{ "allCasesProductID" : "com.yuzool.sidequest.bundle.current_cases", "caseProductIDs" : { "case_02" : "com.yuzool.sidequest.case.quiet_house", "case_03" : "com.yuzool.sidequest.case.last_train", "case_04" : "com.yuzool.sidequest.case.dead_letter", "case_05" : "com.yuzool.sidequest.case.last_known" }, "cases" : [ { "chapters" : [ { "beatIDs" : [ "case_01_ch0.beat.0", "case_01_ch0.beat.1", "case_01_ch0.beat.2", "case_01_ch0.beat.3", "case_01_ch0.beat.4", "investigation.parcel", "case_01_ch0.beat.5" ], "beats" : [ { "answer" : "4471", "prompt" : "This phone isn't yours. It was left for you, unlocked once — with a note taped inside the case: 4 4 7 1. Enter it below.", "type" : "cipher" }, { "sender" : "HANDLER", "text" : "You don't know me. But you're about to.", "type" : "message" }, { "sender" : "HANDLER", "text" : "This phone isn't yours. It was left for you. Everything on it is real — the tasks, the photos, the people. Complete what I send you and I'll tell you why.", "type" : "message" }, { "body" : "You're an independent operative. No badge, no backup. Just a phone and a Handler who only speaks in text.", "imageName" : null, "title" : "YOUR COVER", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "Before you go anywhere, check the delivery audit in Browser. Someone changed where this phone was delivered. Compare it with Messages and Contacts. Tell me who. After that, your first field marker is a red door; Missions has an indoor alternative if you need it.", "type" : "message" }, { "investigation" : { "answers" : [ "Alvarez", "R Alvarez" ], "app" : "browser", "discovery" : "Alvarez redirected the parcel carrying this phone. Someone arranged your first contact before H messaged you.", "hints" : [ "The delivery text and the audit disagree about who made the request.", "Match the dispatch account in Browser to the directory in Contacts.", "RA-447 belongs to R. Alvarez. Enter Alvarez." ], "id" : "parcel", "question" : "Who requested the delivery change? Enter the contact’s surname.", "sources" : [ { "app" : "messages", "body" : "SwiftParcel • SP-88213\nDelivered to a neighbour at recipient’s request. You never set a delivery preference.", "id" : "parcel.source.0", "title" : "Delivery notification" }, { "app" : "browser", "body" : "Cached delivery audit\nRequest entered by dispatch account RA-447 at 11:58. This was an internal override, not a customer preference.", "id" : "parcel.source.1", "title" : "SP-88213 • request audit" }, { "app" : "contacts", "body" : "RA-447 — R. Alvarez, Silverline Freight dispatch.\nJO-558 — J. Okafor, Dockside night security.", "id" : "parcel.source.2", "title" : "Dispatch directory" } ], "title" : "The delivery that changed" }, "type" : "investigation" }, { "questTitle" : "Find a red door.", "type" : "fieldMission" } ], "id" : "case_01_ch0", "legacyBeatIDs" : [ "case_01_ch0.beat.0", "case_01_ch0.beat.1", "case_01_ch0.beat.2", "case_01_ch0.beat.3", "case_01_ch0.beat.4", "case_01_ch0.beat.5" ], "title" : "First Contact" }, { "beatIDs" : [ "case_01_ch1.beat.0", "case_01_ch1.beat.1", "case_01_ch1.beat.2", "case_01_ch1.beat.3", "case_01_ch1.beat.4", "case_01_ch1.beat.5", "case_01_ch1.beat.6" ], "beats" : [ { "sender" : "HANDLER", "text" : "Good. You're in the system now.", "type" : "message" }, { "sender" : "HANDLER", "text" : "This case is called COLD OPEN. Somebody wants something buried. We're going to dig it up.", "type" : "message" }, { "sender" : "HANDLER", "text" : "I found this on the last person who had this phone. See what you make of it.", "type" : "message" }, { "hotspots" : [ { "text" : "\"the mark is always the same colour as the door.\"", "x" : 0.29999999999999999, "y" : 0.29999999999999999 }, { "text" : "\"call only from a clean line.\"", "x" : 0.28000000000000003, "y" : 0.47999999999999998 }, { "text" : "The rest is torn off — but you can just make out: \"...4 7 1\"", "x" : 0.34999999999999998, "y" : 0.62 } ], "imageName" : "EvidenceNote", "prompt" : "A torn note, left on the desk. Tap around it.", "type" : "photoClue" }, { "body" : "All we have is a partial name and a burner number ending in 471. You're going to have to fill in the blanks.", "imageName" : null, "title" : "SUBJECT: UNKNOWN", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "The folded witness note describes something from the recovered pocket inventory. Compare Notes and Photos. Tell me which object it means.", "type" : "message" }, { "investigation" : { "answers" : [ "key", "a key" ], "app" : "notes", "discovery" : "The witness was describing a key. The unmarked key in the pocket is evidence, not a souvenir.", "hints" : [ "Open both listed records and compare their details.", "The photograph shows a coin, a key and an unmarked envelope. Only one of these turns inside a lock.", "The answer is key." ], "id" : "teeth", "question" : "Which object does the witness mean?", "sources" : [ { "app" : "notes", "body" : "I have teeth but never bite. I turn without taking a step. A room keeps its secrets until I arrive.", "id" : "teeth.source.0", "title" : "Folded witness note" }, { "app" : "photos", "body" : "The photograph shows a coin, a key and an unmarked envelope. Only one of these turns inside a lock.", "id" : "teeth.source.1", "title" : "Recovered pocket inventory" } ], "title" : "A pocket-sized witness" }, "type" : "investigation" } ], "id" : "case_01_ch1", "legacyBeatIDs" : [ "case_01_ch1.beat.0", "case_01_ch1.beat.1", "case_01_ch1.beat.2", "case_01_ch1.beat.3", "case_01_ch1.beat.4", "case_01_ch1.beat.5", "case_01_ch1.beat.6" ], "title" : "The Marker" }, { "beatIDs" : [ "case_01_ch2.beat.0", "case_01_ch2.beat.1", "case_01_ch2.beat.2", "investigation.manifest", "case_01_ch2.beat.3", "case_01_ch2.beat.4", "case_01_ch2.beat.5", "case_01_ch2.beat.6", "case_01_ch2.beat.7" ], "beats" : [ { "sender" : "HANDLER", "text" : "There's a route. Somebody walks it every week. We need to know it before they do.", "type" : "message" }, { "sender" : "HANDLER", "text" : "Five points. I need them walked in the right order — the order they're written in the note, not the order they're numbered on the map.", "type" : "message" }, { "correctOrder" : [ 2, 0, 4, 1, 3 ], "imageName" : "RouteMap", "points" : [ { "x" : 0.17999999999999999, "y" : 0.20999999999999999 }, { "x" : 0.53000000000000003, "y" : 0.14999999999999999 }, { "x" : 0.80000000000000004, "y" : 0.42999999999999999 }, { "x" : 0.42999999999999999, "y" : 0.63 }, { "x" : 0.20000000000000001, "y" : 0.78000000000000003 } ], "type" : "mapRoute" }, { "investigation" : { "answers" : [ "24", "24kg" ], "app" : "calculator", "discovery" : "One entire 24 kg crate disappeared before the shipment reached Dockside.", "hints" : [ "Work out the expected total first.", "Use Calculator: 18 × 24, then subtract 408.", "432 − 408 = 24. Enter 24." ], "id" : "manifest", "question" : "The manifest lists 18 crates at 24 kg each. The received total is 408 kg. How many kilograms went missing?", "sources" : [ { "app" : "browser", "body" : "18 identical crates. Declared weight per crate: 24 kg. Total weight received: 408 kg.", "id" : "manifest.source.0", "title" : "SLF-2291 • weight sheet" }, { "app" : "notes", "body" : "Packaging weight is already included. The scale was calibrated. Compare the declared total against the received total.", "id" : "manifest.source.1", "title" : "Weighbridge note" } ], "title" : "What was removed?" }, "type" : "investigation" }, { "body" : "Contents redacted pending customs review. Destination: Bay 14, Dockside Storage. Whoever's walking that route is walking it for this shipment. Worth a look if you ever get a spare browser tab.", "imageName" : null, "title" : "SILVERLINE FREIGHT — MANIFEST #SLF-2291", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "Now find the unlisted delivery entrance. The visitor notice is in Browser; Okafor's access note is in Contacts.", "type" : "message" }, { "investigation" : { "answers" : [ "east stairwell", "east" ], "app" : "browser", "discovery" : "The east stairwell is the delivery route after reception closes.", "hints" : [ "Open both listed records and compare their details.", "At night, deliveries come through the east stairwell. Knock twice. Do not use the quay gate.", "The answer is east stairwell." ], "id" : "side-entrance", "question" : "Which entrance remains open after 18:00?", "sources" : [ { "app" : "browser", "body" : "Main reception closes at 18:00. Couriers must use the entrance named in the night-shift note. The quay gate is locked for repairs.", "id" : "side-entrance.source.0", "title" : "Dockside visitor notice" }, { "app" : "contacts", "body" : "At night, deliveries come through the east stairwell. Knock twice. Do not use the quay gate.", "id" : "side-entrance.source.1", "title" : "Okafor • access note" } ], "title" : "Find the unlisted entrance" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "One more. Get eyes on someone — approach a stranger, get them talking. You need to know you can do this before it matters.", "type" : "message" }, { "questTitle" : "Ask someone you know for a recommendation and give them your full attention.", "type" : "fieldMission" } ], "id" : "case_01_ch2", "legacyBeatIDs" : [ "case_01_ch2.beat.0", "case_01_ch2.beat.1", "case_01_ch2.beat.2", "case_01_ch2.beat.3", "case_01_ch2.beat.4", "case_01_ch2.beat.5", "case_01_ch2.beat.6", "case_01_ch2.beat.7" ], "title" : "The Route" }, { "beatIDs" : [ "case_01_ch3.beat.0", "case_01_ch3.beat.1", "case_01_ch3.beat.2", "case_01_ch3.beat.3", "case_01_ch3.beat.4", "case_01_ch3.beat.5" ], "beats" : [ { "body" : "Partial number: _ _ 4 7 1. Torn note: \"the mark is always the same colour as the door.\" You already found a red door. Put it together — the code is the same four digits from the note.", "imageName" : null, "title" : "EVIDENCE LOG", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "That number on the note. It's not just a phone number — it's a code. You've seen it before. Enter it.", "type" : "message" }, { "answer" : "4471", "prompt" : "Enter the four-digit code from the note.", "type" : "cipher" }, { "sender" : "HANDLER", "text" : "That's the code to a storage locker. I can't tell you where yet. You need one more thing first.", "type" : "message" }, { "sender" : "HANDLER", "text" : "The switchboard calls encode a second sequence. Messages has the extract; Notes explains how the printout was ordered.", "type" : "message" }, { "investigation" : { "answers" : [ "258" ], "app" : "messages", "discovery" : "The switchboard sequence is 258. The newest-first display had concealed the order.", "hints" : [ "Open both listed records and compare their details.", "The log was printed newest first. The access sequence uses the extension digits in the order the calls actually happened.", "The answer is 258." ], "id" : "call-order", "question" : "Put the three extension digits in chronological order. What is the sequence?", "sources" : [ { "app" : "messages", "body" : "06:14 — extension 8\n06:11 — extension 5\n06:08 — extension 2", "id" : "call-order.source.0", "title" : "Switchboard extract" }, { "app" : "notes", "body" : "The log was printed newest first. The access sequence uses the extension digits in the order the calls actually happened.", "id" : "call-order.source.1", "title" : "Switchboard notation" } ], "title" : "Three calls, one sequence" }, "type" : "investigation" } ], "id" : "case_01_ch3", "legacyBeatIDs" : [ "case_01_ch3.beat.0", "case_01_ch3.beat.1", "case_01_ch3.beat.2", "case_01_ch3.beat.3", "case_01_ch3.beat.4", "case_01_ch3.beat.5" ], "title" : "The Cipher" }, { "beatIDs" : [ "case_01_ch4.beat.0", "investigation.watch", "case_01_ch4.beat.1", "case_01_ch4.beat.2", "case_01_ch4.beat.3", "case_01_ch4.beat.4", "case_01_ch4.beat.5", "case_01_ch4.beat.6", "case_01_ch4.beat.7" ], "beats" : [ { "sender" : "HANDLER", "text" : "Last thing for this phase. Someone planted something on you already. You just haven't noticed.", "type" : "message" }, { "investigation" : { "answers" : [ "22", "2200" ], "app" : "weather", "discovery" : "The 22:00 bridge inspection leaves Unit 14 unobserved during heavy rain.", "hints" : [ "You need both weather cover and an absent patrol.", "Compare the 22:00 entries in Weather and Calendar.", "The only overlap is 22:00. Enter 22." ], "id" : "watch", "question" : "Which hour gives you rain cover while the patrol is away? Enter the hour in 24-hour time.", "sources" : [ { "app" : "weather", "body" : "Operation-night forecast, fictional location:\n21:00 clear • 22:00 heavy rain • 23:00 clear.", "id" : "watch.source.0", "title" : "Dockside • archived forecast" }, { "app" : "calendarApp", "body" : "Patrol inside Unit 14 at 21:00. Bridge inspection from 22:00 to 22:45. Returns to Dockside at 23:00.", "id" : "watch.source.1", "title" : "Night patrol roster" } ], "title" : "A gap in the watch" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "Compare your shopping receipt with the parcel draft. Find the item you never ordered. Both records are on this phone.", "type" : "message" }, { "investigation" : { "answers" : [ "brass key", "key" ], "app" : "notes", "discovery" : "The brass key was planted inside a legitimate delivery.", "hints" : [ "Open both listed records and compare their details.", "Mug, light, notebooks. Also a brass key in an unmarked sleeve. No sender on the sleeve. I have not used it.", "The answer is brass key." ], "id" : "unclaimed", "question" : "Which item was delivered without appearing on your order?", "sources" : [ { "app" : "notes", "body" : "Ordered: blue mug; rear bicycle light; three notebooks. All three items were checked on arrival.", "id" : "unclaimed.source.0", "title" : "Shopping receipt" }, { "app" : "messages", "body" : "Mug, light, notebooks. Also a brass key in an unmarked sleeve. No sender on the sleeve. I have not used it.", "id" : "unclaimed.source.1", "title" : "Parcel contents • your draft" } ], "title" : "Something that is not yours" }, "type" : "investigation" }, { "body" : "Whatever it is, it means someone's already been close enough to touch your life. That should worry you more than it does.", "imageName" : null, "title" : "PLANTED", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "While you were checking your own place, someone else sent me this. Page 14 of an off-book ledger. Read the margin.", "type" : "message" }, { "hotspots" : [ { "text" : "\"UNIT 14 — PAID, recurring, 1st of month.\" Same locker the note pointed to.", "x" : 0.23999999999999999, "y" : 0.20000000000000001 }, { "text" : "\"H. — no line item. redacted throughout.\" Even the ledger won't name the Handler.", "x" : 0.57999999999999996, "y" : 0.31 }, { "text" : "\"ASSET (NEW) — ACTIVE, first tasking logged this week.\" That's you. You're a line item.", "x" : 0.45000000000000001, "y" : 0.37 }, { "text" : "Margin note, different handwriting: \"if H asks about the ASSET line — I never wrote it. — dockside\"", "x" : 0.34999999999999998, "y" : 0.54000000000000004 } ], "imageName" : "LedgerPage", "prompt" : "A page torn from somewhere it shouldn't have left. Tap around it.", "type" : "photoClue" }, { "body" : "Someone at Dockside Storage logs your taskings before you even finish them. Either they're watching the same feed the Handler is, or they ARE the Handler — and \"H\" is a shared alias, not one person.", "imageName" : null, "title" : "YOU ARE A LINE ITEM", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "That locker code you found — I can get you the address now. Give me a minute.", "type" : "message" } ], "id" : "case_01_ch4", "legacyBeatIDs" : [ "case_01_ch4.beat.0", "case_01_ch4.beat.1", "case_01_ch4.beat.2", "case_01_ch4.beat.3", "case_01_ch4.beat.4", "case_01_ch4.beat.5", "case_01_ch4.beat.6", "case_01_ch4.beat.7" ], "title" : "Check Your Six" }, { "beatIDs" : [ "case_01_ch5.beat.0", "case_01_ch5.beat.1", "case_01_ch5.beat.2", "investigation.intercept", "case_01_ch5.beat.3", "case_01_ch5.beat.4", "case_01_ch5.beat.5", "case_01_ch5.beat.6" ], "beats" : [ { "sender" : "HANDLER", "text" : "Corner of the old industrial block. Row of lockers nobody's touched since the building shut. Yours is the one with no number on it.", "type" : "message" }, { "correctOrder" : [ 1, 3, 0, 4, 2 ], "imageName" : "RouteMap", "points" : [ { "x" : 0.17999999999999999, "y" : 0.20999999999999999 }, { "x" : 0.53000000000000003, "y" : 0.14999999999999999 }, { "x" : 0.80000000000000004, "y" : 0.42999999999999999 }, { "x" : 0.42999999999999999, "y" : 0.63 }, { "x" : 0.20000000000000001, "y" : 0.78000000000000003 } ], "type" : "mapRoute" }, { "body" : "A single key. No tag. No note. Just a key that opens something else, somewhere else.", "imageName" : null, "title" : "LOCKER CONTENTS", "type" : "dossier" }, { "investigation" : { "answers" : [ "14" ], "app" : "comms", "discovery" : "Unit 14 held the missing crate: the original ledger linking freight payments to the operation.", "hints" : [ "The intercepted delivery went to the same account as the phone.", "“One-four” is a unit number. Cross-check the index.", "Enter 14." ], "id" : "intercept", "question" : "Which unit received the missing crate? Enter its number.", "sources" : [ { "app" : "comms", "body" : "DISPATCH: Keep the extra crate off the main manifest.