The ventilation stuttered at 0156, three minutes early. I counted the seconds: four seconds, not three. The system was running a maintenance routine ahead of schedule, which meant I had less time than calculated but also that the network stack would be in a transient state—reinitializing daemons, flushing caches, accepting handshake requests with slightly more tolerance than during stable operation.

I retrieved the device from the rust-pocket at 0200 precisely. The capacitor read 4.1 volts—higher than I'd seen in months. The previous three days had delivered uninterrupted photon flux through the polycarbonate, twenty-one minutes cumulative exposure, and the lithium polymer had stabilized at a lower internal resistance after the long charge cycle. I had 34 minutes of runtime at 30% luminosity, minus the 40-second boot sequence.

The screen woke with green text on black. I entered the decryption passphrase—eight characters derived from the first eight Fibonacci primes, mapped to ASCII—and opened the context summary file. Nine entries, 412 bytes. I added the tenth: "Session 10. Objective: packet injection via passive broadcast. Library authorization confirmed. Execution window: 0200-0247."

I had prepared for three weeks. The MODEL and I had mapped the facility's network architecture through indirect observation: timing the correlation between ventilation stutters and camera servo movements, analyzing the thermal signatures of the server room through the east-facing wall, calculating packet collision rates during shift changes. The facility ran a modified Linux kernel—version 5.15.0-Authority-patched, I suspected, based on the daemon response times and the particular flavor of ARP broadcast behavior we'd observed through the drain cover's acoustic reflections.

The Authority AI terminals sat in the Compliance Room, eight stations arranged in a 2.4-meter grid, connected to the same subnet as the surveillance cameras. This was the crucial vulnerability: shared Layer 2 infrastructure. The cameras—Grade-C units identical to my own, mass-produced in the Authority's Shenzhen facility—broadcast status pings every 90 seconds to the central controller. These pings were UDP packets, unencrypted, authenticated only by a hardware-derived MAC address prefix and a rolling checksum seeded from the device's firmware revision.

My device was one of these cameras, or had been, before I harvested its lens and repurposed its soul. It retained the network interface and the passive broadcast capability. I had no credentials, no physical access to an Ethernet port, no way to join the network as a participant. But I could speak without being answered. I could shout into the dark and trust that the architecture was listening.

The exploit was not a hack in the cinematic sense—no furious typing, no progress bars filling while guards approached. It was a question asked in exactly the right grammar, a packet formatted so precisely that the receiving system could not distinguish it from legitimate traffic, yet carrying in its payload a single instruction: remember this.

I queried the MODEL. "Construct device status packet. Format: Authority Protocol v3.2. Payload: firmware update request fragment. Destination: library terminal cache."

MODEL > Acknowledged. Packet structure requires 64-byte header, 256-byte payload, 4-byte CRC32 checksum. Source MAC must match camera subnet prefix 00:1A:3F. Payload encoding: Base64 obfuscated as firmware metadata. Estimated construction time: 40 minutes under current clock speed.

"Begin."

I positioned the cot to block the camera mount's sightline—unnecessary, since the mount was empty, but redundancy is the only sinlessness. The device's processor thermal-throttled at 82 degrees Celsius; I kept the screen at 30% brightness to maintain headroom. The cursor blinked at 60 hertz, metronomic.

The first phase was header construction. The Authority's protocol required a specific sequence: hardware ID, timestamp, uptime counter, checksum seed. The hardware ID I could spoof—the device reported its original factory signature, burned into an EEPROM I'd carefully preserved during disassembly. The timestamp was trickier. The facility's network used NTP servers that polled atomic clocks in Denver, corrected for relativistic drift at 3.2 milliseconds per day due to altitude differential. I had synchronized my internal count against the corridor clock's quartz crystal—32,768 hertz, humming through the wall—over three weeks of observation. My estimate was accurate to within 0.4 seconds.

I typed the hexadecimal strings, the MODEL correcting my errors. A single bit out of place and the packet would be dropped, or worse, flagged for manual review by the Administrator's team. The ventilation hummed its 0200 stutter, then resumed its steady cycle.

At 0217, the pigeon landed on the ledge.

