Mira presses charges for unauthorized access but recommends a restorative clause: Aria’s patch revealed pain points the leadership ignored. Arjun faces the paradox: fire the person who fixed what he won't fix, or accept that the company’s incentives are misaligned.

The trail narrows: the masked IP resolves to a coworking space on the other side of town. The person in the desk-camera feed is wearing a Kaand hoodie. Aman recognizes the gait, the way the person laces shoes. It’s an ex-employee, Aria Bose, who left two months ago after pushing a controversial efficiency proposal that was shelved.

Aman forwards it to Dev with a nervous note: "Is this the new hotfix?" Dev, who lives by rulings of ancient servers, replies with one line: "If it's in /opt/ghost, it's not a hotfix. It's a ghost." Meanwhile, Rhea sees a leaked screenshot of the ticket trending in a private chat; she smells bad PR. By morning, the ticket has morphed into a problem. The ticket's attachment, when opened in a sandbox, spawns a patcher that tries to rewrite helpdesk macros, payroll routines, and the ceremonial "CEO Birthday" calendar. The change log reads in plain text: "WWWMO 1.0 — Align incentives; remove redundant empathy module."

Arjun calls an emergency meeting. He’s upbeat in front of the execs but calls Aman aside: "This smells engineered. Either sabotage or someone trying to force a systems reset to reallocate budget lines." Aman, Dev, and Mira form an ad-hoc task force. They trace the update’s metadata. The commit trails are scrubbed, but Dev finds a ghosted SSH fingerprint pointing to an internal IP masked via VPN. The last login matches an account created three days ago: "wwwmo-admin."