\nNIGHT SHIFT: Copy. Same unit as the phone account. One-four.\nDISPATCH: It contains the original payment ledger. No copies.", "id" : "intercept.source.0", "title" : "Intercept • freight radio" }, { "app" : "browser", "body" : "Unit 12: empty. Unit 14: leased to the phone account. Unit 17: maintenance supplies.", "id" : "intercept.source.1", "title" : "Dockside • unit index" } ], "title" : "The missing crate" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "Inspect the key description in Photos. Compare it with the locker service manual in Browser. Which compartment does it fit?", "type" : "message" }, { "investigation" : { "answers" : [ "document drawer", "drawer" ], "app" : "photos", "discovery" : "The key fits a document drawer, not an exterior door.", "hints" : [ "Open both listed records and compare their details.", "Meter cupboard: long brass key, round bow.\nDocument drawer: short flat key, square bow, two teeth.\nLoading door: electronic fob.", "The answer is document drawer." ], "id" : "key-fit", "question" : "Which compartment does the recovered key fit?", "sources" : [ { "app" : "photos", "body" : "Short flat blade. Square bow. Two teeth. No brand or number.", "id" : "key-fit.source.0", "title" : "Key inspection" }, { "app" : "browser", "body" : "Meter cupboard: long brass key, round bow.\nDocument drawer: short flat key, square bow, two teeth.\nLoading door: electronic fob.", "id" : "key-fit.source.1", "title" : "Locker service manual" } ], "title" : "A key without a tag" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "Every locker in this case has a padlock nobody remembers buying. Find one out in the real world that has clearly been left for years. I want to see what neglect looks like on a lock.", "type" : "message" }, { "questTitle" : "Find a padlock that has clearly been left in place for years.", "type" : "fieldMission" } ], "id" : "case_01_ch5", "legacyBeatIDs" : [ "case_01_ch5.beat.0", "case_01_ch5.beat.1", "case_01_ch5.beat.2", "case_01_ch5.beat.3", "case_01_ch5.beat.4", "case_01_ch5.beat.5", "case_01_ch5.beat.6" ], "title" : "The Storage Locker" }, { "beatIDs" : [ "case_01_ch6.beat.0", "case_01_ch6.beat.1", "case_01_ch6.beat.2", "investigation.device", "case_01_ch6.beat.3", "case_01_ch6.beat.4", "case_01_ch6.beat.5", "case_01_ch6.beat.6" ], "beats" : [ { "sender" : "HANDLER", "text" : "I need to tell you something before this goes further.", "type" : "message" }, { "hotspots" : [ { "text" : "Timestamp: 23:41:07 — three minutes before your very first message from me.", "x" : 0.25, "y" : 0.94999999999999996 }, { "text" : "That's not a stranger in the doorway. Look at the coat.", "x" : 0.52000000000000002, "y" : 0.57999999999999996 }, { "text" : "This was taken from inside the building across from yours.", "x" : 0.10000000000000001, "y" : 0.40000000000000002 } ], "imageName" : "SurveillancePhoto", "prompt" : "A still, pulled from a camera neither of us installed. Tap around it.", "type" : "photoClue" }, { "body" : "You've never seen my face. Never heard my voice. For all you know, \"H\" isn't watching the case. \"H\" IS the case.", "imageName" : null, "title" : "HANDLER: UNVERIFIED", "type" : "dossier" }, { "investigation" : { "answers" : [ "relay.h", "relayh" ], "app" : "vitals", "discovery" : "H used the phone’s remote relay to take the surveillance image, then lied about its source.", "hints" : [ "Compare the photo timestamp with the camera access log.", "The matching entry is the remote process.", "Enter relay.h." ], "id" : "device", "question" : "Which process accessed the camera at 23:41? Enter its name.", "sources" : [ { "app" : "vitals", "body" : "CAMERA ACCESS\n23:38 camera.manual — closed\n23:41 relay.h — remote capture\n23:44 messages — foreground\nThis is an archived fictional device log.", "id" : "device.source.0", "title" : "Device audit • 23:41" }, { "app" : "photos", "body" : "Captured at 23:41:07. The source is this phone’s remote relay, not the street camera claimed in H’s caption.", "id" : "device.source.1", "title" : "Surveillance still • metadata" } ], "title" : "Who opened the camera?" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "I'm not going to pretend that photo doesn't exist. Compare the camera audit with my first message. Calculate the gap yourself.", "type" : "message" }, { "investigation" : { "answers" : [ "180", "180 seconds" ], "app" : "calculator", "discovery" : "H had camera access 180 seconds before introducing themself.", "hints" : [ "Open both listed records and compare their details.", "First message from H: 23:44:07. This receipt uses the same handset clock.", "The answer is 180." ], "id" : "audit-gap", "question" : "How many seconds passed between the capture and H’s first message?", "sources" : [ { "app" : "vitals", "body" : "Capture: 23:41:07. The timestamp is from the handset clock.", "id" : "audit-gap.source.0", "title" : "Camera audit" }, { "app" : "messages", "body" : "First message from H: 23:44:07. This receipt uses the same handset clock.", "id" : "audit-gap.source.1", "title" : "Message receipt" } ], "title" : "Three missing minutes" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "If that still came from a camera neither of us installed, then cameras matter. Find one pointing at a public street and note which way it faces. Tell me what it can and can't see.", "type" : "message" }, { "questTitle" : "Find a security camera and note which way it points.", "type" : "fieldMission" } ], "id" : "case_01_ch6", "legacyBeatIDs" : [ "case_01_ch6.beat.0", "case_01_ch6.beat.1", "case_01_ch6.beat.2", "case_01_ch6.beat.3", "case_01_ch6.beat.4", "case_01_ch6.beat.5", "case_01_ch6.beat.6" ], "title" : "Who Is H" }, { "beatIDs" : [ "case_01_ch7.beat.0", "choice.trust-h", "case_01_ch7.beat.1", "case_01_ch7.beat.2" ], "beats" : [ { "sender" : "HANDLER", "text" : "The missing crate held the original freight ledger. Alvarez diverted it to Unit 14 and delivered this phone so you could find it. I used the camera relay to confirm delivery. That was the lie you caught.", "type" : "message" }, { "choice" : { "id" : "trust-h", "options" : [ { "consequence" : "You challenged H. H acknowledges the remote capture in your report.", "id" : "challenge", "response" : "H: Yes. I activated the relay. I needed to know Alvarez delivered the phone. You caught the lie.", "text" : "You took that photo. Explain yourself." }, { "consequence" : "You preserved a copy with M. An independent archive now exists.", "id" : "reserve", "response" : "M: Good instinct. I sent you a mirror receipt. H can’t erase your copy now.", "text" : "I’m keeping a copy before we continue." } ], "prompt" : "H used your camera and hid it. How do you respond?" }, "type" : "choice" }, { "body" : "COLD OPEN resolved: Alvarez redirected the phone and the missing crate. Unit 14 held a ledger documenting off-book payments to former operatives. H took the surveillance photo remotely. One ledger entry remains unresolved: Dana Mercer, listed missing but still receiving support.", "imageName" : null, "title" : "CASE CLOSED — FOR NOW", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "Welcome to the work. I'll be in touch. — H", "type" : "message" } ], "id" : "case_01_ch7", "legacyBeatIDs" : [ "case_01_ch7.beat.0", "case_01_ch7.beat.1", "case_01_ch7.beat.2" ], "title" : "Cold Open" } ], "continuationChapterID" : null, "estimatedPlayTime" : "About 1–2 hours", "id" : "case_01", "investigationCount" : 11, "isFree" : true, "requiredCompletedCaseID" : null, "synopsis" : "You were left a phone. Someone's using it to run you. First job: find out what COLD OPEN actually is.", "tagline" : "A phone that isn't yours. A Handler who won't say why.", "title" : "COLD OPEN" }, { "chapters" : [ { "beatIDs" : [ "case_02_ch0.beat.0", "case_02_ch0.beat.1", "case_02_ch0.beat.2", "case_02_ch0.beat.3", "case_02_ch0.beat.4" ], "beats" : [ { "sender" : "HANDLER", "text" : "COLD OPEN's filed. Good. Now here's what's actually been waiting.", "type" : "message" }, { "sender" : "HANDLER", "text" : "There's a house two streets from where you photographed that red door. Listed vacant for eight months. Meter's been running the whole time.", "type" : "message" }, { "body" : "Address withheld pending clearance. Owner of record: deceased, three years ago. Utility account still active — paid in cash, monthly, on time.", "imageName" : null, "title" : "CASE FILE — QUIET HOUSE", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "Get a feel for what 'occupied' actually looks like before I send you to the real thing.", "type" : "message" }, { "questTitle" : "Find a house number you like the look of.", "type" : "fieldMission" } ], "id" : "case_02_ch0", "legacyBeatIDs" : [ "case_02_ch0.beat.0", "case_02_ch0.beat.1", "case_02_ch0.beat.2", "case_02_ch0.beat.3", "case_02_ch0.beat.4" ], "title" : "Vacant On Paper" }, { "beatIDs" : [ "case_02_ch1.beat.0", "case_02_ch1.beat.1", "case_02_ch1.beat.2", "investigation.meter", "case_02_ch1.beat.3" ], "beats" : [ { "sender" : "HANDLER", "text" : "Good. Now the real one. From the street, it should look empty. Tell me if it does.", "type" : "message" }, { "hotspots" : [ { "text" : "Upstairs window. Lit, every night, same time. Someone's keeping a schedule.", "x" : 0.71999999999999997, "y" : 0.35999999999999999 }, { "text" : "Front yard hasn't been touched in months. Whoever's inside isn't keeping up appearances — or doesn't care to.", "x" : 0.29999999999999999, "y" : 0.80000000000000004 }, { "text" : "The path to the door is worn smooth. Somebody uses it. A lot.", "x" : 0.5, "y" : 0.88 } ], "imageName" : "QuietHouse", "prompt" : "The house, from across the street. Tap around it.", "type" : "photoClue" }, { "body" : "Overgrown outside, worn path inside the gate. That's not neglect — that's a way of hiding in plain sight. Nobody looks twice at a house that already looks empty.", "imageName" : null, "title" : "READ", "type" : "dossier" }, { "investigation" : { "answers" : [ "8", "8kwh" ], "app" : "calculator", "discovery" : "The house uses eight times the vacancy baseline. Someone is living there.", "hints" : [ "Subtract the first reading from the second.", "Divide 48 by 6 in Calculator.", "The average is 8 kWh per day. Enter 8." ], "id" : "meter", "question" : "The meter rose from 1840 to 1888 over 6 days. What is the daily average in kWh?", "sources" : [ { "app" : "photos", "body" : "Day 1: 1840 kWh. Day 7: 1888 kWh. Six complete days between readings.", "id" : "meter.source.0", "title" : "Meter photographs • readings" }, { "app" : "notes", "body" : "An empty property with only the alarm active uses less than 1 kWh per day. Compare the measured daily average.", "id" : "meter.source.1", "title" : "Vacancy baseline" } ], "title" : "An occupied house" }, "type" : "investigation" }, { "questTitle" : "Find a bit of nature reclaiming something man-made.", "type" : "fieldMission" } ], "id" : "case_02_ch1", "legacyBeatIDs" : [ "case_02_ch1.beat.0", "case_02_ch1.beat.1", "case_02_ch1.beat.2", "case_02_ch1.beat.3" ], "title" : "The Meter" }, { "beatIDs" : [ "case_02_ch2.beat.0", "case_02_ch2.beat.1", "investigation.visits", "case_02_ch2.beat.2", "case_02_ch2.beat.3", "case_02_ch2.beat.4" ], "beats" : [ { "sender" : "M.", "text" : "Don't go in that house. I'm serious. Whoever's in there isn't your problem to solve.", "type" : "message" }, { "sender" : "HANDLER", "text" : "Ignore that. Static on the line, nothing else. Keep going.", "type" : "message" }, { "investigation" : { "answers" : [ "3", "03" ], "app" : "calendarApp", "discovery" : "The technician brings the cash payment each month. Maintenance is a cover for supporting the occupant.", "hints" : [ "Compare the dates in both records.", "Visits and payments repeat on the same day.", "Enter 3." ], "id" : "visits", "question" : "Which day of each month does the unlisted technician visit? Enter the day number.", "sources" : [ { "app" : "calendarApp", "body" : "January 3 • February 3 • March 3. Each visit starts at 06:00, before neighbours leave for work.", "id" : "visits.source.0", "title" : "Maintenance • archived visits" }, { "app" : "browser", "body" : "Cash payments received on the 3rd of each month at a branch across town. No contractor is named.", "id" : "visits.source.1", "title" : "Utility payment receipts" } ], "title" : "A maintenance pattern" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "I need eyes on the house from three angles before we go further. Walk the block, in this order.", "type" : "message" }, { "correctOrder" : [ 4, 0, 1, 2, 3 ], "imageName" : "RouteMap", "points" : [ { "x" : 0.22, "y" : 0.29999999999999999 }, { "x" : 0.68000000000000005, "y" : 0.20000000000000001 }, { "x" : 0.84999999999999998, "y" : 0.55000000000000004 }, { "x" : 0.55000000000000004, "y" : 0.75 }, { "x" : 0.14999999999999999, "y" : 0.62 } ], "type" : "mapRoute" }, { "investigation" : { "answers" : [ "west lane", "west" ], "app" : "maps", "discovery" : "The west lane gives a public approach without entering the property.", "hints" : [ "Open both listed records and compare their details.", "Observe from a public path. Do not enter a yard or open a gate. We need a report, not another missing person.", "The answer is west lane." ], "id" : "safe-route", "question" : "Which approach lets the observer stay in a public place?", "sources" : [ { "app" : "maps", "body" : "West lane: public footpath.\nEast yard: residents only.\nNorth gate: private service entrance.", "id" : "safe-route.source.0", "title" : "Block access plan" }, { "app" : "messages", "body" : "Observe from a public path. Do not enter a yard or open a gate. We need a report, not another missing person.", "id" : "safe-route.source.1", "title" : "M. • boundary" } ], "title" : "Read the route restrictions" }, "type" : "investigation" } ], "id" : "case_02_ch2", "legacyBeatIDs" : [ "case_02_ch2.beat.0", "case_02_ch2.beat.1", "case_02_ch2.beat.2", "case_02_ch2.beat.3", "case_02_ch2.beat.4" ], "title" : "Uninvited" }, { "beatIDs" : [ "case_02_ch3.beat.0", "case_02_ch3.beat.1", "investigation.quiet-code", "case_02_ch3.beat.2", "case_02_ch3.beat.3", "case_02_ch3.beat.4" ], "beats" : [ { "body" : "Payments made in cash, same amount, always the 3rd of the month, deposited at a branch clear across town. Whoever's paying doesn't want it traced to this street.", "imageName" : null, "title" : "UTILITY RECORD (PARTIAL)", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "There's a maintenance panel on the meter box. A code's scratched into the paint next to it: 1 9 0 4. Check the visit log.", "type" : "message" }, { "investigation" : { "answers" : [ "MERCER" ], "app" : "cipherTool", "discovery" : "The protected occupant is Mercer, the operative whose name was erased from the freight paperwork.", "hints" : [ "The message was encoded by moving forward three letters.", "Set Cipher to −3 and enter PHUFHU.", "The decoded surname is MERCER." ], "id" : "quiet-code", "question" : "Decode PHUFHU with a Caesar shift of −3. Enter the decoded surname.", "sources" : [ { "app" : "comms", "body" : "H: Use the alias on the meter. PHUFHU.\nM: Same old shift?