revised labor annex and an updated cash projection.

The room log records the source credential, the 11:48 p.m. upload, and the receiving lender account. It cannot identify the person using either account.

Diane enlarges the source field.

The upload originated from Elliot's executive account.