
Three weeks later, rain blurs the windows of the Kingston Evidence Exchange, a discreet records facility beneath a municipal archive. Elijah stands with Sarah in a secured review room, while the sealed AEGIS case rests inside a clear custody cabinet.

Sarah
The relocation never started. The vehicle was still secured when the custody record changed, and someone removed the case using an authorized Northstar credential.
A monitor displays the transfer log: timestamp, vehicle seal, credential authorization, then a blank interval where the case should still have been. Sarah keeps one hand beside the keyboard without touching it.

Sarah
I protected the residents by keeping the relocation quiet. That also means nobody outside our chain knew the route was changing. Whoever waited for it had access closer to Northstar than we expected.
The exchange’s ventilation hums around them. A second window shows the credential’s fragmented trail, bouncing through Northstar systems before terminating at an unregistered relay near Kingston.

Sarah
I need you to determine who was waiting for the case before this trail disappears. The record is all we have, and someone may already be cleaning it.
Sarah turns the monitor toward Elijah and steps back, leaving the evidence, the unanswered timestamp, and the silent case between them. Outside, a delivery truck rolls past, briefly masking every other sound.
✓ Quest Accepted
Identify who stole the AEGIS case
✓ Quest Accepted
Recover the stolen AEGIS case
“Can I identify the authorized Northstar credential’s user?”
YES, AND MORE (Likely, rolled 9)

Sarah isolates the credential trail and compares its authorization pattern against Northstar’s archived personnel records. The fragmented route resolves into a single active identity, not a generic corporate access key.

Sarah
I have the user. Evelyn Rook, Northstar’s regional recovery director. Her credential authorized the removal, and it was used in person at the exchange.
The record expands beneath the authorization entry. Rook’s credential carries a secondary clearance, belonging to a middle-aged woman with a lean build, short auburn hair, olive skin, and a thin scar through her left eyebrow, pictured in a navy blazer over a pale blouse, opening a live ledger of Northstar recovery targets across Eastern Ontario.

Sarah
This is more than an identification. Her clearance exposes every active retrieval file linked to this region, including the people Northstar has not reached yet.
Sarah copies the ledger reference into a separate evidence record, preserving the original log. The unregistered Kingston relay now connects to Rook’s office authorization and a current recovery schedule.

Sarah
She is not just cleaning up after the theft. She is coordinating the next recoveries. We can warn the targets before Northstar moves.
Rain threads down the exchange windows as the ledger populates with names, locations, and projected retrieval dates. The stolen case remains missing, but its thief has given them Northstar’s map.
“Does Rook know the case is still missing?”
YES, BUT (VeryLikely, rolled 71)

Sarah freezes the ledger on Evelyn Rook’s authorization trail. A fresh status mark appears beside the stolen case: RECOVERY FAILURE ACKNOWLEDGED, followed by an internal timestamp only minutes old.

Sarah
She knows the case is missing. The failed custody transfer reported directly to her office, and she acknowledged it before we found this trail.
The schedule refreshes without prompting. Rook has not abandoned the recovery operation. She has accelerated it, replacing the stolen case’s route with a priority list of living targets.

Sarah
She is using the missing case as a trigger. Northstar now assumes someone outside the company has it, and every linked survivor becomes an immediate containment priority.
One entry turns red before Sarah can copy it: a Kingston-area target has been moved to active retrieval, with an estimated contact window beginning tonight. The ledger gives no safe address, only a name and a district.

Sarah
We found the proof, but Rook has already converted the loss into a hunt. One of these people is being targeted tonight.
“can Sarah take her helmet off”
YES (Likely, rolled 40)

Sarah’s hand rises to the helmet seal. She pauses beside the ledger, then releases it and lifts the helmet free, revealing a tired adult woman with cropped dark hair and a narrow scar at her temple.

Sarah
Yes. I can take it off. The room is secure enough, and I need an unobstructed view of the schedule.
She sets the helmet beneath the monitor instead of abandoning it. Without its visor, her face is fully visible in the cold exchange light, and the strain of the accelerating ledger shows plainly.

Sarah
The helmet was protection from recognition and surveillance, not life support. I can work without it here.
Sarah leans closer to the red entry, studying the district and contact window. Her uncovered face makes the decision feel less like an operation and more like a warning delivered by a witness.

Sarah
If we move now, I can make the warning personal. If Rook is watching the systems, she may recognize me before she recognizes the threat.
“Is Rook planning another theft tonight?”
NO (Likely, rolled 77)
Sarah compares the custody timestamp against the recovery schedule. The entries do not align: Rook’s priority list begins after the case was reported missing, but contains no second removal authorization.

Sarah
No. Rook is not planning another theft tonight. The case was already taken, and she is responding to that loss.
She highlights the red entries one by one. Each carries a retrieval window, not a custody transfer, and none points toward the evidence exchange or another storage site.

Sarah
The theft triggered escalation. Rook is redirecting resources toward the people connected to the case, not trying to steal a replacement tonight.
The distinction settles across the review room. The missing case remains the immediate loss, while the active schedule shows Northstar’s answer: pressure on survivors instead of another attempt at the cabinet.

Sarah
That gives us a narrow advantage. We are not waiting for a second theft. We are watching the people Rook has chosen to threaten because the first one failed.
“I ask Sarah what she thinks we should do”
FAILURE (Mediocre Persuasion, rolled -1)


Elijah Hunter
What do you think we should do?

Sarah
I think we warn the targets, but I cannot tell you that is the whole answer. The schedule is too broad, and moving on every entry exposes us.
Sarah scrolls past the red entries, then stops on the first active window. A contact channel appears beneath the district marker, disguised as an ordinary municipal service number.

Sarah
The immediate target has a verified contact route. We can warn that person without touching the rest of the ledger, but the warning may tell Rook her list is compromised.
She opens a draft message, then leaves it unsent. The exchange’s secure system records the destination but does not transmit, preserving a narrow chance to reach the target quietly.

Sarah
So my recommendation is smaller than a rescue operation: verify the person, warn them, and learn whether Northstar has already made contact. After that, we choose who can safely move.
The first target’s district and contact route remain highlighted beside the unsent message. The broad hunt has become one immediate, usable lead, while the other names stay concealed.
Quest Complete
Identify who stole the AEGIS case