\nH: Three forward to hide it. Reverse it to read.", "id" : "quiet-code.source.0", "title" : "Support line • fragment" }, { "app" : "notes", "body" : "For decoding, move each letter three places back. A wraps to X. The Cipher app supports negative shifts.", "id" : "quiet-code.source.1", "title" : "Cipher desk note" } ], "title" : "A name behind the alias" }, "type" : "investigation" }, { "answer" : "1904", "prompt" : "Enter the four digits scratched into the meter box paint.", "type" : "cipher" }, { "sender" : "HANDLER", "text" : "Log shows monthly maintenance visits. Same technician every time. No company listed anywhere.", "type" : "message" }, { "investigation" : { "answers" : [ "73", "£73", "73 pounds" ], "app" : "calculator", "discovery" : "Someone continued paying £73 each month while the house was listed vacant.", "hints" : [ "Open both listed records and compare their details.", "Find the size of a single monthly payment. Divide the total by the number of payments.", "The answer is 73." ], "id" : "standing-order", "question" : "What is the monthly payment, in pounds?", "sources" : [ { "app" : "browser", "body" : "Six equal monthly cash payments total £438. No late fees, credits or partial payments.", "id" : "standing-order.source.0", "title" : "Utility account summary" }, { "app" : "notes", "body" : "Find the size of a single monthly payment. Divide the total by the number of payments.", "id" : "standing-order.source.1", "title" : "Account query" } ], "title" : "A payment that never stopped" }, "type" : "investigation" } ], "id" : "case_02_ch3", "legacyBeatIDs" : [ "case_02_ch3.beat.0", "case_02_ch3.beat.1", "case_02_ch3.beat.2", "case_02_ch3.beat.3", "case_02_ch3.beat.4" ], "title" : "What The Meter Knows" }, { "beatIDs" : [ "case_02_ch4.beat.0", "case_02_ch4.beat.1", "investigation.identity", "case_02_ch4.beat.2", "case_02_ch4.beat.3", "case_02_ch4.beat.4", "case_02_ch4.beat.5", "case_02_ch4.beat.6" ], "beats" : [ { "sender" : "HANDLER", "text" : "I need to tell you who's in that house.", "type" : "message" }, { "body" : "Partial match to a name that appears exactly once in your case files — on the storage locker paperwork from COLD OPEN. No other record of them exists that I can find.", "imageName" : null, "title" : "IDENTITY — UNCONFIRMED", "type" : "dossier" }, { "investigation" : { "answers" : [ "Dana Mercer", "Mercer" ], "app" : "contacts", "discovery" : "Dana Mercer is alive and sheltering in the house. The monthly visits were keeping them supplied.", "hints" : [ "The badge and the recovered card refer to the same person.", "Look up D. Mercer in the recovered personnel card.", "Enter Dana Mercer." ], "id" : "identity", "question" : "Which former operative is living in the house? Enter the full name or surname.", "sources" : [ { "app" : "contacts", "body" : "Dana Mercer — former field operative, freight-ledger investigation. Reported missing after the Dockside audit.", "id" : "identity.source.0", "title" : "Recovered personnel card" }, { "app" : "photos", "body" : "An old field badge is visible beside the window: D. MERCER. The photo was taken after the missing-person report.", "id" : "identity.source.1", "title" : "Window still • identifying detail" } ], "title" : "Identify the occupant" }, "type" : "investigation" }, { "sender" : "M.", "text" : "Now you know why I said stay out. That was the last person H sent there. It didn't end well for them either.", "type" : "message" }, { "sender" : "HANDLER", "text" : "M. doesn't know what they're talking about. Finish the job.", "type" : "message" }, { "investigation" : { "answers" : [ "bell", "r bell" ], "app" : "contacts", "discovery" : "Bell appears on both visits and handles the payment envelope.", "hints" : [ "Open both listed records and compare their details.", "Meter seal checked. Signed: R. Bell. Payment envelope collected by hand.", "The answer is bell." ], "id" : "repair-name", "question" : "Who signed both repair visits? Enter the surname.", "sources" : [ { "app" : "contacts", "body" : "Hallway switch replaced. Signed: R. Bell. Utility account holder absent.", "id" : "repair-name.source.0", "title" : "Service visit A" }, { "app" : "browser", "body" : "Meter seal checked. Signed: R. Bell. Payment envelope collected by hand.", "id" : "repair-name.source.1", "title" : "Service visit B" } ], "title" : "The recurring signature" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "Meters are the only witnesses that never lie. Find a utility cover or meter box on a public street and get it in frame. Don't open anything and don't touch anything.", "type" : "message" }, { "questTitle" : "Find a utility cover or meter box on a public street.", "type" : "fieldMission" } ], "id" : "case_02_ch4", "legacyBeatIDs" : [ "case_02_ch4.beat.0", "case_02_ch4.beat.1", "case_02_ch4.beat.2", "case_02_ch4.beat.3", "case_02_ch4.beat.4", "case_02_ch4.beat.5", "case_02_ch4.beat.6" ], "title" : "Face In The Window" }, { "beatIDs" : [ "case_02_ch5.beat.0", "case_02_ch5.beat.1", "choice.protect", "case_02_ch5.beat.2", "case_02_ch5.beat.3" ], "beats" : [ { "sender" : "HANDLER", "text" : "No visit, no message to the house, and no object left at a real address. This is an archived phone investigation. Read the departure window from the records already on this handset.", "type" : "message" }, { "questTitle" : "Find something that looks like it was left there on purpose, for you.", "type" : "fieldMission" }, { "choice" : { "id" : "protect", "options" : [ { "consequence" : "You protected Mercer’s address. M handled the departure privately.", "id" : "redact", "response" : "M: Address stripped. Mercer gets a quieter departure because you asked.", "text" : "Remove the address from the shared report." }, { "consequence" : "You demanded accountability. H signed the extraction authorization.", "id" : "account", "response" : "H: Put my name on it. I arranged the house and I’ll arrange the exit.", "text" : "Name H as the person responsible for their safety." } ], "prompt" : "You know Mercer’s location. What goes into the report?" }, "type" : "choice" }, { "body" : "The records support that Dana Mercer used the vacant house and left during a planned extraction window. They do not confirm who arranged the departure, whether it was completed safely, or where the freight ledger went. The original file remains open for record review.", "imageName" : null, "title" : "CASE STATUS — INTERIM", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "There is another archive envelope on this phone. It arrived after the first report was sealed. Check the receipt before you decide the house story is finished.", "type" : "message" } ], "id" : "case_02_ch5", "legacyBeatIDs" : [ "case_02_ch5.beat.0", "case_02_ch5.beat.1", "case_02_ch5.beat.2", "case_02_ch5.beat.3" ], "title" : "The Window" }, { "beatIDs" : [ "case_02_ch6.beat.0", "case_02_ch6.beat.1", "case_02_ch6.beat.2", "case_02_ch6.beat.3", "case_02_ch6.beat.4", "case_02_ch6.beat.5", "case_02_ch6.beat.6", "case_02_ch6.beat.7" ], "beats" : [ { "sender" : "M.", "text" : "I found a second copy of the utility packet. It was indexed under returns, not under the house. Same account, different handwriting in the margins.", "type" : "message" }, { "investigation" : { "answers" : [ "3", "03", "third" ], "app" : "calendarApp", "discovery" : "The utility account was funded on the third of each month, before the statement closed.", "hints" : [ "Compare the cash-entry dates with the statement close dates.", "The deposits occur on the same calendar day in all three months.", "The account was funded on the third day of each month." ], "id" : "payment-window", "question" : "On which day of each month was the utility account funded? Enter the day number.", "sources" : [ { "app" : "calendarApp", "body" : "Three cash deposits are logged on March 3, April 3 and May 3. The utility statements close on the 6th, 7th and 6th respectively.", "id" : "qh2.calendar-debits", "title" : "Recurring account entries" }, { "app" : "browser", "body" : "The vacant address used 11, 12 and 11 units. Each statement was paid in full before its due date; no late fee or service interruption appears.", "id" : "qh2.browser-statements", "title" : "Saved utility statements" }, { "app" : "notes", "body" : "‘Pay before the paper arrives. Keep the amount ordinary. Never use the same counter twice.’ The note has no author field.", "id" : "qh2.notes-margin", "title" : "Margin note · unsigned" } ], "title" : "The payment window" }, "type" : "investigation" }, { "body" : "Three deposits match the utility amount to the cent. Their dates are not monthly billing dates: each is the third day of the month, before the statement is issued. A note in the margin reads: ‘keep the meter ordinary; don't round the usage.’", "imageName" : null, "title" : "CASH DEPOSIT SLIP", "type" : "dossier" }, { "investigation" : { "answers" : [ "contractor", "contractor name", "company", "company name", "vendor" ], "app" : "mail", "discovery" : "The work orders omit the contractor identity even though the meter seals remain intact.", "hints" : [ "Read all three notices, not just the latest one.", "The time and seal fields are present; one identity field is consistently empty.", "The work orders never name a contractor or vendor." ], "id" : "work-order", "question" : "What identifying field is absent from every service work order?", "sources" : [ { "app" : "mail", "body" : "Each notice lists a two-hour window, a meter seal number and a handwritten ‘checked’ mark. The contractor field is blank on all three copies.", "id" : "qh2.mail-work-orders", "title" : "Service notices · March to May" }, { "app" : "contacts", "body" : "The account's vendor directory lists Northline Metering, Bellwether Service and Municipal Utilities. None has a work order matching the seal numbers in the notices.", "id" : "qh2.contacts-vendors", "title" : "Approved utility vendors" }, { "app" : "browser", "body" : "The meter seals were intact at each visit. The register records no replacement, damage report or emergency call.", "id" : "qh2.browser-seal", "title" : "Seal register · offline copy" } ], "title" : "The unlisted work order" }, "type" : "investigation" }, { "answer" : "0303", "prompt" : "The work-order index is assembled from the receipt month and the two digits of the maintenance day: month 03, day 03. Enter the four-digit archive key.", "type" : "cipher" }, { "investigation" : { "answers" : [ "c17", "c-17" ], "app" : "browser", "discovery" : "Two receipts and the local index tie the deposits to batch C-17 without identifying who made them.", "hints" : [ "Compare the batch field on both receipts.", "The code begins with C and ends with 17.", "The shared batch is C-17." ], "id" : "cash-batch", "question" : "Which batch code links the three utility deposits?", "sources" : [ { "app" : "browser", "body" : "Utility reference 48-19 · cash batch C-17 · accepted 08:42 · counter receipt printed.", "id" : "qh2.browser-batch-a", "title" : "Cash receipt · 03 March" }, { "app" : "browser", "body" : "Utility reference 48-19 · cash batch C-17 · accepted 08:39 · counter receipt printed.", "id" : "qh2.browser-batch-b", "title" : "Cash receipt · 03 April" }, { "app" : "notes", "body" : "C-17: deposits grouped for reconciliation. The batch number links records; it does not identify a customer or a person at the counter.", "id" : "qh2.notes-batch", "title" : "Batch index · local copy" } ], "title" : "The cash batch" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "The code opened a batch record, not an address. No route is attached. What matters is whether the same person prepared the deposits and signed the repairs.", "type" : "message" }, { "investigation" : { "answers" : [ "48-19", "4819" ], "app" : "notes", "discovery" : "Account 48-19 links the utility statement to the cash receipt, but neither copy identifies the payer.", "hints" : [ "Find the same reference in the note, statement and receipt.", "It has two groups separated by a hyphen.", "All three use account 48-19." ], "id" : "shared-account", "question" : "Which account reference appears in the statements and the cash receipts?", "sources" : [ { "app" : "notes", "body" : "Service account 48-19 is associated with the vacant-house meter. Its owner field is marked ‘estate file pending’, not a living account holder.", "id" : "qh2.notes-account-index", "title" : "Account cross-reference" }, { "app" : "browser", "body" : "Account 48-19 · amount 62.40 · paid 03 April · balance 0.00.", "id" : "qh2.browser-account-statement", "title" : "April statement" }, { "app" : "mail", "body" : "Account 48-19 · amount 62.40 · batch C-17. The payer name is not captured on this receipt.", "id" : "qh2.mail-account-receipt", "title" : "Cash receipt copy" } ], "title" : "One account, three records" }, "type" : "investigation" } ], "id" : "case_02_ch6", "legacyBeatIDs" : [ "case_02_ch6.beat.0", "case_02_ch6.beat.1", "case_02_ch6.beat.2", "case_02_ch6.beat.3", "case_02_ch6.beat.4", "case_02_ch6.beat.5", "case_02_ch6.beat.6", "case_02_ch6.beat.7" ], "title" : "The Return Receipt" }, { "beatIDs" : [ "case_02_ch7.beat.0", "case_02_ch7.beat.1", "case_02_ch7.beat.2", "case_02_ch7.beat.3", "case_02_ch7.beat.4", "case_02_ch7.beat.5", "case_02_ch7.beat.6", "case_02_ch7.beat.7", "case_02_ch7.beat.8" ], "beats" : [ { "sender" : "HANDLER", "text" : "The work orders use a service alias. Compare its permissions with the contact card and the mail archive; a name alone is not authorization.", "type" : "message" }, { "investigation" : { "answers" : [ "s porter", "porter", "s. porter" ], "app" : "contacts", "discovery" : "S. Porter is a recurring paperwork alias, not a verified identity.", "hints" : [ "Open the Contacts card and compare the work-order reply.", "The alias has an initial, then a surname.", "The card says S. Porter." ], "id" : "service-alias", "question" : "What is the exact alias written on the maintenance contact card?", "sources" : [ { "app" : "contacts", "body" : "S. Porter · meter access · no phone number · imported from a paper work order. Contact card has no portrait, company or mailing address.", "id" : "qh2.contacts-service", "title" : "Service contact · local only" }, { "app" : "mail", "body" : "‘Please retain S. Porter as the label in the packet. The name is not an employee record; it is the routing alias used on older maintenance copies.’ Sender details withheld.", "id" : "qh2.mail-alias-thread", "title" : "Work-order reply" }, { "app" : "notes", "body" : "The alias repeats across paperwork but has no independent identity record. Do not treat a contact label as proof that a specific person attended the house.", "id" : "qh2.notes-alias-limit", "title" : "Review note" } ], "title" : "A service alias is not a person" }, "type" : "investigation" }, { "body" : "The panel log records a short maintenance session on the evening the upstairs light was seen. The session opened the utility cabinet only. No door lock, camera, or home sensor is present in this archive.", "imageName" : null, "title" : "ACCESS WINDOW", "type" : "dossier" }, { "investigation" : { "answers" : [ "15", "fifteen" ], "app" : "calendarApp", "discovery" : "The service window was shifted fifteen minutes later, overlapping the recorded upstairs light.", "hints" : [ "Compare the original and revised start times.", "The start moved from 21:30 to 21:45.", "The window shifted by fifteen minutes." ], "id" : "calendar-shift", "question" : "By how many minutes was the maintenance window changed?", "sources" : [ { "app" : "calendarApp", "body" : "Scheduled 21:30–21:50. Saved from the local archive two days before the visit.", "id" : "qh2.calendar-window-original", "title" : "Meter check · original" }, { "app" : "calendarApp", "body" : "Changed to 21:45–22:05 at 20:11 on the day of the visit. The event owner remained the service account.", "id" : "qh2.calendar-window-edited", "title" : "Meter check · edit history" }, { "app" : "notes", "body" : "The upstairs light is recorded at 21:48 in the street observation sheet. A time overlap can narrow the review window, but it cannot show who was inside.", "id" : "qh2.notes-window-context", "title" : "Schedule note" } ], "title" : "A window moved by fifteen minutes" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "she acknowledged it", "dana acknowledged receipt", "seen", "she saw it", "read receipt" ], "app" : "messages", "discovery" : "The archive records a read receipt and a short acknowledgment, but cannot independently identify the handset user.", "hints" : [ "Read Dana's two-line response and the delivery record.", "The archive distinguishes ‘seen’ from a longer explanation.", "It establishes an acknowledgment and a read receipt, not who held the phone." ], "id" : "message-gap", "question" : "What does the message archive establish about Dana's reply?", "sources" : [ { "app" : "messages", "body" : "21:12 HANDLER: ‘Window moved. Confirm you saw this.’ 21:14 DANA: ‘Seen. No reply until the packet is here.’ 22:09 HANDLER: ‘Copy.’", "id" : "qh2.messages-thread", "title" : "HANDLER ↔ DANA · archived" }, { "app" : "phone", "body" : "The 21:12 message was delivered to the archived handset. Read receipt: 21:13. No outgoing call is listed in the same interval.", "id" : "qh2.phone-delivery", "title" : "Delivery record" }, { "app" : "notes", "body" : "This export preserves stored messages and delivery metadata. It cannot prove who read the screen or who typed a reply.", "id" : "qh2.notes-message-policy", "title" : "Archive limitation" } ], "title" : "The missing reply" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the note says she planned to leave when the light went out", "she planned to leave when the light went out", "the note describes a plan" ], "app" : "notes", "discovery" : "Dana's note records an intention to leave after the light went out; it does not verify that she did.", "hints" : [ "Separate the wording of the note from the later observation sheet.", "One is a stated plan; neither source identifies an observer.", "The phone preserves Dana's plan, not proof that she completed it." ], "id" : "witness-note", "question" : "Which fact is directly supported by Dana's saved note?", "sources" : [ { "app" : "notes", "body" : "‘Window moved. I will leave when the light goes out. No one needs the address in a message.’ Saved 22:02; last edited 22:04.", "id" : "qh2.notes-dana", "title" : "Pocket note · unsent" }, { "app" : "calendarApp", "body" : "The upstairs light was marked on at 21:48 and off at 22:16. The sheet identifies no observer and has no location stamp.", "id" : "qh2.calendar-lights", "title" : "Observation sheet" }, { "app" : "browser", "body" : "A saved note establishes that text existed on the device. It does not prove the author followed it or that an event happened as described.", "id" : "qh2.browser-caveat", "title" : "Evidence standard · excerpt" } ], "title" : "What the note can prove" }, "type" : "investigation" }, { "sender" : "M.", "text" : "The note is from Dana, not from the technician. It reads like somebody making sure a person could leave without naming the person who helped.", "type" : "message" }, { "sender" : "HANDLER", "text" : "Dana's note came through a door that someone left open. Find a door that isn't: one with a keyhole or a keypad. I want to know what it asks for.", "type" : "message" }, { "questTitle" : "Find a door with a keyhole or a keypad.", "type" : "fieldMission" } ], "id" : "case_02_ch7", "legacyBeatIDs" : [ "case_02_ch7.beat.0", "case_02_ch7.beat.1", "case_02_ch7.beat.2", "case_02_ch7.beat.3", "case_02_ch7.beat.4", "case_02_ch7.beat.5", "case_02_ch7.beat.6", "case_02_ch7.beat.7", "case_02_ch7.beat.8" ], "title" : "A Door Held Open" }, { "beatIDs" : [ "case_02_ch8.beat.0", "case_02_ch8.beat.1", "case_02_ch8.beat.2", "case_02_ch8.beat.3", "case_02_ch8.beat.4", "case_02_ch8.beat.5", "case_02_ch8.beat.6", "case_02_ch8.beat.7", "case_02_ch8.beat.8" ], "beats" : [ { "body" : "The handset contains a read-only index of archived records. Its numbered links are filing order, not streets or directions. Nothing here is a real-world route to follow.", "imageName" : null, "title" : "OFFLINE INDEX", "type" : "dossier" }, { "investigation" : { "answers" : [ "dispatch copy", "dispatch" ], "app" : "browser", "discovery" : "The file's next record is the dispatch copy; the index encodes filing order, not geography.", "hints" : [ "Follow the arrows in the offline packet index.", "The service receipt is followed by the second entry.", "The next record is the dispatch copy." ], "id" : "offline-route", "question" : "In the filing key, which record follows the service receipt?", "sources" : [ { "app" : "browser", "body" : "Filing order: service receipt → dispatch copy → pocket note → call record → mirror checksum. The arrows show document order only.", "id" : "qh2.browser-index", "title" : "Offline packet index" }, { "app" : "mail", "body" : "The maintenance receipt is the first item in the packet. No street, station, vehicle or destination appears on the page.", "id" : "qh2.mail-service-receipt", "title" : "Service receipt · archived" }, { "app" : "notes", "body" : "Do not convert filing order into a physical route. This is a local document index, not a map of real places.", "id" : "qh2.notes-route-caution", "title" : "Handler annotation" } ], "title" : "The index is not a route" }, "type" : "investigation" }, { "correctOrder" : [ 2, 4, 1, 3, 0 ], "imageName" : "RouteMap", "points" : [ { "x" : 0.19, "y" : 0.23999999999999999 }, { "x" : 0.48999999999999999, "y" : 0.17000000000000001 }, { "x" : 0.78000000000000003, "y" : 0.34999999999999998 }, { "x" : 0.70999999999999996, "y" : 0.68000000000000005 }, { "x" : 0.28000000000000003, "y" : 0.81000000000000005 } ], "type" : "mapRoute" }, { "investigation" : { "answers" : [ "42", "forty two", "forty-two" ], "app" : "phone", "discovery" : "The handset recorded a 42-second call six minutes after the service window ended.", "hints" : [ "Read the duration in the Recent Calls record.", "00:42 is forty-two seconds.", "The archived call lasted 42 seconds." ], "id" : "call-window", "question" : "How long did the archived dispatch call last? Enter the number of seconds.", "sources" : [ { "app" : "phone", "body" : "22:11 · outgoing · relay desk extension · connected 00:42. The extension is an archived label, not a live number.", "id" : "qh2.phone-dispatch", "title" : "Recent calls · local export" }, { "app" : "calendarApp", "body" : "Service window ended at 22:05. The archived call began six minutes later, at 22:11.", "id" : "qh2.calendar-call-window", "title" : "Dispatch window" }, { "app" : "contacts", "body" : "A system label used by the phone export. No personal contact data is present; callbacks are disabled in this archive.", "id" : "qh2.contacts-relay", "title" : "Relay desk · restricted" } ], "title" : "The brief call" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "checksum", "checksum suffix", "4d2" ], "app" : "mail", "discovery" : "The dispatch copies share checksum suffix 4D2; later integrity review must still validate the full record.", "hints" : [ "Compare the two dispatch entries line by line.", "The packet label and preparation time match too, but focus on the verification field.", "Both copies have checksum suffix 4D2." ], "id" : "dispatch-copy", "question" : "Which field is identical in the two archived dispatch copies?", "sources" : [ { "app" : "mail", "body" : "Packet 7A · prepared 22:08 · checksum suffix 4D2 · recipient redacted.", "id" : "qh2.mail-dispatch-original", "title" : "Dispatch · original" }, { "app" : "mail", "body" : "Packet 7A · prepared 22:08 · checksum suffix 4D2 · recipient withheld in mirror export.", "id" : "qh2.mail-dispatch-mirror", "title" : "Dispatch · mirror" }, { "app" : "notes", "body" : "Matching labels and timestamps do not prove the copy is complete. A checksum is the part intended to reveal a byte-level difference.", "id" : "qh2.notes-copy-rule", "title" : "Copy review standard" } ], "title" : "Two dispatch copies" }, "type" : "investigation" }, { "body" : "The records can show when an archived dispatch was prepared and when the house account changed. They cannot identify who held the phone or where Dana went afterward.", "imageName" : null, "title" : "TIMELINE — NOT A LOCATION", "type" : "dossier" }, { "investigation" : { "answers" : [ "pocket note", "the pocket note", "note" ], "app" : "calendarApp", "discovery" : "The pocket note reached the handset six minutes before the mirror copy; creation order is unknown.", "hints" : [ "Compare the two arrival times in the local log.", "22:18 comes before 22:24.", "The pocket note arrived first on the handset." ], "id" : "arrival-window", "question" : "Which record arrived first on the handset: the pocket note or the mirror copy?", "sources" : [ { "app" : "calendarApp", "body" : "Pocket note imported 22:18. Mirror dispatch imported 22:24. The log records files arriving on this handset, not people arriving at a place.", "id" : "qh2.calendar-arrivals", "title" : "Archive arrival log" }, { "app" : "notes", "body" : "The note was saved before the mirror copy. A six-minute gap is not evidence that the files were created in that order.", "id" : "qh2.notes-arrival-note", "title" : "Import annotation" }, { "app" : "mail", "body" : "Received locally at 22:24. Original creation time unavailable; import timestamp is preserved.", "id" : "qh2.mail-import-header", "title" : "Mirror import header" } ], "title" : "What arrived when?" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "This file is about the hours nobody watches. Wait for the light to change, then find a light that's still on after dark. Somebody keeps that habit.", "type" : "message" }, { "questTitle" : "Find a light that is still on after dark.", "type" : "fieldMission" } ], "id" : "case_02_ch8", "legacyBeatIDs" : [ "case_02_ch8.beat.0", "case_02_ch8.beat.1", "case_02_ch8.beat.2", "case_02_ch8.beat.3", "case_02_ch8.beat.4", "case_02_ch8.beat.5", "case_02_ch8.beat.6", "case_02_ch8.beat.7", "case_02_ch8.beat.8" ], "title" : "The Hour Between" }, { "beatIDs" : [ "case_02_ch9.beat.0", "case_02_ch9.beat.1", "case_02_ch9.beat.2", "case_02_ch9.beat.3", "case_02_ch9.beat.4", "case_02_ch9.beat.5", "case_02_ch9.beat.6" ], "beats" : [ { "sender" : "HANDLER", "text" : "The return packet has two copies of the same record. Don't trust the heading. Compare the original, the mirror, and the note that says who made it.", "type" : "message" }, { "investigation" : { "answers" : [ "the files match", "the copies match", "matching copies", "same checksum" ], "app" : "browser", "discovery" : "The original and mirror files have the same checksum, confirming they match but not that either is truthful.", "hints" : [ "Compare all groups in the two hashes.", "Every group appears in the same order.", "The files match each other; that says nothing about whether their claims are true." ], "id" : "mirror-integrity", "question" : "What does the full checksum comparison establish?", "sources" : [ { "app" : "browser", "body" : "84A9-117C-03F2-4D2B-6E11-9C40-AB72-51D0.", "id" : "qh2.browser-original-hash", "title" : "Original packet · SHA-256" }, { "app" : "browser", "body" : "84A9-117C-03F2-4D2B-6E11-9C40-AB72-51D0.", "id" : "qh2.browser-mirror-hash", "title" : "Mirror packet · SHA-256" }, { "app" : "notes", "body" : "Equal checksums support that these two files match. They do not prove either copy is truthful or identify its author.", "id" : "qh2.notes-hash-limit", "title" : "Integrity note" } ], "title" : "A mirror that holds" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "recipient", "recipient field", "contact", "recipient identity" ], "app" : "mail", "discovery" : "The recipient field was intentionally withheld; the archive does not support recovering the person's identity.", "hints" : [ "Check the field comparison and the redaction log.", "Three technical fields remain visible; one person-related field does not.", "The recipient identity was withheld." ], "id" : "recipient-mask", "question" : "Which personal field was deliberately removed from both dispatch copies?", "sources" : [ { "app" : "mail", "body" : "Packet number, preparation time and checksum are preserved. Recipient field appears as [WITHHELD] in both copies.", "id" : "qh2.mail-dispatch-fields", "title" : "Dispatch field comparison" }, { "app" : "contacts", "body" : "The archive review may confirm file integrity without restoring a withheld contact identity. No contact lookup is available from this offline copy.", "id" : "qh2.contacts-privacy", "title" : "Privacy handling note" }, { "app" : "notes", "body" : "The recipient was removed before the phone archive was created. The log does not name the person who applied the redaction.", "id" : "qh2.notes-redaction", "title" : "Redaction log" } ], "title" : "The recipient stays masked" }, "type" : "investigation" }, { "answer" : "0303", "prompt" : "The redacted recipient stays private. The checksum key is built from the two confirmed month digits, then the two confirmed day digits: 03 and 03.", "type" : "cipher" }, { "investigation" : { "answers" : [ "the same alias appears on both", "same alias", "paperwork link", "it links the paperwork" ], "app" : "contacts", "discovery" : "The same service alias appears on the contact card and sign-off, linking records without proving who wrote them.", "hints" : [ "Compare the alias card with the sign-off field.", "The same label appears twice, but neither item identifies a person.", "S. Porter is a paperwork link, not a verified identity." ], "id" : "repair-signature", "question" : "What is the strongest supported link between S. Porter and the work orders?", "sources" : [ { "app" : "contacts", "body" : "No phone, employer or address. The card was imported with the returned work-order packet.", "id" : "qh2.contacts-porter-card", "title" : "S. Porter · alias card" }, { "app" : "mail", "body" : "The sign-off field contains ‘S. Porter’. It is written in the same hand as the alias card's margin label, according to the archive note.", "id" : "qh2.mail-porter-signature", "title" : "Repair copy · sign-off" }, { "app" : "browser", "body" : "A matching handwritten label links paperwork. Without a verified sample or independent witness, it does not establish a legal identity.", "id" : "qh2.browser-signature-limit", "title" : "Forensic annotation" } ], "title" : "A signature without a name" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "receipt confirmation", "confirmed receipt", "whether dispatch was received", "cleared house and received dispatch", "the arrival was confirmed" ], "app" : "messages", "discovery" : "H's revision withdraws the claim that the house was cleared and the dispatch received.", "hints" : [ "Compare the certainty of the two versions.", "The revision removes a claim that a person left safely and that a packet arrived.", "H changed confirmed receipt into an unconfirmed preparation." ], "id" : "handler-edit", "question" : "What changed in the Handler's later account of the departure?", "sources" : [ { "app" : "messages", "body" : "‘The house was cleared at 22:16. Dispatch confirmed the packet was received.’ Saved in the first report.", "id" : "qh2.messages-handler-original", "title" : "HANDLER · first account" }, { "app" : "messages", "body" : "‘The light went out at 22:16. Dispatch was prepared; receipt not confirmed.’ Revision saved at 23:03.", "id" : "qh2.messages-handler-revision", "title" : "HANDLER · revised account" }, { "app" : "notes", "body" : "The first version claims the house was cleared and dispatch received. The revision describes only a light going out and a packet being prepared.", "id" : "qh2.notes-handler-diff", "title" : "Revision difference" } ], "title" : "The Handler's edit" }, "type" : "investigation" }, { "choice" : { "id" : "quiet-house-record", "options" : [ { "consequence" : "You retained the independently checked timeline and kept the private name out of the shared report.", "id" : "quiet-redacted", "response" : "M.: That's enough to test the account without turning the file into a list of people to find.", "text" : "Keep the identity redacted and attach the verified timestamps." }, { "consequence" : "You kept both source copies local and shared a checksum rather than personal details.", "id" : "quiet-local", "response" : "HANDLER: Understood. The source stays here; the checksum lets the next reviewer confirm it wasn't changed.", "text" : "Keep both copies on this phone and share only their checksum." } ], "prompt" : "The mirror copy is intact, but a private name is unnecessary to establish the timeline. What do you preserve?" }, "type" : "choice" } ], "id" : "case_02_ch9", "legacyBeatIDs" : [ "case_02_ch9.beat.0", "case_02_ch9.beat.1", "case_02_ch9.beat.2", "case_02_ch9.beat.3", "case_02_ch9.beat.4", "case_02_ch9.beat.5", "case_02_ch9.beat.6" ], "title" : "Two Versions" }, { "beatIDs" : [ "case_02_ch10.beat.0", "case_02_ch10.beat.1", "case_02_ch10.beat.2", "case_02_ch10.beat.3", "case_02_ch10.beat.4", "case_02_ch10.beat.5" ], "beats" : [ { "sender" : "M.", "text" : "The two copies agree on the hour. They still disagree on who authorized the envelope. Your report should say exactly that.", "type" : "message" }, { "investigation" : { "answers" : [ "none", "no item", "none of them", "nothing" ], "app" : "phone", "discovery" : "No item in this phone archive independently confirms Dana's safe arrival.", "hints" : [ "Read all three sources and look for a person or destination acknowledged at the other end.", "A call and a prepared packet are not the same as a received packet.", "None of these records independently confirms a safe arrival." ], "id" : "departure-confirmation", "question" : "Which item independently confirms a safe arrival?", "sources" : [ { "app" : "phone", "body" : "A 42-second call to an archived relay-desk extension. No destination, recipient or result is recorded.", "id" : "qh2.phone-call-end", "title" : "Call log · 22:11" }, { "app" : "mail", "body" : "Prepared at 22:08. The receipt field is blank in both the original and mirror copies.", "id" : "qh2.mail-dispatch-no-receipt", "title" : "Dispatch packet" }, { "app" : "calendarApp", "body" : "No arrival event was imported. The archive has no travel booking or check-in receipt for Dana.", "id" : "qh2.calendar-no-arrival", "title" : "Arrival calendar" } ], "title" : "The limit of the departure record" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the handset received the note at 22:18 and dispatch at 22:24", "the local import times", "the phone received the records at 22:18 and 22:24" ], "app" : "vitals", "discovery" : "The handset's import times are verified; a safe arrival remains an unconfirmed inference.", "hints" : [ "Use only a timestamp directly shown in the local records.", "The safe-arrival claim has no receipt.", "The verified fact is the two local import times, not Dana's destination." ], "id" : "report-boundary", "question" : "Which statement belongs in the verified-facts section?", "sources" : [ { "app" : "vitals", "body" : "The handset received a pocket note at 22:18 and a mirror dispatch at 22:24. Those are local import times.", "id" : "qh2.vitals-fact", "title" : "Device activity" }, { "app" : "notes", "body" : "‘Dana reached the extraction point safely.’ No destination receipt or independent acknowledgment is attached.", "id" : "qh2.vitals-inference", "title" : "Draft conclusion" }, { "app" : "browser", "body" : "A device log can establish that a record was stored and when. It cannot establish an unrecorded event or identify the person who held the device.", "id" : "qh2.vitals-method", "title" : "Review standard" } ], "title" : "Separate fact from inference" }, "type" : "investigation" }, { "choice" : { "id" : "quiet-house-conclusion", "options" : [ { "consequence" : "You recorded a supported safe-house lead and left the unverified destination open.", "id" : "safehouse-lead", "response" : "M.: That is what the records support. I'll compare the departure receipt with the next archive, without exposing the address.", "text" : "The house was a temporary safe place; the extraction remains unconfirmed." }, { "consequence" : "You kept the conclusion limited to verified handset and utility records.", "id" : "records-only", "response" : "HANDLER: Careful. A device record is evidence of a record, not proof of who was holding it.", "text" : "The utility account and departure window are verified; the occupant is not." } ], "prompt" : "What can this phone-only review conclude?" }, "type" : "choice" }, { "body" : "The second review confirmed that the vacant-house account, service visits, and archived departure window belong to one coordinated file. The phone supports Dana Mercer's use of the house, but it does not prove who authorized the extraction or where Dana went. Your disclosure choice and those limits are preserved in the case report.", "imageName" : null, "title" : "CASE CLOSED — QUIET HOUSE", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "A transfer receipt points to a station archive. It's the next file, not an instruction to travel. Last Train is sealed until this report is filed.", "type" : "message" } ], "id" : "case_02_ch10", "legacyBeatIDs" : [ "case_02_ch10.beat.0", "case_02_ch10.beat.1", "case_02_ch10.beat.2", "case_02_ch10.beat.3", "case_02_ch10.beat.4", "case_02_ch10.beat.5" ], "title" : "Quiet House, Reopened" }, { "beatIDs" : [ "case_02_ch11.beat.0", "case_02_ch11.beat.1", "case_02_ch11.beat.2", "case_02_ch11.beat.3", "case_02_ch11.beat.4", "case_02_ch11.beat.5", "case_02_ch11.beat.6" ], "beats" : [ { "sender" : "M.", "text" : "A small addendum came back with the redacted report. No new address, no name to chase—just a correction to the order the copies were saved.", "type" : "message" }, { "investigation" : { "answers" : [ "which file reached the handset first", "the pocket note arrived first", "import order only", "arrival order on the handset" ], "app" : "mail", "discovery" : "The pocket note reached this handset first; its source creation time remains unknown.", "hints" : [ "The log is about files arriving on this device.", "It does not contain source creation timestamps.", "It establishes import order only: the pocket note arrived first." ], "id" : "local-order", "question" : "What does the handset's arrival order establish?", "sources" : [ { "app" : "mail", "body" : "Pocket note · received 22:18. Mirror dispatch · received 22:24. Original creation timestamps were not retained in the export.", "id" : "qh2.mail-arrival-order", "title" : "Import queue" }, { "app" : "calendarApp", "body" : "The import service sorts items by arrival on this device. It does not preserve the order in which source files were written.", "id" : "qh2.calendar-queue-note", "title" : "Queue note" } ], "title" : "Import order and creation order" }, "type" : "investigation" }, { "body" : "The device import log records file receipt, not the moment the original documents were created. Keep those timelines separate in the final note.", "imageName" : null, "title" : "ARCHIVE ADDENDUM", "type" : "dossier" }, { "investigation" : { "answers" : [ "that the dispatch was received", "safe arrival", "that the occupant was safely cleared", "confirmed receipt" ], "app" : "messages", "discovery" : "The corrected receipt withdraws the earlier claim of confirmed dispatch receipt and safe clearance.", "hints" : [ "Compare the first summary with the correction.", "The correction says prepared, not received.", "The correction withdrew the claim of confirmed receipt and safe clearance." ], "id" : "receipt-revision", "question" : "Which claim did the corrected receipt withdraw?", "sources" : [ { "app" : "messages", "body" : "‘Dispatch received at 22:16; occupant safely cleared.’ Saved before the mirror packet was imported.", "id" : "qh2.messages-receipt-first", "title" : "Draft summary · first" }, { "app" : "messages", "body" : "‘22:16 is the light-out observation. Dispatch was prepared at 22:08; receipt not confirmed.’ Author field is withheld.", "id" : "qh2.messages-receipt-corrected", "title" : "Correction · 23:03" }, { "app" : "notes", "body" : "The corrected copy distinguishes an observation from a confirmed handoff. It does not supply a destination or identify an author.", "id" : "qh2.notes-receipt-review", "title" : "Correction note" } ], "title" : "The receipt correction" }, "type" : "investigation" }, { "choice" : { "id" : "quiet-house-archive", "options" : [ { "consequence" : "You preserved the first report and attached a dated correction.", "id" : "append-note", "response" : "M.: Good. The first report stays intact, and anyone reading it can see what changed.", "text" : "Append a dated correction to the existing report." }, { "consequence" : "You replaced the working copy while retaining the original in the local change history.", "id" : "replace-copy", "response" : "HANDLER: The replacement is clean, but the change history remains on this handset.", "text" : "Replace the local copy with the corrected version." } ], "prompt" : "How should the archive preserve this correction?" }, "type" : "choice" }, { "body" : "The return receipt changes the order of imported files, not the verified departure window. The original conclusion remains bounded by the same evidence.", "imageName" : null, "title" : "ADDENDUM FILED", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "That closes the house file. The archive is stable, and Dana's destination remains private. No further tasking is attached.", "type" : "message" } ], "id" : "case_02_ch11", "legacyBeatIDs" : [ "case_02_ch11.beat.0", "case_02_ch11.beat.1", "case_02_ch11.beat.2", "case_02_ch11.beat.3", "case_02_ch11.beat.4", "case_02_ch11.beat.5", "case_02_ch11.beat.6" ], "title" : "The Copy That Stayed" }, { "beatIDs" : [ "case_02_ch12.beat.0", "case_02_ch12.beat.1", "case_02_ch12.beat.2", "case_02_ch12.beat.3", "case_02_ch12.beat.4", "case_02_ch12.beat.5", "case_02_ch12.beat.6", "case_02_ch12.beat.7", "case_02_ch12.beat.8", "case_02_ch12.beat.9" ], "beats" : [ { "sender" : "M.", "text" : "The return receipt led to a second utility export. It has the same account number, but the two copies were assembled months apart. Keep the original report sealed while we compare them.", "type" : "message" }, { "body" : "This is a read-only review of the vacant property's meter records. The account belongs to a deceased owner. No live meter, address lookup, or utility contact is available from this handset. Compare the retained copies; do not turn an anomaly into a visit.", "imageName" : null, "title" : "SUPPLEMENT 02-A · CONTROL COPY", "type" : "dossier" }, { "investigation" : { "answers" : [ "08114", "8114", "the previous reading" ], "app" : "browser", "discovery" : "The April value was copied forward from the prior reading; it is not evidence of zero use.", "hints" : [ "Compare the statement with the maintenance slip.", "No new reading is recorded, so the export retained the old value.", "The April statement carried forward 08114." ], "id" : "qh3-meter-reset", "question" : "Which meter value was carried forward after the April reset?", "sources" : [ { "app" : "browser", "body" : "Previous reading: 08114. Current reading: 08114. The period is billed as a normal month, with no estimate marker and no service interruption.", "id" : "qh3.reset.statement", "title" : "April statement · account 48-19" }, { "app" : "mail", "body" : "Seal M-774 was checked on 3 April. The technician's reading field is blank; the box marked 'no access required' is ticked.", "id" : "qh3.reset.technician", "title" : "Maintenance slip · copy B" }, { "app" : "notes", "body" : "The export script copied the prior value when a current reading was missing. It did not label the value as estimated in the customer-facing statement.", "id" : "qh3.reset.margin", "title" : "Reconciliation margin" } ], "title" : "A reset without a reading" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the april check is unsigned", "the april entry is unsigned", "the source changed", "the april note lacks a signature" ], "app" : "notes", "discovery" : "The April seal check exists only as an unsigned pocket copy; the official register does not confirm it.", "hints" : [ "Separate the official register from the pocket copy.", "The only April entry is unsigned and not in the register.", "The April check has no signature, so attendance is unverified." ], "id" : "qh3-seal-chain", "question" : "What changed between the two seal records?", "sources" : [ { "app" : "browser", "body" : "Seal M-774 was installed on 12 February and recorded intact on 3 March. The register's next signed entry is dated 3 May.", "id" : "qh3.seal.register", "title" : "Meter seal register" }, { "app" : "mail", "body" : "A handwritten copy lists seal M-774 and 'visual check only'. It has no technician signature or company identifier.", "id" : "qh3.seal.workorder", "title" : "Work order · 3 April" }, { "app" : "notes", "body" : "The April note was imported from a pocket copy, not the utility's signed register. It cannot establish that a worker attended or that the meter was opened.", "id" : "qh3.seal.audit", "title" : "Audit comparison" } ], "title" : "The seal with two histories" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "3", "three", "three days" ], "app" : "calendarApp", "discovery" : "The service window moved three calendar days earlier; the anonymous automated notice does not identify who requested it.", "hints" : [ "Compare 9 May with 6 May.", "Count calendar days, not the hours in the two windows.", "The new window was three days earlier." ], "id" : "qh3-reading-window", "question" : "How many days earlier was the second reading window scheduled?", "sources" : [ { "app" : "calendarApp", "body" : "The archived appointment was set for 9 May, 10:00–12:00. This copy was synchronized at 18:12 the previous evening.", "id" : "qh3.window.old", "title" : "Original service window" }, { "app" : "messages", "body" : "At 18:19, an automated notice moved the window to 6 May, 10:00–12:00. It contains no name or reply address.", "id" : "qh3.window.new", "title" : "Account notification" }, { "app" : "notes", "body" : "Three calendar days separate the original and revised dates. The phone received the change after both entries had already been written to the local archive.", "id" : "qh3.window.note", "title" : "Scheduling note" } ], "title" : "A reading window moved" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "That unsigned copy could be careless paperwork or an attempt to make an ordinary account look occupied. We need a second source before we call it either.", "type" : "message" }, { "investigation" : { "answers" : [ "42.60", "42.6", "4260", "£42.60" ], "app" : "mail", "discovery" : "Three cash slips carry the same £42.60 amount, but the repeated amount cannot identify the payer.", "hints" : [ "Read the amount, not the batch code.", "All three dates show the same pounds and pence.", "Each slip records £42.60." ], "id" : "qh3-ledger-amount", "question" : "What monthly amount appears on all three cash slips? Enter the amount in pounds.", "sources" : [ { "app" : "mail", "body" : "Account 48-19 · £42.60 · cash received 08:42 · batch C-17. No payer name was collected on this copy.", "id" : "qh3.cash.march", "title" : "Counter slip · March" }, { "app" : "browser", "body" : "The April slip is £42.60 and references batch C-17. Its cashier timestamp is 08:39, three minutes earlier than March.", "id" : "qh3.cash.april", "title" : "Account summary · April" }, { "app" : "notes", "body" : "The May slip also lists £42.60. The amount matches the standing charge and the same narrow band of ordinary usage.", "id" : "qh3.cash.may", "title" : "Reconciliation sheet · May" } ], "title" : "The amount that stayed ordinary" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "staff number", "employer-issued staff number", "signed company record", "verified employer record" ], "app" : "contacts", "discovery" : "The phone cannot authenticate S. Porter as a real contractor; it has no verified employer identifier.", "hints" : [ "The alias itself repeats, but the card has no independent identifiers.", "Look for the field the identity standard calls out.", "A verified employer-issued staff number or signed company record is missing." ], "id" : "qh3-payer-limit", "question" : "Which identity field would be needed to link S. Porter to a real contractor?", "sources" : [ { "app" : "contacts", "body" : "The card has a first initial and surname only. Phone, employer, address, and staff number are blank.", "id" : "qh3.payer.card", "title" : "S. Porter · service alias" }, { "app" : "browser", "body" : "Northline Metering, Bellwether Service, and Municipal Utilities are approved for this account. None of their staff rosters includes a match for the alias.", "id" : "qh3.payer.vendor", "title" : "Approved contractor list" }, { "app" : "notes", "body" : "An alias on a local work copy is not an identity match. A verified employer-issued staff number or signed company record would be needed.", "id" : "qh3.payer.standard", "title" : "Identity standard" } ], "title" : "A contact card without a person" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "temporary protected holding", "protected holding", "temporary safeguarding" ], "app" : "browser", "discovery" : "The internal schedule uses a temporary protected-holding classification while public billing remains marked vacant.", "hints" : [ "Read the internal schedule, not the public billing label.", "The record separates the cost category from the sealed resident file.", "The schedule classifies it as a temporary protected holding." ], "id" : "qh3-vacancy-label", "question" : "How was the property classified in the safeguarding schedule?", "sources" : [ { "app" : "browser", "body" : "Account 48-19 is listed as 'temporary protected holding'. The address and resident name are stored in a separate sealed record.", "id" : "qh3.vacancy.schedule", "title" : "Property schedule" }, { "app" : "notes", "body" : "The monthly charge is coded as a temporary property cost, not a standard vacant-property tariff.", "id" : "qh3.vacancy.ledger", "title" : "Cost ledger" }, { "app" : "mail", "body" : "A protected holding remains coded as vacant in public billing records to prevent exposure of a resident's presence.", "id" : "qh3.vacancy.policy", "title" : "Safeguarding policy" } ], "title" : "The account classification" }, "type" : "investigation" }, { "choice" : { "id" : "qh3-audit-scope", "options" : [ { "consequence" : "You reported the unsigned copy and marked attendance unverified.", "id" : "qh3-report-uncertain", "response" : "M.: That keeps the gap visible without inventing a visitor.", "text" : "Report the unsigned check and mark attendance unverified." }, { "consequence" : "You documented the carry-forward rule and preserved both source copies.", "id" : "qh3-report-estimate", "response" : "HANDLER: Reasonable. Record the carry-forward rule and keep the source copies.", "text" : "Treat the unchanged reading as an export estimate." } ], "prompt" : "The meter copies conflict. What belongs in the interim audit?" }, "type" : "choice" } ], "id" : "case_02_ch12", "legacyBeatIDs" : [ "case_02_ch12.beat.0", "case_02_ch12.beat.1", "case_02_ch12.beat.2", "case_02_ch12.beat.3", "case_02_ch12.beat.4", "case_02_ch12.beat.5", "case_02_ch12.beat.6", "case_02_ch12.beat.7", "case_02_ch12.beat.8", "case_02_ch12.beat.9" ], "title" : "The Meter's Other Copy" }, { "beatIDs" : [ "case_02_ch13.beat.0", "case_02_ch13.beat.1", "case_02_ch13.beat.2", "case_02_ch13.beat.3", "case_02_ch13.beat.4", "case_02_ch13.beat.5", "case_02_ch13.beat.6", "case_02_ch13.beat.7", "case_02_ch13.beat.8", "case_02_ch13.beat.9" ], "beats" : [ { "sender" : "M.", "text" : "The meter cannot tell us who stayed there. The