Chapter 115
Twelve Thousand Shifts
Jonah is missing, his company devices are abandoned, and three live networks still recognize procurement routes his team helped design.
I order isolation before anyone can turn his absence into a conclusion. Nico reaches for the network map. June Park reaches for a paper binder.
"If you isolate everything at once," she says, "you erase twelve thousand scheduled shifts."
Councilwoman Hart looks from her to me across the emergency operations table. Jonah missed his forensic interview fifty-six minutes ago. That makes him absent from a required meeting. It does not establish that he fled, that he touched Elliot's account, or that he has access to any current system.
Every minute of delay costs us.
The ride-control network governs inspection status and maintenance holds. Payroll receives time and premium codes. The vendor network carries delivery permissions and receiving records. They were designed as separate environments, but Nico's review has found service bridges used for overnight synchronization.
Vale technology created the architecture diagram six months ago, and a vendor administrator last updated it two weeks before the credential lockout. Technology operations holds the signed export. Its vulnerability is practical: undocumented bridges may exist, and a line on a diagram does not prove a route is active.
"We test each bridge before cutting it," Nico says.
"How long?"
"Four hours if the map is complete. Longer if it isn't."
"We do not have longer."
I write the isolation order with the exact systems named. Ride controls keep local safety logic but lose external vendor synchronization. Payroll stops automated imports and retains the last verified time snapshot. Vendor access loses every bridge into operations. No one deletes accounts, logs, or pending changes.
Hart requires the order in the municipal incident record because the closures and public audit fall within her oversight. I create it at 3:42. She countersigns at 3:49 after city counsel confirms that her approval witnesses the emergency protocol but does not transfer management authority to the city.
The order proves who authorized the isolation and when. It cannot prove we found every route.
Nico sends the signed hash to technology operations. Two independent administrators execute the cuts while the examiner records their screens. At 4:03, the first synchronization link goes dark.
By 4:08, scheduling terminals across Wondervale display the same red banner.
LIVE ROSTER UNAVAILABLE. CONTACT YOUR SUPERVISOR.
The banner reaches food service, maintenance, costumes, clinic support, security, sanitation, guest operations, and every seasonal team due to rotate before midnight. Twelve thousand shift assignments cover the next seven days. All twelve thousand jobs still exist. Workers have lost the digital system that tells them where and when to report.
A worker who misses a shift because management cannot find the record may still lose pay.
"Put the scheduling bridge back," Nico says. "We can isolate it downstream from payroll."
"Can you prove the bridge cannot write into vendor access?"
He studies the map, then shakes his head.
June opens her binder. "We can run on paper."
Inside are department rosters with numbered pages, handwritten corrections, supervisor initials, and worker acknowledgments. Creases and corrections cover pages people have used.
"We built this after the spring outage," she says. "The scheduling app failed for nine hours and management paid people according to whatever the system recovered. Workers kept their own copies after that."
She places an outage report beside the binder. Guest operations created the report at 6:20 the morning after the failure. June's organizing committee retained a stamped copy after payroll closed the dispute. It shows that the paper rosters reconciled ninety-three percent of shifts before the digital system returned. The remaining seven percent required supervisor and employee review.
"This is not a perfect record," June says. "It is a continuity method we have tested under pressure."
Nico turns one page carefully. "Anyone can alter a paper line."
"Anyone with scheduling access can alter a digital one. Paper makes us look at the handwriting."
She offers a tested system with visible weaknesses.
June proposes a three-copy roster. One copy stays with the department captain, while payroll receives the second. Workers who do not report to the same supervisor staff an employee verification desk and hold the third. Every change requires the worker's acknowledgment and two initials from different roles. Missing workers are contacted through protected numbers already held by HR; organizers do not copy the directory.
Nico adds a sequence number and a photograph taken at handoff. The photograph proves the page's condition at that time, not whether the underlying assignment was proper. Hart adds a city observer at the central intake table. I require safety-critical teams to be checked against qualifications held by Camille Brooks's protected personnel unit before deployment.
