Proof from the Paper Roster

The team tests latches, route width, backup power, staff response, quiet-space entry, medication delivery, and roster verification. Inspectors ask workers to explain procedures without supervisors answering for them. One seasonal performer gives the wrong location for a manual override. Tessa stops the route, retrains the crew, and repeats the drill before asking for credit.

At ten, the physical systems pass.

The documentation review does not.

The city requires proof that every worker assigned to the west route received paid evacuation training after the cue redesign. HR has qualification records. The trust has design-session attendance. Dev has drill results. None shows the exact roster for the overnight shift that installed and tested the modules.

Camille searches the isolated scheduling archive. The digital record ends before installation because Wondervale still uses the worker-run paper system for protected operations. The department packet contains page forty-two and page forty-four. Page forty-three is missing.

Without it, six workers' training and paid time cannot be reconciled. The city inspector can delay approval or exclude the route.

"Who had custody?" I ask.

The operations captain says the original went to payroll intake. Payroll scanned the packet, but its file also jumps from forty-two to forty-four. A supervisor's photograph shows a stack, not readable names. None proves page forty-three existed at handoff.

June arrives with the employee verification archive.

Her three-copy roster rule put one copy with the department, one with payroll, and one at the worker desk. The employee archive stores its copy by sequence number, not supervisor name. She does not hand it to me.

She gives it to the city inspector.

Page forty-three lists six workers, training codes, start and end times, worker acknowledgments, and two initials from different roles. The worker desk stamped receipt at 11:52 p.m. The reverse contains a correction where one employee replaced a sick coworker and received the full paid session.

The operations captain created the roster before the shift, and the worker desk amended it before placing it in the employee archive. The original employee copy remains with the trust; the city receives a certified scan. Its vulnerability is paper. Handwriting can be misread, initials require authentication, and the page proves recorded attendance, not competence.

The inspectors test that limit.

They select three workers from the page and interview them separately. Each identifies the cue docks, evacuation lane, and failed-sleeve closure. Drill logs confirm performance. Payroll compares the times and confirms payment to all six, including the replacement premium.

The inspector selects a fourth name from page forty-two as a control. That worker attended the earlier route briefing but not the redesigned-cue training and correctly says she is not qualified for the west turn. The scheduling system has her assigned to food service outside the controlled zone. Her answer matters because a roster that makes everyone appear trained would be easier to approve and less trustworthy.

Hart's analyst reconciles the six names against access logs without treating entry as attendance. Five badges opened the employee gate before training. The replacement used a temporary credential after reporting the sick call at the worker desk. The access record supports presence but cannot show who remained for the full session; time sheets, acknowledgments, interviews, and drill performance have to agree.

The missing company copies remain a records failure. Camille opens an incident review rather than treating June's archive as permission to ignore it.

"Why was page forty-three absent twice?" the inspector asks.

Payroll intake shows a scanner jam at 12:18. The machine log records an error between pages forty-two and forty-four. That explains the missing scan, not the missing physical company copy. The department captain remembers returning the packet after payroll but cannot identify who refiled it.

The inspector records the gap as unresolved. No evidence supports deliberate removal. The company must reconcile custody and report within ten business days.

Camille maps the handoff while the inspection continues. The department copy moved from the captain to payroll intake, then to a return bin shared by three units. No one signed receipt after scanning. She closes the bin process immediately and issues numbered transfer envelopes with two-role acknowledgment. The change protects future packets, but it cannot manufacture custody evidence for the missing page. The incident remains open.

June asks that employees review the new envelope before implementation. The first version requires a supervisor signature even when a worker delivers a correction directly. That would recreate the gate that workers built the paper desk to remove. Payroll revises it so either the worker desk or department can initiate transfer, and the receiving role must acknowledge without requiring managerial approval of the content.

June's paper archive supplies the proof necessary for training. It also preserves a disagreement the digital system would have flattened: the replacement worker challenged an unpaid break deduction, and the worker desk corrected it before payroll.

"The manual process was supposed to be temporary," a board observer says.

"Temporary does not mean disposable," June answers. "We keep it until the replacement system proves workers can see and challenge changes."

The inspector asks who owns future roster design. June says employees and HR jointly, with safety qualification input and no vendor exclusivity. Elliot Vale is not on the list.

I feel the old instinct to add resources and solve the next system. I ask instead whether the budget process has received a proposal. It has. The employee seats vote next month.

At noon, inspectors hold the closing conference. Dev's closures remain valid for the three unrepaired attractions. The west route and winter zones may reopen. The cue pilot remains conditional on freeze-cycle review. Benefits and labor covenants are outside the inspector's direct licensing authority but appear in the public reopening conditions through the city subsidy agreement.

Each department lead must answer one final question: what evidence would make the city close the area again? Food service names a refrigeration breach, Tessa names crowd clearance outside the limit, Dev names an uncontained safety defect, and Camille names assigned workers without paid qualification. The inspector records each answer beside the responsible role. Approval does not erase the risks; it identifies who must act when a threshold is crossed.

Hart asks one worker from each department where to report a supervisor who refuses a stop. Every worker names the independent route, though two reach for an outdated phone number on their cards. The city requires replacement cards before the public gate opens. June verifies distribution from the employee desk instead of accepting a bulk-delivery receipt.

The employee observer asks whether communications may summarize the conditions as "fully compliant." Hart says no. The order authorizes specified operations under continuing duties and leaves three attractions closed. Any public statement must link the actual order. Rina adds the exact language to the reopening release before the inspectors depart.

Approval depends on four items: reconcile the missing company roster page, maintain paid training, publish safety metrics, and report any route failure within twenty-four hours. A significant breach can trigger partial closure without waiting for a full annual review.

The lead inspector creates the conditional approval at 12:24, enters it into the municipal licensing system, and serves Wondervale, the trust, and employee representatives. The city retains the authoritative order. Its vulnerability is compliance. Approval reflects evidence today, and the city can withdraw it if practice diverges from the record.

I sign acknowledgment, not celebration.

Department leads receive copies before communications. Dev tells maintenance what remains closed. Tessa schedules a worker-only walkthrough. Lena confirms payroll paid testers for reopening review. June files page forty-three back in the employee archive after the city certifies its scan.

Reporters gather at the public gate. Communications asks whether I will announce that Wondervale passed.

"Conditional approval," I say. "Department leads present first."

Dev names the remaining closures. Tessa explains the delay and redesign. June shows the roster process without exposing worker names. Hart states the city's authority to inspect again.

I stand behind them and watch Wondervale speak in voices that do not need mine to become official.

At 1:03, the municipal portal changes our status from CLOSED PENDING REVIEW to CONDITIONALLY APPROVED FOR REOPENING.

One condition appears in bold beneath it:

Wondervale must publish safety and labor metrics every quarter.