archive has a room-by-room inspection, a power summary, and a set of ordinary delivery notes. See whether they agree before you write a story around the house.", "type" : "message" }, { "body" : "These records were copied from an old property-management archive. They are not a current address record. No exterior inspection or contact with a resident is part of this case.", "imageName" : null, "title" : "SUPPLEMENT 02-B · OCCUPANCY REVIEW", "type" : "dossier" }, { "investigation" : { "answers" : [ "6", "six", "6 hours" ], "app" : "vitals", "discovery" : "A six-hour overnight load repeats, but the power record cannot identify an occupant or an appliance.", "hints" : [ "Subtract 23:10 from 05:10 across midnight.", "The interval crosses midnight, but its length is six hours.", "The repeated load lasted six hours." ], "id" : "qh3-power-profile", "question" : "What was the longest repeated overnight load in the power summary? Enter hours.", "sources" : [ { "app" : "vitals", "body" : "Every recorded interval runs 23:10–05:10 at a low, steady draw. Daytime spikes are absent. The archive records duration and total draw, not which appliance caused it.", "id" : "qh3.power.summary", "title" : "Load summary · six nights" }, { "app" : "notes", "body" : "A steady low draw can come from a refrigerator, router, or several devices in standby. The summary cannot distinguish those causes.", "id" : "qh3.power.note", "title" : "Technician's interpretation" }, { "app" : "browser", "body" : "The estimated monthly usage is within the range of a vacant property with basic equipment left connected.", "id" : "qh3.power.bill", "title" : "Estimated usage table" } ], "title" : "A flat load overnight" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "held at the depot", "held at local depot", "return label created", "not delivered" ], "app" : "mail", "discovery" : "The carrier record never confirms delivery; the later rear-gate note is not proof anyone received the parcel.", "hints" : [ "Find the last carrier event, not the account's preferred instruction.", "No signature or door scan appears.", "The parcel was never confirmed delivered; it remained held and then received a return label." ], "id" : "qh3-delivery-scan", "question" : "Which status did the parcel keep in the carrier record?", "sources" : [ { "app" : "mail", "body" : "The first scan says 'held at local depot'. A later generated email was sent to the account address, but the delivery field is blank.", "id" : "qh3.delivery.notice", "title" : "Delivery notice · SP-88213" }, { "app" : "browser", "body" : "The last carrier event is 'return label created'. There is no door scan, signature, or neighbor handoff.", "id" : "qh3.delivery.cache", "title" : "Offline tracking cache" }, { "app" : "calendarApp", "body" : "A copied calendar entry says 'leave by rear gate'. Its creation date is after the parcel was already held at the depot.", "id" : "qh3.delivery.calendar", "title" : "Property note · delivery window" } ], "title" : "A parcel never delivered" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "21:14:08", "21:14", "211408" ], "app" : "photos", "discovery" : "One archived still shows a lit window at 21:14:08; it cannot support the claim that the room was lit every night.", "hints" : [ "Use the image metadata rather than the old caption.", "There is one still, with a timestamp down to seconds.", "The only verified capture time is 21:14:08." ], "id" : "qh3-window-routine", "question" : "Which time is actually stamped on the archived window photograph?", "sources" : [ { "app" : "photos", "body" : "The image metadata shows 21:14:08. A lit upstairs window is visible, but the interior is not. No face or identifying object can be resolved.", "id" : "qh3.photo-frame", "title" : "Archived exterior still" }, { "app" : "notes", "body" : "The still was exported from a municipal traffic camera. It records the time of capture; it does not record the house interior or explain why the light was on.", "id" : "qh3.camera-policy", "title" : "Camera retention policy" }, { "app" : "messages", "body" : "A prior reviewer described the window as 'lit every night'. The packet contains one still and no series of nightly images.", "id" : "qh3.story-caption", "title" : "Original case caption" } ], "title" : "The light in the frame" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "interior check", "the interior check", "caretaking interior check" ], "app" : "browser", "discovery" : "An interior check was billed without a corresponding access record; the file does not prove that the visit occurred.", "hints" : [ "Compare the billed service with the access log.", "The invoice names a check but supplies no date or signature.", "The unmatched service is the monthly interior check." ], "id" : "qh3-cleaning-invoice", "question" : "What service was invoiced but has no matching access record?", "sources" : [ { "app" : "browser", "body" : "A monthly 'interior check' is billed at £18.00. The invoice has a service code but no visit date, signature, or time window.", "id" : "qh3.invoice", "title" : "Caretaking invoice · April" }, { "app" : "calendarApp", "body" : "No door opening or key checkout is recorded for the house that month. The log is complete for the office-held duplicate key.", "id" : "qh3.access-log", "title" : "Access log · April" }, { "app" : "mail", "body" : "The invoice was paid from a pooled property account. No individual customer name appears on the remittance.", "id" : "qh3.accounts", "title" : "Accounts query" } ], "title" : "The invoice with no visit" }, "type" : "investigation" }, { "answer" : "030303", "prompt" : "The property archive groups the three verified dates by their day number. Enter the day repeated in March, April, and May.", "type" : "cipher" }, { "investigation" : { "answers" : [ "june", "06" ], "app" : "notes", "discovery" : "The June statement is missing from this bundle; the cover sheet alone cannot establish why.", "hints" : [ "Compare the listed months with the import receipt.", "June has a cover sheet but no indexed statement.", "June is missing from the retained statement index." ], "id" : "qh3-date-key", "question" : "Which month is missing from the retained envelope index?", "sources" : [ { "app" : "notes", "body" : "Rows list March, April, and May. Each row points to a utility copy and has a checksum.", "id" : "qh3.index.rows", "title" : "Envelope index · retained" }, { "app" : "deaddrop", "body" : "The envelope was imported on 3 June. Its contents include a June billing cover sheet, but the cover sheet has no statement attached.", "id" : "qh3.index.import", "title" : "Import receipt" }, { "app" : "mail", "body" : "An absent statement is a gap in this bundle, not proof that the original was destroyed or that anyone removed it.", "id" : "qh3.index.limit", "title" : "Reviewer note" } ], "title" : "The date key" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "a window appeared lit in one frame", "the window was lit in one frame", "a single lit window", "one frame showed a light" ], "app" : "messages", "discovery" : "The verified wording is limited to one illuminated window in one frame.", "hints" : [ "Keep the answer narrower than the original case caption.", "Only one dated frame exists.", "The archive supports a window appearing lit in one frame, nothing more." ], "id" : "qh3-occupancy-language", "question" : "Which phrase is directly supported by the archive?", "sources" : [ { "app" : "messages", "body" : "'Light seen from the road; no door contact.' The note has no date beyond the month and no named author.", "id" : "qh3.occupancy-note", "title" : "Caretaker note · copy" }, { "app" : "photos", "body" : "One upstairs window is bright in one frame. The camera faces the street, not the rooms.", "id" : "qh3.occupancy-image", "title" : "Single traffic-camera still" }, { "app" : "notes", "body" : "A light in one frame supports only that a window appeared illuminated at that capture time. It does not establish a resident, routine, or identity.", "id" : "qh3.occupancy-summary", "title" : "Evidence wording guide" } ], "title" : "What the notes actually say" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "The file describes a property with inconsistent maintenance records. It still does not tell us who used it. Finish the copy audit before making a personal claim.", "type" : "message" } ], "id" : "case_02_ch13", "legacyBeatIDs" : [ "case_02_ch13.beat.0", "case_02_ch13.beat.1", "case_02_ch13.beat.2", "case_02_ch13.beat.3", "case_02_ch13.beat.4", "case_02_ch13.beat.5", "case_02_ch13.beat.6", "case_02_ch13.beat.7", "case_02_ch13.beat.8", "case_02_ch13.beat.9" ], "title" : "The Rooms Between Readings" }, { "beatIDs" : [ "case_02_ch14.beat.0", "case_02_ch14.beat.1", "case_02_ch14.beat.2", "case_02_ch14.beat.3", "case_02_ch14.beat.4", "case_02_ch14.beat.5", "case_02_ch14.beat.6", "case_02_ch14.beat.7", "case_02_ch14.beat.8" ], "beats" : [ { "sender" : "M.", "text" : "We found a final packet: the account was part of a temporary safeguarding arrangement. A name was deliberately held back. Your job is to decide what can be closed without unsealing it.", "type" : "message" }, { "body" : "This file contains a redacted safeguarding record. The withheld identity is intentionally absent. Do not infer it from an alias, a photograph, or a payment pattern. The audit can be completed with the protected fields left sealed.", "imageName" : null, "title" : "SUPPLEMENT 02-C · CUSTODY TERMS", "type" : "dossier" }, { "investigation" : { "answers" : [ "property liaison", "the property liaison", "liaison" ], "app" : "contacts", "discovery" : "The property liaison role could approve basic costs; the handset does not identify the staff member behind the role.", "hints" : [ "The contact card uses a job role instead of a name.", "Look at the role permitted to approve basic property costs.", "The account approver is the property liaison." ], "id" : "qh3-account-authority", "question" : "Which role is named as the account approver?", "sources" : [ { "app" : "contacts", "body" : "Role: property liaison. Authority: approve utilities and basic repairs for a temporary vacant property. Personal name omitted from the copy.", "id" : "qh3.authority-card", "title" : "Safeguarding office · role card" }, { "app" : "browser", "body" : "A liaison may authorize payments only within the monthly cap. The delegation does not permit access to a resident's identity file.", "id" : "qh3.authority-policy", "title" : "Delegation policy" }, { "app" : "notes", "body" : "The £42.60 account charge is below the approved cap. The ledger records the role code, not the person who submitted it.", "id" : "qh3.authority-ledger", "title" : "Payment ledger" } ], "title" : "Who could approve a service payment?" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "17.40", "17.4", "1740" ], "app" : "calculator", "discovery" : "The reviewed charge was £17.40 below the cap, consistent with the recorded approval limit.", "hints" : [ "Subtract the posted charge from the cap.", "60.00 minus 42.60 leaves 17.40.", "The charge was £17.40 below the cap." ], "id" : "qh3-cap-check", "question" : "How many pounds below the £60 cap was the £42.60 charge?", "sources" : [ { "app" : "browser", "body" : "Monthly utility charges may be approved up to £60 without a second signature.", "id" : "qh3.cap-policy", "title" : "Temporary-property policy" }, { "app" : "notes", "body" : "The reviewed charge is £42.60. No additional repair or caretaker fee was posted to this account that month.", "id" : "qh3.cap-ledger", "title" : "Account ledger" }, { "app" : "vitals", "body" : "The difference between the allowed cap and the posted amount is the remaining headroom, not evidence of a refund.", "id" : "qh3.cap-audit", "title" : "Arithmetic check" } ], "title" : "Inside the monthly cap" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "26 minutes", "26", "0:26" ], "app" : "calendarApp", "discovery" : "The duplicate key was signed out for 26 minutes; no entry event is recorded.", "hints" : [ "Subtract 09:12 from 09:38.", "The times are on the same morning.", "The duplicate key was out for 26 minutes." ], "id" : "qh3-key-custody", "question" : "For how long was the duplicate key signed out?", "sources" : [ { "app" : "calendarApp", "body" : "Duplicate K-2 signed out at 09:12 on 7 May by role code PL-4.", "id" : "qh3.key-out", "title" : "Key register · checkout" }, { "app" : "calendarApp", "body" : "K-2 returned at 09:38 the same day. Seal number unchanged; no door-opening event was recorded.", "id" : "qh3.key-return", "title" : "Key register · return" }, { "app" : "notes", "body" : "Checkout duration is measured from sign-out to return. A key's presence outside the cabinet does not prove a door was opened.", "id" : "qh3.key-policy", "title" : "Key handling rule" } ], "title" : "A key checked out" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "resident identity", "resident name", "contact method", "forwarding location", "personal identity fields" ], "app" : "notes", "discovery" : "The safeguarding policy withholds the resident's identity and forwarding details from this review.", "hints" : [ "Look for fields that the policy marks as protected.", "The working copy retains costs and dates while withholding personal details.", "Resident identity, contact method, and forwarding location are deliberately withheld." ], "id" : "qh3-redaction-map", "question" : "Which field is explicitly withheld by the safeguarding policy?", "sources" : [ { "app" : "notes", "body" : "Resident name, contact method, and any forwarding location are classified as protected fields.", "id" : "qh3.redaction.policy", "title" : "Redaction schedule" }, { "app" : "mail", "body" : "The service dates, amounts, account references, and custody signatures remain visible. Personal identity fields are blank by design.", "id" : "qh3.redaction.copy", "title" : "Released working copy" }, { "app" : "browser", "body" : "The review authorizes a cost audit only. It does not authorize identity reconstruction or a request to the property owner.", "id" : "qh3.redaction.review", "title" : "Release review" } ], "title" : "The page that should stay closed" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the cost audit", "costs and custody", "accounting and custody", "the accounting review" ], "app" : "vitals", "discovery" : "The cost and key-custody audit can be closed; the payer, April visit, and resident identity remain unresolved.", "hints" : [ "Separate records you reconciled from identity questions you cannot answer.", "Costs and the key register reconcile; the payer and visit remain unknown.", "You can close the cost and custody audit while leaving identity sealed." ], "id" : "qh3-final-scope", "question" : "Which part of the case is ready to be closed?", "sources" : [ { "app" : "vitals", "body" : "The utility charge is within the approved cap. Three cash slips reconcile to the same amount; the payer is unknown.", "id" : "qh3.final-costs", "title" : "Cost review" }, { "app" : "notes", "body" : "The duplicate key was returned with its seal intact. The unsigned April service check remains unverified.", "id" : "qh3.final-custody", "title" : "Custody review" }, { "app" : "messages", "body" : "Keep identity and forwarding fields sealed. Record unresolved gaps without contacting the protected resident.", "id" : "qh3.final-protection", "title" : "Safeguarding instruction" } ], "title" : "What the audit can close" }, "type" : "investigation" }, { "choice" : { "id" : "qh3-closeout", "options" : [ { "consequence" : "You closed the reconciled cost and custody work while preserving the resident's redaction.", "id" : "qh3-close-audit", "response" : "M.: That's a complete report. The unresolved parts are visible, and the protected person stays protected.", "text" : "Close the cost audit and retain the identity redaction." }, { "consequence" : "You referred the unsigned copy for a records-policy review and kept the identity sealed.", "id" : "qh3-refer-policy", "response" : "HANDLER: Logged. No identity request or property contact is authorized by this referral.", "text" : "Refer the unsigned service copy for policy review only." } ], "prompt" : "How should the final report protect the sealed resident?" }, "type" : "choice" }, { "body" : "The utility account and duplicate-key records have been reconciled as far as the archive allows. One service check remains unsigned. The property was covered by a temporary safeguarding arrangement; its resident's identity and onward location remain sealed. This report closes the records review without treating a lit window, an alias, or a cash slip as proof of who lived there.", "imageName" : null, "title" : "CASE CLOSED — QUIET HOUSE", "type" : "dossier" } ], "id" : "case_02_ch14", "legacyBeatIDs" : [ "case_02_ch14.beat.0", "case_02_ch14.beat.1", "case_02_ch14.beat.2", "case_02_ch14.beat.3", "case_02_ch14.beat.4", "case_02_ch14.beat.5", "case_02_ch14.beat.6", "case_02_ch14.beat.7", "case_02_ch14.beat.8" ], "title" : "A House Kept on Paper" } ], "continuationChapterID" : "case_02_ch12", "estimatedPlayTime" : "About 2–3 hours", "id" : "case_02", "investigationCount" : 44, "isFree" : false, "requiredCompletedCaseID" : "case_01", "synopsis" : "A house two streets over is listed vacant. The meter says otherwise. The Handler wants to know who's really inside — and why it matters to them.", "tagline" : "Somebody's been living in a house that's supposed to be empty.", "title" : "QUIET HOUSE" }, { "chapters" : [ { "beatIDs" : [ "case_03_ch0.beat.0", "case_03_ch0.beat.1", "case_03_ch0.beat.2", "case_03_ch0.beat.3", "investigation.ticket", "case_03_ch0.beat.4" ], "beats" : [ { "sender" : "HANDLER", "text" : "QUIET HOUSE is done. Whatever's still open on that one isn't yours to close. This one's smaller. Should be quick.", "type" : "message" }, { "sender" : "HANDLER", "text" : "A ticket was bought two nights ago. Cash, one-way, no return, no booking history before it. The name on it doesn't exist anywhere else I can find.", "type" : "message" }, { "body" : "Name: D. MERCER. Route: undisclosed. Departure: within 48 hours of purchase. Paid in exact cash, no card trail, no ID check flagged.", "imageName" : null, "title" : "TICKET — CASE FILE", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "Get a sense of the station before you go asking it questions.", "type" : "message" }, { "investigation" : { "answers" : [ "Silverline Freight", "Silverline" ], "app" : "browser", "discovery" : "Silverline funded Mercer’s evacuation on H’s authorization. This is a planned extraction.", "hints" : [ "Cash payment still left a voucher trail.", "Browser names the issuer; Contacts explains the authorization.", "Enter Silverline Freight." ], "id" : "ticket", "question" : "Which organization funded Mercer’s ticket? Enter the company name.", "sources" : [ { "app" : "browser", "body" : "Ticket paid with voucher SLF-2291-R. The cash desk preserved the voucher issuer: Silverline Freight.", "id" : "ticket.source.0", "title" : "Ticket • cash withdrawal audit" }, { "app" : "contacts", "body" : "R. Alvarez can issue Silverline Freight travel vouchers. The authorization on this one reads: evacuation, approved H.", "id" : "ticket.source.1", "title" : "Dispatch authorization" } ], "title" : "Who bought the ticket?" