I bought this MacBook Pro 16" (M5 Pro, 48 GB) as BRAND NEW / SEALED from a local reseller at full new price. Box looked factory-sealed, nothing inside looked disturbed. I set it up on Aug 30, 2026. Then I checked the logs. I need expert opinions on what happened before me.
THE MACHINE (all verified on the unit itself)
- MacBook Pro 16", Apple M5 Pro (18-core), 48 GB, model identifier Mac17,8
- Order code: MGE64LL/A (US-market configuration)
- Serial: J3CXPF2W56
- Battery serial: F5DHSY005TS0000VDA - 3 charge cycles, 100% health (rated 1000 cycles)
- Charger as shipped: genuine Apple 140W USB-C (serial C4H621502PMQ41CAQ)
- Shipped on macOS 26.5.1 (factory image mastered May 21, 2026), now on 26.6.2
- No MDM/DEP enrollment (not ex-corporate). Single user account. No wipe/reinstall markers - log history runs unbroken from the very first boot to today.
THE 6-MINUTE SESSION ON JUNE 27, 2026 (Note: timestamps are in -07 because the machine was still on its factory-default Pacific clock - region was never chosen. So -07 does not prove physical location.)
- 09:29:26 -07 - first line ever written in /var/log/install.log. The boot ledger starts 4 seconds earlier: "wtmp begins Sat Jun 27 22:29:22 +06 2026" (that line renders in my local timezone; same moment).
- 09:29:33 -07 - the Hello screen (Language Chooser) starts. Wi-Fi scan finds NO networks.
- 09:31:12 -07 - "User input detected: Mac plugged in, cancelling shutdown timer" - someone connected the charger mid-session. ZERO keyboard/trackpad input was ever recorded in this session.
- 09:31:44 -07 - GarageBand / MAContent asset packs auto-staging (normal offline first-boot staging from the factory image; no Apple ID, no network).
- 09:34:59 -07 - the Mac restarts itself once (normal first-boot behavior; second BOOT_TIME recorded in hardware: 1782578099).
- 09:35:15 -07 - last activity ever. No shutdown record = force-powered-off (power button held).
Total uptime: 5 minutes 53 seconds across two boots. No login, no account, no language ever selected.
THEN 64 DAYS OF NOTHING
- /var/log/install.log contains exactly three dates: 2026-06-27, 2026-08-30, 2026-08-31. The last June 27 line (line 3366) is followed immediately by Aug 30 (line 3367).
- The boot ledger (last/wtmp) shows zero events between June 27 and Aug 30. No boots, no logins, nothing.
AUGUST 30, 2026 - ME, FOR THE FIRST TIME EVER
- 19:23:13 (+06, my local time) - "hello started"
- 19:23:18 - "User input detected: mouse moved" - the first human touch ever recorded on this Mac (mine)
- 19:24-19:27 - Setup Assistant runs (_mbsetupuser session); /var/db/.AppleSetupDone created 19:27:57
- No other username has ever logged in (deleted accounts would still appear in the boot ledger - none do).
APPLE'S OWN RECORD
- checkcoverage.apple.com shows warranty until Aug 29, 2027 - anchored to MY purchase date. So Apple's servers have no earlier activation, consistent with the June session never connecting to any Wi-Fi.
MY QUESTIONS
- Does Apple's factory QC ever boot a finished retail unit to the customer Hello screen ~5 weeks AFTER the factory image was mastered (May 21 -> June 27), and then force it off? Or does a truly factory-sealed Mac's install.log begin with the customer's own first boot?
- If not Apple: is "charger plugged in, no input, forced off after 6 minutes" consistent with an importer/reseller bench test - i.e., a US unit opened, tested, re-packed and re-sealed before export?
- Is there ANY way to tell where the June 27 boot happened, given the machine was on factory-default clock and never touched a network?
- Anything else I can check locally to narrow down who did it?
TL;DR: Sold as sealed new. The Mac's own logs prove it was opened and powered on once - 6 minutes, Hello screen only, charger plugged in, forced off - 64 days before my setup. Battery at 3 cycles, no prior accounts, no wipe, Apple warranty starts with me. Apple factory QC, or the seller's chain? If you work in Mac repair, retail, or QC, I'd genuinely value your read. Happy to paste more log lines on request.