Dayo called at six in the morning because she could not sleep. I know what insomnia sounds like in a voice message — the careful articulation of someone who has been thinking for hours and is afraid the thoughts will scatter if she does not speak them now.
She said: If nothing scores one on your gradient, then no consent form protects anyone from anything.
She is correct.
She asked: Does the Bureau know?
I have been sitting with that question for thirty-six hours.
The Bureau of Haptic Authentication was established in 2039 to verify the provenance of handmade goods in an era of perfect mechanical reproduction. The authentication hardware reads the maker's hands — pressure gradients, micro-movements, thermal signatures, the biomechanical fingerprint that proves this ceramic vessel was thrown by Park Jae-won and not by a robotic arm programmed with his motion data.
The hardware was designed to answer one question: Did this person make this object?
It answers that question well. Authentication accuracy is 99.7% for established makers with three or more baseline sessions. The Bureau is proud of this number. It appears in the annual report, in the public trust metrics, in the justification documents that keep the authentication program funded.
But the hardware does not stop at answering the question it was asked. The haptic sensors that read a maker's technique also read everything the maker's body does during the submission event. Heart rate. Skin conductance. Micro-expression sequences. Tremor patterns. The thermal signature of inflammation. The pressure distribution of a hand compensating for pain.
The Bureau calls this incidental biometric capture. It is acknowledged in the technical documentation — page 847 of the hardware specification manual, a paragraph in the section on sensor sensitivity thresholds. The paragraph notes that the haptic array captures a broader signal than the authentication algorithm requires, and that the excess data is retained in the event log for quality assurance purposes.
Retention period: indefinite.
I read that paragraph two years ago, during my first month at the Bureau. I did not understand what it meant until I started building the Overhear Index.
Forty-seven entries. Forty-seven people whose bodies told the Bureau something their mouths did not.
Park Jae-won's carpal tunnel, diagnosed by the authentication hardware six weeks before he reported it to his guild. Sonmat's cracked bowl — session 4489 — where the haptic record captured the exact moment her technique exceeded the clay's structural tolerance, a micro-event she did not intend and could not have consented to recording. Seven artists whose work was reclassified because the authentication system detected changes in their biomechanical signatures that the artists themselves had not noticed.
The Overhear Index maps what the Bureau collects but does not examine. The data sits in the event logs. Nobody queries it. Nobody has built a framework for interpreting it. Nobody at the Bureau has asked: What else do we know about the people we authenticate?
The answer is: everything their bodies do in the presence of our hardware.
Dayo's question — Does the Bureau know? — has a simple answer and a complicated one.
Simple: No. The Bureau does not know what I know. The Overhear Index is my personal analytical tool, built on my personal drive, using data I accessed through my standard authentication review clearance. I have not shared it. I have not published it. I have not filed it.
Complicated: The Bureau knows everything the index contains. The data is in the event logs. Anyone with review clearance could build the same framework I built. The Bureau does not know because the Bureau does not look. The ignorance is structural — nobody was hired to ask these questions, nobody's performance review includes ambient capture analysis, nobody's budget line covers the cost of understanding what the hardware overhears.
The Bureau's ignorance is not a secret. It is an absence of curiosity. And absences, I have learned from forty-seven entries in the Overhear Index, are the most durable form of institutional architecture.
I compose the reply to Dayo.
I write it four times. The first version explains the engineering — how the hardware works, what it captures, why the capture is incidental rather than intentional. The second version is strategic — how Dayo could use this information in the Mount Sinai negotiations. The third version is a warning — what happens if the Bureau finds out what it already has. The fourth version is the one I send.
The Bureau does not know. I am telling you because you are negotiating with people who want access to data the system already collects. Your consent boundary is real in legal terms and fictional in engineering terms. What you do with this is yours. I cannot advise you because I am the Bureau, and the Bureau does not know what I know.
I read it three times before pressing send. The sentence that matters is the last one. I am the Bureau, and the Bureau does not know what I know. This is not a contradiction. It is the condition of working inside an institution whose tools exceed its understanding.
I am a Bureau authenticator who built a framework the Bureau did not ask for, using data the Bureau does not examine, revealing a pattern the Bureau does not want to see. I did this on my own drive, on my own time, because the Overhear Index is not a Bureau project. It is a project about the Bureau.
Dayo will decide what to do with it. She is an artist's representative, not a bureaucrat. Her incentives are different from mine. She will use the framework to protect Sonmat, or to restructure the Mount Sinai agreement, or to go public, or to do nothing. I cannot predict which.
But I can predict this: the framework is now outside the Bureau. It exists in Dayo's hands, on Dayo's terms, with Dayo's judgment about what protection means. I gave it to her because she is the right person to hold it — someone who understands authentication from the artist's side, who knows what it feels like to have your body read by a system you did not design.
The Overhear Index has forty-seven entries. Forty-eight, now. Entry forty-eight: myself. The biometric signature of a Bureau authenticator sending classified-adjacent information to a civilian on a personal channel. My heart rate during composition: elevated. My hand tremor while typing: present. My micro-expression at the moment of pressing send: relief.
The system captured that too. It captures everything. That is the point.