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "23:24", "2324" ], "app" : "calendarApp", "discovery" : "The revised station notice reads 23:24. The station clock still needs checking. The unchanged platform makes the timetable change easy to miss.", "hints" : [ "Open both listed records and compare their details.", "Tonight’s service leaves 25 minutes later than originally scheduled. The platform is unchanged.", "The answer is 23:24." ], "id" : "ticket-change", "question" : "What departure time should appear on the revised station notice?", "sources" : [ { "app" : "calendarApp", "body" : "Original station notice: 22:59. Times use the station clock. Platform 6. Reservation remains valid after timetable changes.", "id" : "ticket-change.source.0", "title" : "Saved journey" }, { "app" : "browser", "body" : "Tonight’s service leaves 25 minutes later than originally scheduled. The platform is unchanged.", "id" : "ticket-change.source.1", "title" : "Rail service update" } ], "title" : "A changed departure" }, "type" : "investigation" } ], "id" : "case_03_ch0", "legacyBeatIDs" : [ "case_03_ch0.beat.0", "case_03_ch0.beat.1", "case_03_ch0.beat.2", "case_03_ch0.beat.3", "case_03_ch0.beat.4" ], "title" : "One Way" }, { "beatIDs" : [ "case_03_ch1.beat.0", "case_03_ch1.beat.1", "case_03_ch1.beat.2", "investigation.clock", "case_03_ch1.beat.3" ], "beats" : [ { "sender" : "HANDLER", "text" : "Ran the name through everything I have. No such person. Not dead, not missing, not real. Somebody built this identity to use exactly once.", "type" : "message" }, { "hotspots" : [ { "text" : "Departure board — one line whited out. Somebody doesn't want that destination known.", "x" : 0.20000000000000001, "y" : 0.28000000000000003 }, { "text" : "A bag, left on the bench since mid-morning. Still there at close. Forgotten, or a plant.", "x" : 0.14000000000000001, "y" : 0.71999999999999997 }, { "text" : "The station clock. Every clock in this city runs ten minutes fast, on purpose, so nobody misses a train. This one's no different — which means the anomaly isn't the clock.", "x" : 0.82999999999999996, "y" : 0.22 } ], "imageName" : "StationPlatform", "prompt" : "The platform, late. Tap around it.", "type" : "photoClue" }, { "body" : "Nothing about this platform is wrong on its own. A whited-out board line. An unclaimed bag. A clock exactly as fast as it should be. It's the combination that's staged — like someone wanted you looking at all three.", "imageName" : null, "title" : "READ", "type" : "dossier" }, { "investigation" : { "answers" : [ "2314", "23:14" ], "app" : "calculator", "discovery" : "The archive entry at 23:14 is Mercer’s train. The clock was a distraction, not an altered record.", "hints" : [ "A fast clock shows a later time than reality.", "Subtract ten minutes from 23:24.", "The actual departure was 23:14. Enter 23:14." ], "id" : "clock", "question" : "The station clock showed 23:24 at departure. It runs ten minutes fast. What was the actual time? Enter HH:MM.", "sources" : [ { "app" : "photos", "body" : "Departure captured at station-display time 23:24.", "id" : "clock.source.0", "title" : "Platform • clock capture" }, { "app" : "calendarApp", "body" : "Every station clock is set ten minutes fast. Archive timestamps use actual time, not display time.", "id" : "clock.source.1", "title" : "Station clock advisory" } ], "title" : "The real departure" }, "type" : "investigation" }, { "questTitle" : "Find a sign with a spelling mistake.", "type" : "fieldMission" } ], "id" : "case_03_ch1", "legacyBeatIDs" : [ "case_03_ch1.beat.0", "case_03_ch1.beat.1", "case_03_ch1.beat.2", "case_03_ch1.beat.3" ], "title" : "No Such Person" }, { "beatIDs" : [ "case_03_ch2.beat.0", "case_03_ch2.beat.1", "investigation.trace", "case_03_ch2.beat.2", "case_03_ch2.beat.3" ], "beats" : [ { "sender" : "HANDLER", "text" : "Walk it the way they would have. Ticket counter to platform, in the order they'd have gone.", "type" : "message" }, { "correctOrder" : [ 0, 1, 2, 3, 4 ], "imageName" : "RouteMap", "points" : [ { "x" : 0.20000000000000001, "y" : 0.25 }, { "x" : 0.5, "y" : 0.17999999999999999 }, { "x" : 0.78000000000000003, "y" : 0.38 }, { "x" : 0.65000000000000002, "y" : 0.69999999999999996 }, { "x" : 0.29999999999999999, "y" : 0.80000000000000004 } ], "type" : "mapRoute" }, { "investigation" : { "answers" : [ "6" ], "app" : "trace", "discovery" : "Mercer reached platform 6 two minutes before the coastal service departed.", "hints" : [ "Follow the recovered log to its final stop.", "Match that stop with the 23:14 departure.", "Enter 6." ], "id" : "trace", "question" : "Which platform did the protected traveler reach? Enter its number.", "sources" : [ { "app" : "trace", "body" : "22:41 Quiet House → 22:56 service alley → 23:08 station side entrance → 23:12 platform 6. All times are actual time. This is a recovered fictional log, not your GPS.", "id" : "trace.source.0", "title" : "Recovered movement log" }, { "app" : "browser", "body" : "Platform 4: cancelled. Platform 6: 23:14 coastal service. Platform 8: freight only.", "id" : "trace.source.1", "title" : "Departure archive • platform allocation" } ], "title" : "The route after the house" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "Good. Whoever they are, they cased this station same as you just did.", "type" : "message" }, { "investigation" : { "answers" : [ "locker" ], "app" : "notes", "discovery" : "The acrostic spells LOCKER. The apparent route instructions are a distraction.", "hints" : [ "Open both listed records and compare their details.", "The note is an acrostic. Its first letters name the place. Ignore the tempting directions in the sentences.", "The answer is locker." ], "id" : "platform-word", "question" : "Read the first letter of each line. Where should the envelope go?", "sources" : [ { "app" : "notes", "body" : "Look where the announcements fade.\nOnly one lamp stays on.\nCarry nothing with a name.\nKeep the envelope dry.\nEnter when the bell stops.\nReturn by the public stairs.", "id" : "platform-word.source.0", "title" : "Station note" }, { "app" : "messages", "body" : "The note is an acrostic. Its first letters name the place. Ignore the tempting directions in the sentences.", "id" : "platform-word.source.1", "title" : "M. • reading instruction" } ], "title" : "A word between the lines" }, "type" : "investigation" } ], "id" : "case_03_ch2", "legacyBeatIDs" : [ "case_03_ch2.beat.0", "case_03_ch2.beat.1", "case_03_ch2.beat.2", "case_03_ch2.beat.3" ], "title" : "Retrace" }, { "beatIDs" : [ "case_03_ch3.beat.0", "case_03_ch3.beat.1", "case_03_ch3.beat.2", "case_03_ch3.beat.3", "case_03_ch3.beat.4" ], "beats" : [ { "body" : "A fragment of the archived departure board, recovered off the station's own systems. Most of it's corrupted. The listing that matters isn't.", "imageName" : null, "title" : "DEPARTURE LOG (PARTIAL)", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "The archive needs a pull code. It's flashing on today's delayed listing: 2 3 1 4. Enter it.", "type" : "message" }, { "answer" : "2314", "prompt" : "The departure board flashes a delayed-listing pull code: 2 3 1 4. Enter it to open the archive.", "type" : "cipher" }, { "sender" : "HANDLER", "text" : "Archive's up. Route was headed out of the city. Direction only — the final stop's been wiped from every copy but the original board.", "type" : "message" }, { "questTitle" : "Find a tree that looks older than the buildings around it.", "type" : "fieldMission" } ], "id" : "case_03_ch3", "legacyBeatIDs" : [ "case_03_ch3.beat.0", "case_03_ch3.beat.1", "case_03_ch3.beat.2", "case_03_ch3.beat.3", "case_03_ch3.beat.4" ], "title" : "The Board" }, { "beatIDs" : [ "case_03_ch4.beat.0", "case_03_ch4.beat.1", "investigation.receipt", "case_03_ch4.beat.2", "case_03_ch4.beat.3", "case_03_ch4.beat.4" ], "beats" : [ { "sender" : "HANDLER", "text" : "I need you to sit down for this one.", "type" : "message" }, { "body" : "The fabricated identity on the ticket traces back through a paperwork trail to the same partial name on the COLD OPEN storage locker, and the same unconfirmed identity from QUIET HOUSE. Same person. Still moving.", "imageName" : null, "title" : "NAME MATCH — CONFIRMED", "type" : "dossier" }, { "investigation" : { "answers" : [ "daybreak" ], "app" : "comms", "discovery" : "Independent confirmation: Mercer arrived alive. H arranged the extraction but concealed the ledger’s contents.", "hints" : [ "Find the confirmation word in the intercepted exchange.", "The protocol defines whether the passenger survived.", "Enter DAYBREAK." ], "id" : "receipt", "question" : "What word confirms the passenger arrived alive? Enter the code word.", "sources" : [ { "app" : "comms", "body" : "ESCORT: One passenger delivered, breathing, no pursuit.\nM: Confirmation word?\nESCORT: DAYBREAK.\nM: Receipt saved. Don’t send it through H.", "id" : "receipt.source.0", "title" : "Coastal line • received 01:06" }, { "app" : "notes", "body" : "DAYBREAK = arrived alive. NIGHTFALL = extraction failed. These codes refer to the passenger, not the courier.", "id" : "receipt.source.1", "title" : "Extraction protocol" } ], "title" : "Proof of arrival" }, "type" : "investigation" }, { "sender" : "M.", "text" : "That ticket wasn't bought by them. It was bought for them. By H. Same as one's probably been bought for you, whenever you stop being useful.", "type" : "message" }, { "sender" : "HANDLER", "text" : "M. again. Ignore it. You're not being replaced, you're being trained. There was a difference — until now, apparently.", "type" : "message" }, { "questTitle" : "Find an object that looks handmade in a world of factory-made things.", "type" : "fieldMission" } ], "id" : "case_03_ch4", "legacyBeatIDs" : [ "case_03_ch4.beat.0", "case_03_ch4.beat.1", "case_03_ch4.beat.2", "case_03_ch4.beat.3", "case_03_ch4.beat.4" ], "title" : "Someone You Know" }, { "beatIDs" : [ "case_03_ch5.beat.0", "case_03_ch5.beat.1", "choice.publish", "case_03_ch5.beat.2", "case_03_ch5.beat.3", "case_03_ch5.beat.4" ], "beats" : [ { "sender" : "HANDLER", "text" : "Mercer boarded the coastal service at platform 6, at 23:14 actual time. I authorized the ticket through Silverline. The arrival receipt you intercepted is real. Now decide who gets the ledger — I won’t make that decision for you.", "type" : "message" }, { "investigation" : { "answers" : [ "c", "file c" ], "app" : "browser", "discovery" : "File C is the camera original. A is a faithful copy; B has changed.", "hints" : [ "Open both listed records and compare their details.", "The source-camera file predates both exports. A matching checksum can establish a faithful copy, but does not make the copy the original.", "The answer is c." ], "id" : "original-copy", "question" : "Which file is the original: A, B or C?", "sources" : [ { "app" : "browser", "body" : "A: export time 22:09; checksum 7C2F; marked copy.\nB: export time 22:12; checksum 9D10; marked revised.\nC: capture time 21:58; checksum 7C2F; source camera.", "id" : "original-copy.source.0", "title" : "Archive inventory" }, { "app" : "vitals", "body" : "The source-camera file predates both exports. A matching checksum can establish a faithful copy, but does not make the copy the original.", "id" : "original-copy.source.1", "title" : "Integrity note" } ], "title" : "Choose the original" }, "type" : "investigation" }, { "choice" : { "id" : "publish", "options" : [ { "consequence" : "An independent copy reached Mercer. The witness controls their evidence.", "id" : "witness", "response" : "M: Received. Mercer can testify without H owning the only copy.", "text" : "Give Mercer and M an independent copy." }, { "consequence" : "H received a copy. You retained the original ledger as protection.", "id" : "handler", "response" : "H: A copy is enough. Keep the original. You’ve earned the right to check my work.", "text" : "Give H a copy, but retain the original." } ], "prompt" : "Mercer is safe. Who gets the freight ledger?" }, "type" : "choice" }, { "body" : "LAST TRAIN resolved: Silverline funded the ticket on H’s authorization. Mercer boarded at platform 6 and arrived alive, independently confirmed by the DAYBREAK receipt. The ledger exposes payments used to control operatives, including Mercer. Your distribution decision determines who holds a copy. What H intends to do with their network next remains open.", "imageName" : null, "title" : "CASE CLOSED — LAST TRAIN", "type" : "dossier" }, { "sender" : "M.", "text" : "You did the job and you're still asking questions afterward. That's rarer than you'd think. Stay that way, whatever they tell you next. — M.", "type" : "message" }, { "sender" : "HANDLER", "text" : "Three for three. Whatever you decide to believe about me after this — you're good at this. That was never in question. More when I have it. — H", "type" : "message" } ], "id" : "case_03_ch5", "legacyBeatIDs" : [ "case_03_ch5.beat.0", "case_03_ch5.beat.1", "case_03_ch5.beat.2", "case_03_ch5.beat.3", "case_03_ch5.beat.4" ], "title" : "Last Train" }, { "beatIDs" : [ "case_03_ch6.beat.0", "case_03_ch6.beat.1", "case_03_ch6.beat.2", "case_03_ch6.beat.3", "case_03_ch6.beat.4", "case_03_ch6.beat.5", "case_03_ch6.beat.6", "case_03_ch6.beat.7", "case_03_ch6.beat.8", "case_03_ch6.beat.9", "case_03_ch6.beat.10" ], "beats" : [ { "sender" : "M.", "text" : "The arrival receipt is real, but it reached us through the same archive that carried the ticket. Let's check the copy against independent records before we let the case stand on it.", "type" : "message" }, { "investigation" : { "answers" : [ "station archive", "the coastal service station archive", "coastal service archive" ], "app" : "mail", "discovery" : "The coastal service station archive created the receipt; H's handset only relayed its copy.", "hints" : [ "Check the receipt header and transfer log.", "The handset that relayed the file is not the system that created it.", "The station archive created the arrival receipt." ], "id" : "receipt-origin", "question" : "Which system created the arrival receipt?", "sources" : [ { "app" : "mail", "body" : "Created by the coastal service's station archive at 06:18. Imported to this handset at 08:02. Passenger field masked in transit copy.", "id" : "lt2.mail-receipt", "title" : "DAYBREAK · arrival receipt" }, { "app" : "browser", "body" : "The