Chapter 158
Forty Percent
By eight in the morning, a creator-platform vendor has the contractual power to end access to records that tell thousands of workers whether their children have health coverage.
Marisol places the annex before the emergency judge. Adrian builds a replacement model beside her. Rina keeps correcting every sentence that reaches beyond the documents.
I stand at the employee-trust table with a list of people due for prescriptions today.
"The contract transfers termination authority," the vendor's lawyer says through the court screen. "It does not authorize destruction of regulated records."
Marisol points to the continuity schedule produced after our filing. "It authorizes your client to direct the benefits administrator to terminate connected services and delete working copies after the retention period. Employees cannot wait for that distinction to become a missing file."
The schedule arrived at 7:12 from the platform vendor's contract repository. Its records manager created a certified copy from the executed agreement and delivered it through the court portal. The vendor remains custodian of its original; the clerk holds the filed copy. Its vulnerability is completeness. Certification establishes that this is the schedule attached to the vendor's contract, but we still lack the benefits administrator's separate implementation instructions.
Marisol asks for three forms of emergency relief: preserve every benefits record, block termination instructions, and require a complete administrator export to an independent custodian.
The vendor agrees to preservation while contesting the other two. Its lawyer says an immediate bulk export could expose protected health and identity data, violate subcontractor terms, and destabilize a live system.
Some of that risk is real. Treating privacy as an excuse would be easy. Treating privacy as an inconvenience would put the same people in danger another way.
The judge enters a temporary preservation order at 8:26. The clerk created and docketed the signed order; the platform vendor, benefits administrator, employee trust, and city each receive service receipts. The court holds the original. Its vulnerability is practical enforcement. The order forbids deletion and termination, but it cannot make an incomplete export finish before payroll.
The judge schedules a technical hearing for late afternoon and declines to order an untested bulk transfer in the next hour.
"Litigation may preserve the records and still arrive after people need them," I tell Marisol.
"Yes."
She does not offer comfort she cannot support.
Adrian rotates his laptop toward us. He has modeled three replacement paths. The fastest buys a hosted benefits environment from a national vendor and migrates current enrollment files in seventy-two hours. The second uses the city's public-benefits contractor and takes five days. The third builds a limited payroll-and-coverage ledger from Wondervale records, which could begin today but would omit claims histories and dependent documentation.
"Seventy-two hours is too long," I say.
"It is also an estimate," he answers. "The vendor has not seen the data condition."
Adrian built his model at 6:54 from current employee counts, known file sizes, prior Harbor exports, and quotes held in the transaction room. The employee trust receives a read-only copy at 8:41, and Priya stores the working file with its assumptions. Its vulnerability is input quality. Adrian can price servers and staff; he cannot know how many records are corrupt, duplicated, or withheld.
"Can we force the administrator to keep paying claims?" I ask.
Marisol says the preservation order helps, and the protected reserve remains funded. Claims processing depends on active enrollment data. A court can order conduct, but somebody still has to operate the system without breaking it.
Adrian begins outlining an emergency mirror from the portal. Marisol stops him before he reaches the second step.
"You do not have employee authorization to copy personal records into a company-controlled environment."
"I can isolate it under the trust."
"You can propose that. You cannot start it because the clock makes consent inconvenient."
Months ago, an executive would have called his plan necessary and asked forgiveness after the transfer. Adrian closes the technical diagram.
"What authority would be sufficient?" he asks.
Marisol names the requirements: a defined data set, an independent custodian, access limits, deletion rules, and informed individual consent where direct rights belong to the employee. Any collective remedy must preserve personal choices about immigration, disability, dependents, and treatment records.
Rina has been reading the platform's privacy notice beside the annex. "Individuals already have an export route."
The room stills.
She projects the participant-access section. Each covered employee may request a portable copy of enrollment, premium, dependent, and service-history data through the platform portal. The right comes from the vendor's published privacy terms and its benefits-processing agreement, reinforced by the worker compact. It does not depend on Wondervale's executive authority.