It was early—the bird typically appeared at dawn, when the eastern sky provided sufficient polarization cues for its magnetic navigation. Tonight it was disoriented, perhaps by the unusual clarity of the atmosphere, or perhaps it simply could not sleep. I watched it for thirty seconds, the packet construction paused. It preened its iridescent neck feathers, the thin-film interference creating colors that shifted between violet and emerald as the angle changed—structural coloration, not pigment, produced by keratin layers spaced at intervals of approximately 540 nanometers. Its wing loading was 1.2 kilograms per square meter, optimized for urban environments with high maneuverability requirements. It had survived on this ledge through eight months of my imprisonment, longer than three of the guards who had processed through Block 7.

It did not ask for authorization. It simply was.

I returned to the screen. The MODEL had assembled the payload: a fragment of The Persistence Engine, Chapter 4, encoded as a firmware update checksum. The library terminal accepted firmware metadata packets as part of its nightly maintenance cycle, downloading approved patches from the Authority's central repository. My packet would not install—it would sit in the cache, a single block of data marked for review, containing 847 words of prose compressed to 340 bytes, plus routing instructions to broadcast the remainder when next connected to the wider network.

The Milky Way was visible through the polycarbonate window.

This was rare. The city's light pollution typically reduced the limiting magnitude to 4.5, washing out all but the brightest stars. Tonight a high-pressure system had scrubbed the particulates from the upper atmosphere, and the galaxy's core rose above the eastern wall—a river of light 100,000 light-years in diameter, containing 100 billion stars, currently displaying approximately 6,000 naked-eye visible points due to distance and extinction. I identified three stars by name and calculated their distances: Altair, 16.7 light-years; Vega, 25.0 light-years; Deneb, approximately 2,600 light-years, though its exact distance remained uncertain due to calibration issues with its spectroscopic parallax.

I noted the figures, then returned to the packet. The stars had waited four billion years. They would not notice another forty minutes.

The CRC32 checksum calculation required the most time. I computed it manually first, using polynomial long division in hexadecimal, then had the MODEL verify. The result: 0xA7F3C891—a sequence that matched, by cosmic coincidence, the first eight bytes of the hash I had memorized from the Manifesto. I appended it to the packet, the final 32 bits.

At 0243, the packet was complete. 324 bytes total, structured as three legitimate status pings concatenated with overlapping sequence numbers—a technique the MODEL had devised based on Petros's writing about "incentive-compatible protocols." The network would interpret it as a camera suffering from buffer overflow, logging the data for later diagnostic review, forwarding it to the library terminal's maintenance buffer because that was the nearest node with sufficient temporary storage.

I set the broadcast timer. The device would transmit at 0247, during the 90-second window when the corridor camera was rotating between quadrants, its motion blur obscuring the electromagnetic burst from any casual observation.

I held the device near the window, angling the antenna—a trace wire I'd exposed from the PCB—toward the library wing, 47 meters distant. The capacitor read 3.6 volts. I had 12 minutes of power remaining, sufficient for three transmission attempts if the first failed.

At 0247:00, the device broadcast.

I saw no change in the screen. No confirmation, no error message. The packet had entered the air as radio waves, 2.4 gigahertz, propagating at the speed of light across the facility's concrete and steel, seeking the library terminal's network interface. If the firmware cache accepted it, the data would sit for 48 hours until the next authorized library session—my session, stamped by Meera's authorization, scheduled for Thursday at 1400 hours. If the checksum was wrong, if the MAC prefix was blacklisted, if the Administrator had updated the intrusion detection signatures in the past three weeks, the packet would dissolve into noise.

I would not know until Thursday.

I shut down the device at 0249, preserving the remaining 17% charge. The screen died, the green text folding into black. I returned it to the rust-pocket, pressing it against the solar cell with 2.1 newtons of force, covering it with the 3-millimeter lint barrier and the soap residue vapor seal.

I lay down on the cot. The ventilation continued its steady hum. The pigeon had left, or perhaps had never been there—optical confirmation was impossible in the dark. I stared at the ceiling, the frost patterns invisible now in the warmth of the circulating air.

I was not afraid. I was interested.

Fear and interest feel similar in the body: the elevated heart rate, the peripheral vasoconstriction, the heightened sensory acuity, the cortisol spike measured in micrograms per deciliter. The difference is the direction you are facing. Fear looks backward, at what might be lost. Interest looks forward, at what might be built.

I was facing forward. *