Within twenty minutes, June has an accountable manual option ready, so we can leave the dangerous bridge severed.
"How many departments can start now?" I ask.
"All of them, if management stops pretending the workers are the last people who know where they work."
The answer would have annoyed me a month ago. Today I write her authority into the protocol.
Nico reads the clause twice. "Worker verification can reject a supervisor's change?"
"Pending review," June says. "Otherwise the second desk is decoration."
"Agreed."
Her eyebrows rise; she expected a fight.
"You found the scheduling risk before we did," he tells her. "I'm not going to punish competence because it came in a binder."
Hart countersigns the manual-operations appendix at 4:37. Her office keeps the city copy. Wondervale operations holds the working protocol. The employee trust receives a read-only scan. Its vulnerability is speed: hurried handwriting, missed calls, and local pressure can still produce mistakes. Every exception will require later reconciliation before payroll closes.
The first paper shift begins at five.
Food service captains bring current assignments to the intake room. Workers compare them to screenshots, text notices, and personal calendars. None of those sources controls by itself. Where all three agree, the captain and worker sign. Where they conflict, the worker keeps paid status while the assignment waits for review.
A maintenance supervisor tries to move two technicians from closed Harbor Flight to an open attraction without checking their certification. The employee desk rejects the change. My safety unit verifies one technician's qualification and finds the other lacks training on the new control system. The first transfers. The second receives paid document work.
While manual operation slows the park, it catches an unsafe assignment before convenience can hide it.
At 5:26, payroll receives the first numbered roster packet. The intake clerk stamps each page and returns a duplicate receipt. Digital scheduling remains offline; the packet preserves a path from assigned work to paid time.
The second packet exposes a different failure. A clinic support worker appears on sanitation's evening roster at the same time she is assigned to medication intake. Both supervisors insist their copy is current. June asks the worker before either manager can turn her into a disputed resource.
"The clinic asked me yesterday," she says. "I agreed. Sanitation said they would cover me."
Camille's staffing coordinator created the clinic request at 1:06, and the worker acknowledged it at 1:19. HR holds both messages. Sanitation's page was printed earlier and never amended. The messages prove the later agreement; they do not prove why the supervisor failed to update the roster.
June marks the clinic shift operative, keeps the sanitation shift paid until a replacement is confirmed, and records the conflict for later review. Nico watches her give the worker the receipt number.
"The old system would have overwritten one assignment," he says.
"And whichever manager lost would blame her," June replies.
June's record preserves the work and the people who agreed to it before managers can rewrite the history.
At 5:51, technology confirms the ride, payroll, and vendor networks no longer exchange active sessions through any documented bridge. Their scan also finds two dormant service accounts. Nico places both under preservation instead of deleting them. Dormant status does not tell us who created or last controlled them.
Jonah remains missing.
Security has no lawful basis to turn the park into a manhunt. His vehicle left the executive garage before his scheduled interview, but the gate camera records a plate and a driver-shaped image, not a face. Counsel gives that evidence to investigators with its limits attached.
We keep working as June's team begins reconciling night assignments. At 2:14 yesterday afternoon, an unidentified scheduler used the department account to create North Service's paper roster. A supervisor printed it at 3:02 and stored it in the locked roster cabinet. The cabinet custodian signed it out after the isolation order. Any authorized scheduler could have changed the source before printing, and handwriting added later remains unauthenticated.
June stops on page forty-seven.
"Dev."
Four names appear beneath an 11:00 p.m. assignment. The location field reads West Utility Tunnel C. The job code is archive relocation.
That tunnel has been closed since the Crown Chase evidence breach. The maintenance plan authorizes no night crew there, and our incident schedule contains no archive move.
Whoever created the assignment could still have erased it from the digital system.
The signed paper copy survives.