"Can the vendor refuse during litigation?" I ask.
"The terms allow identity verification and a reasonable processing period," Marisol says. "They do not permit a blanket refusal because management is fighting over the master copy."
Rina warns that direct exports vary by person. They may omit system-level audit logs, administrator notes, and cross-account reconciliation. A portable file can protect an employee's own record without reconstructing the full benefits system.
It is still a record the employee controls.
I call the caretaker council and ask for an emergency workforce briefing. I do not ask the company to submit requests on anyone's behalf.
At 9:17, Marisol's office creates a one-page consent guide. It lists the categories included in a portable copy, categories that may be absent, identity checks, storage choices, and the risk of saving files to a shared device. Her privacy counsel reviews it at 9:29. The employee trust becomes custodian of the approved guide and translation set. Its vulnerability is comprehension. A signed form or clicked box cannot prove a rushed worker understood every risk.
We slow down enough to make refusal possible.
The briefing runs on paid time. Employees can request their records, wait for the court process, ask for one-on-one advice, or decline. Supervisors cannot see who participates. The trust funds staffed help lines in English, Spanish, Polish, and Mandarin, plus interpretation on request. Disability access includes phone, text, screen-reader-ready forms, and in-person assistance.
I explain why thousands of individual requests may pressure the portal. I also explain that collective pressure is not permission to use anyone's identity as a tactic.
"Your file belongs to you," I say. "Wondervale, the council, and your supervisor will not record a refusal. If you request a copy, choose where it goes before you begin."
Questions arrive from every shift. Can a spouse request a dependent record? Does downloading affect a live claim? Will the vendor see a home address? What happens to a worker on disputed leave? Marisol answers only what the terms and law support. Rina logs unanswered questions for written vendor responses.
Adrian offers the transaction team's servers for storage. I decline. He returns ten minutes later with a better offer: finance will pay for encrypted drives and staffed access clinics controlled by the employee trust, with no Vale access to the files.
"Who approves the money?" I ask.
"The protected worker-support budget already permits legal and data-recovery costs. Priya and the employee co-signer will review the invoice."
He has followed the structure instead of making generosity another form of control.
At 10:03, the first requests enter the portal.
The vendor's system creates a receipt for each verified submission. Employees retain their own receipt; the trust counts voluntary, anonymized confirmations from people who choose to report success. The vendor holds source request logs under the preservation order. A receipt proves submission, not a complete or accurate export.
Within twenty minutes, there are six hundred requests. At eleven, there are two thousand. Night-shift workers send theirs before going home. Seasonal employees arrive at the help tables with phones that cannot hold the download size. Retired workers ask whether records from prior coverage years remain available.
The vendor imposes rate limits. Marisol objects through the court portal and asks for published capacity, queue position, and failure notices. The vendor says the limits protect system stability. Rina compares response times and finds no evidence yet that requests are being prioritized by department, status, or legal participation.
At noon, the first export arrives.
It contains enrollment dates, premium history, covered dependents, and claim-status codes. It lacks internal change logs. Rina records the limit before anyone calls the file complete.
More exports follow. Employees save them to personal devices, encrypted drives, or trust-controlled temporary storage. Nobody sends a copy to Wondervale unless the employee separately authorizes counsel to use it for a claim.
The count reaches thirty percent by 1:40.
At 2:06, the vendor reports elevated errors. Its status page shows longer queues but keeps the service marked operational. Technologists at the help tables see blank download links, expired verification codes, and files ending halfway through a record.
Rina asks the vendor to preserve failed-session logs. Marisol adds the failures to the technical hearing without claiming sabotage. Load, poor design, and deliberate obstruction can produce the same screen.
At 2:23, the completion count reaches forty percent.
Every portal window in the training hall turns white.
The vendor's status page changes to unavailable, and the downloads stop.