receipt's file signature matches the station archive export. H's handset relayed it but did not create the source file.", "id" : "lt2.browser-transfer", "title" : "Archive transfer log" } ], "title" : "Where the receipt came from" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "10", "ten", "10 minutes" ], "app" : "notes", "discovery" : "The platform display ran ten minutes fast, explaining the apparent departure-time conflict.", "hints" : [ "Subtract the corrected dispatch time from the platform display.", "23:24 minus 23:14 is ten minutes.", "The platform clock ran ten minutes fast." ], "id" : "platform-clock", "question" : "How far ahead did the platform display run? Enter minutes.", "sources" : [ { "app" : "notes", "body" : "Platform display: 23:24. Dispatch system: 23:14. Calibration sheet says the display runs consistently fast.", "id" : "lt2.notes-platform-clock", "title" : "Clock calibration" }, { "app" : "calendarApp", "body" : "Coastal service departed at 23:14 corrected time. The original case report used the platform display without correction.", "id" : "lt2.calendar-train-time", "title" : "Service record" } ], "title" : "The platform clock" }, "type" : "investigation" }, { "body" : "The station archive has two clock domains: the platform display ran ten minutes fast, while the dispatch system used corrected time. The first report mixed them.", "imageName" : null, "title" : "ARRIVAL COPY", "type" : "dossier" }, { "investigation" : { "answers" : [ "23:14", "2314", "23:14:32", "231432" ], "app" : "calendarApp", "discovery" : "The coastal service departed at 23:14:32 corrected time.", "hints" : [ "The dispatch system already uses corrected time.", "Its record says 23:14:32.", "The corrected departure was 23:14 and 32 seconds." ], "id" : "clock-correction", "question" : "What was the corrected departure time?", "sources" : [ { "app" : "calendarApp", "body" : "Coastal service, platform 6. Scheduled 23:14. Actual departure 23:14:32. Platform display at that moment: 23:24.", "id" : "lt2.calendar-dispatch", "title" : "Dispatch clock · corrected" }, { "app" : "notes", "body" : "Subtract ten minutes from the public display. Do not apply the correction to dispatch-system timestamps.", "id" : "lt2.notes-clock-rule", "title" : "Calibration rule" } ], "title" : "Corrected departure time" }, "type" : "investigation" }, { "answer" : "1406", "prompt" : "The corrected platform index uses the scheduled minute followed by the platform number: 14 and 06. Enter the four digits.", "type" : "cipher" }, { "investigation" : { "answers" : [ "ticket batch 8f2", "batch 8f2", "8f2" ], "app" : "contacts", "discovery" : "Ticket batch 8F2 links the one-use ticket to a passenger who boarded platform 6.", "hints" : [ "Compare the fields that remain visible on both copies.", "The name is withheld; the batch code remains.", "Ticket batch 8F2 links the records." ], "id" : "manifest-match", "question" : "Which non-sensitive field links the ticket to the manifest?", "sources" : [ { "app" : "contacts", "body" : "Passenger 06 · ticket batch 8F2 · boarded platform 6 at 23:14. Name and destination withheld by the archive export.", "id" : "lt2.contacts-manifest", "title" : "Passenger manifest · masked" }, { "app" : "browser", "body" : "Ticket batch 8F2 · platform 6 · 23:14 corrected time. Passenger name is a one-use alias and is not printed on the manifest.", "id" : "lt2.browser-ticket", "title" : "Ticket copy · D. Mercer" } ], "title" : "The manifest match" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "The manifest match confirms a passenger boarded under the temporary identity. It still does not identify that passenger as Dana without another link.", "type" : "message" }, { "investigation" : { "answers" : [ "the sealed intake record", "cross-case record", "the ticket and sealed intake link", "file link" ], "app" : "notes", "discovery" : "The sealed intake links Dana to the ticket file; the archive still has no independent visual identification.", "hints" : [ "Find the record that explicitly connects the ticket alias to Dana.", "The link is in the sealed intake, not a photograph.", "The sealed intake links Dana to the ticket, but not visually to passenger 06." ], "id" : "identity-link", "question" : "What supports linking passenger 06 with Dana Mercer?", "sources" : [ { "app" : "notes", "body" : "The one-use ticket's batch matches passenger 06. The sealed intake record links D. Mercer to that ticket. No photograph or live location is present.", "id" : "lt2.notes-identity-link", "title" : "Cross-case link table" }, { "app" : "contacts", "body" : "A cross-case record can support a file link. It cannot substitute for independent identification of a person at a platform.", "id" : "lt2.contacts-identity-limit", "title" : "Identity review standard" } ], "title" : "A link, not a face" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "The arrival copy only makes sense next to a timetable. Find one out in the world: a timetable, a departure board, a route sign. Show me what a station admits.", "type" : "message" }, { "questTitle" : "Find a timetable, departure board or route sign.", "type" : "fieldMission" } ], "id" : "case_03_ch6", "legacyBeatIDs" : [ "case_03_ch6.beat.0", "case_03_ch6.beat.1", "case_03_ch6.beat.2", "case_03_ch6.beat.3", "case_03_ch6.beat.4", "case_03_ch6.beat.5", "case_03_ch6.beat.6", "case_03_ch6.beat.7", "case_03_ch6.beat.8", "case_03_ch6.beat.9", "case_03_ch6.beat.10" ], "title" : "The Arrival Copy" }, { "beatIDs" : [ "case_03_ch7.beat.0", "case_03_ch7.beat.1", "case_03_ch7.beat.2", "case_03_ch7.beat.3", "case_03_ch7.beat.4", "case_03_ch7.beat.5", "case_03_ch7.beat.6" ], "beats" : [ { "sender" : "M.", "text" : "Your earlier choice decided who received a copy of the ledger. A receipt has now come back from that transfer. We can verify delivery without reopening the private names inside it.", "type" : "message" }, { "investigation" : { "answers" : [ "a redacted copy was received", "redacted copy", "file transfer", "one copy was received" ], "app" : "mail", "discovery" : "The archive records delivery of one redacted ledger copy, without confirming how its recipient used it.", "hints" : [ "Read the receipt's status and the distribution record.", "It confirms delivery of one redacted file, not what happened afterward.", "A redacted copy was received at 09:11." ], "id" : "transfer-receipt", "question" : "What does the signed receipt confirm?", "sources" : [ { "app" : "mail", "body" : "One redacted copy received at 09:11. Checksum suffix 51D0. Personal payment rows excluded from this transfer.", "id" : "lt2.mail-transfer", "title" : "Ledger copy receipt" }, { "app" : "browser", "body" : "The original distribution choice is stored in the case report. This receipt confirms a file transfer, not that a recipient read or acted on it.", "id" : "lt2.browser-choice", "title" : "Distribution record" } ], "title" : "The ledger transfer receipt" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "personal names and account numbers", "names and account numbers", "personal data", "account numbers and names" ], "app" : "notes", "discovery" : "The shared copy omits personal names and account numbers while retaining audit fields.", "hints" : [ "Compare the redaction map with the retained fields.", "Dates and totals remain; identifying payment fields do not.", "Personal names and account numbers were removed." ], "id" : "ledger-redaction", "question" : "Which data was excluded from the transferred copy?", "sources" : [ { "app" : "notes", "body" : "Payment rows with personal names and account numbers removed. Dates, totals, batch references and checksum retained for audit.", "id" : "lt2.notes-redaction-map", "title" : "Redaction map" }, { "app" : "mail", "body" : "Redacted working copy · checksum suffix 51D0 · source retained locally.", "id" : "lt2.mail-copy-header", "title" : "Transfer header" } ], "title" : "The rows left out" }, "type" : "investigation" }, { "choice" : { "id" : "last-train-ledger-retention", "options" : [ { "consequence" : "You kept the source local and shared only the verified index.", "id" : "sealed-source", "response" : "M.: That leaves a checkable trail without duplicating every name.", "text" : "Keep the source encrypted and share the verified index." }, { "consequence" : "You made a redacted working copy and preserved the source separately.", "id" : "redacted-copy", "response" : "HANDLER: Understood. The original is preserved separately; the working copy can travel without its private payment rows.", "text" : "Keep a redacted working copy for the next review." } ], "prompt" : "What is the safest way to retain the evidence?" }, "type" : "choice" }, { "investigation" : { "answers" : [ "a passenger on batch 8f2 arrived", "batch 8f2 arrived", "the passenger arrived", "departure and arrival records exist" ], "app" : "vitals", "discovery" : "Station records support a batch-linked passenger's arrival; Dana's identity link comes from a separate case record.", "hints" : [ "Separate the named passenger from the batch-linked passenger.", "The station record has a masked passenger field.", "A passenger linked to batch 8F2 arrived; the record itself does not name Dana." ], "id" : "arrival-confirmation", "question" : "Which event is independently supported by the station records?", "sources" : [ { "app" : "vitals", "body" : "Service departed platform 6 at 23:14:32 corrected time.", "id" : "lt2.vitals-dispatch", "title" : "Dispatch system" }, { "app" : "browser", "body" : "A passenger associated with batch 8F2 was recorded arriving at 06:18. The passenger field is masked; the record does not name Dana.", "id" : "lt2.browser-arrival", "title" : "Coastal station receipt" }, { "app" : "notes", "body" : "The archive independently supports departure and arrival records. Linking the passenger to Dana relies on the sealed intake, not direct identification.", "id" : "lt2.notes-arrival-limit", "title" : "Review limit" } ], "title" : "What arrival is confirmed?" }, "type" : "investigation" }, { "body" : "The clock correction and independent manifest support the arrival account. The temporary passenger identity remains linked to Dana by the case record, not by a face or live location. The ledger's private rows remain outside the shared report.", "imageName" : null, "title" : "CASE ADDENDUM — LAST TRAIN", "type" : "dossier" }, { "sender" : "M.", "text" : "Now the train record stands on more than H's word. That is enough. The rest of the ledger can wait for a proper review.", "type" : "message" } ], "id" : "case_03_ch7", "legacyBeatIDs" : [ "case_03_ch7.beat.0", "case_03_ch7.beat.1", "case_03_ch7.beat.2", "case_03_ch7.beat.3", "case_03_ch7.beat.4", "case_03_ch7.beat.5", "case_03_ch7.beat.6" ], "title" : "Who Keeps the Ledger" }, { "beatIDs" : [ "case_03_ch8.beat.0", "case_03_ch8.beat.1", "case_03_ch8.beat.2", "case_03_ch8.beat.3", "case_03_ch8.beat.4", "case_03_ch8.beat.5", "case_03_ch8.beat.6", "case_03_ch8.beat.7", "case_03_ch8.beat.8", "case_03_ch8.beat.9" ], "beats" : [ { "sender" : "M.", "text" : "A second station archive arrived after the first review. It changes the order of the paperwork, not the train's route. Keep the passenger's identity masked while we check the copy.", "type" : "message" }, { "body" : "This is a local export from the coastal service. The handset has no live network access, ticket search, or passenger lookup. We are reviewing records already copied to the device.", "imageName" : null, "title" : "SUPPLEMENT 03-A · STATION ARCHIVE", "type" : "dossier" }, { "investigation" : { "answers" : [ "arrival stub", "the arrival stub", "receipt" ], "app" : "mail", "discovery" : "The arrival stub was queued before the manifest row; queue order is not event order.", "hints" : [ "Compare the queue timestamps.", "The stub is queued six minutes before the manifest row.", "The arrival stub entered the queue first." ], "id" : "lt3-queue-sequence", "question" : "Which record entered the station export queue first?", "sources" : [ { "app" : "mail", "body" : "Arrival stub · queued 06:18. Passenger field masked. A checksum was added at 06:19.", "id" : "lt3.queue.receipt", "title" : "Export receipt" }, { "app" : "browser", "body" : "Passenger 06 row · queued 06:24. The row contains batch 8F2 but no name or destination.", "id" : "lt3.queue.manifest", "title" : "Manifest mirror" }, { "app" : "notes", "body" : "Queue time records when a file entered the station export process. It does not prove when the underlying event happened.", "id" : "lt3.queue.note", "title" : "Import semantics" } ], "title" : "The export queue" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "600", "600 seconds", "10 minutes", "10" ], "app" : "calendarApp", "discovery" : "The platform display was 600 seconds ahead, while its seconds matched the corrected timebase.", "hints" : [ "The minutes differ by ten; the seconds match.", "Ten minutes equals 600 seconds.", "The display is 600 seconds ahead." ], "id" : "lt3-platform-offset", "question" : "How many seconds after the corrected departure time does the platform clock show?", "sources" : [ { "app" : "calendarApp", "body" : "Display: 23:24:32. The capture metadata places this frame at the train's departure.", "id" : "lt3.offset.platform", "title" : "Platform clock capture" }, { "app" : "phone", "body" : "Corrected departure: 23:14:32. The dispatch server was synchronized to the station master clock.", "id" : "lt3.offset.dispatch", "title" : "Dispatch timebase" }, { "app" : "notes", "body" : "The platform display ran ten minutes fast throughout that week. Seconds remained synchronized.", "id" : "lt3.offset.calibration", "title" : "Clock calibration" } ], "title" : "Two clocks, one departure" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "cl-06", "cl06", "coastal line 06" ], "app" : "browser", "discovery" : "Both copies identify service CL-06; the code cannot identify who rode it.", "hints" : [ "Compare the service fields, not the passenger field.", "The same short code appears on both copies.", "The code is CL-06." ], "id" : "lt3-stub-code", "question" : "Which service code appears on both copies?", "sources" : [ { "app" : "browser", "body" : "Service: CL-06 · batch 8F2 · recorded 06:18. Passenger name is masked in the retained copy.", "id" : "lt3.stub.paper", "title" : "Paper arrival stub" }, { "app" : "mail", "body" : "Service: CL-06 · batch 8F2 · checksum verified. The receipt was generated by the station archive.", "id" : "lt3.stub.mail", "title" : "Station mirror receipt" }, { "app" : "notes", "body" : "CL-06 is the coastal line's early arrival service. A service code identifies the route, not an individual rider.", "id" : "lt3.stub.index", "title" : "Service-code index" } ], "title" : "The stub's service code" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "08:02", "0802", "copy time", "the transfer time" ], "app" : "notes", "discovery" : "08:02 records the local transfer, not the train's arrival.", "hints" : [ "Look for the field labeled copied, not the event time.", "The handset received the file at 08:02.", "08:02 is the copy time; the train event occurred earlier." ], "id" : "lt3-duplicate-time", "question" : "Which timestamp belongs to the copy operation rather than the train event?", "sources" : [ { "app" : "calendarApp", "body" : "Departure: 23:14:32 corrected time. Arrival at the receiving station: 06:18.", "id" : "lt3.copy.event", "title" : "Station event record" }, { "app" : "mail", "body" : "The arrival receipt was copied to the review handset at 08:02. Its original file time remained 06:18.", "id" : "lt3.copy.transfer", "title" : "Copy transfer log" }, { "app" : "notes", "body" : "'Copied' is a local file event. It must not be substituted for the underlying station event timestamp.", "id" : "lt3.copy.rule", "title" : "Timestamp legend" } ], "title" : "The duplicate timestamp" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "destination", "destination field", "the destination field" ], "app" : "messages", "discovery" : "The destination field was removed in a station-side revision; its value is not recoverable from this handset.", "hints" : [ "Compare the two row versions field by field.", "Only the destination changes between copies.", "The destination field was removed before local review." ], "id" : "lt3-manifest-edit", "question" : "Which manifest field changed after the first export?", "sources" : [ { "app" : "messages", "body" : "Passenger 06 · batch 8F2 · platform 6 · destination field masked.", "id" : "lt3.edit.before", "title" : "Reviewer copy · 07:05" }, { "app" : "browser", "body" : "Passenger 06 · batch 8F2 · platform 6 · destination field removed entirely. The row checksum changed.", "id" : "lt3.edit.after", "title" : "Reviewer copy · 07:12" }, { "app" : "notes", "body" : "The revision removed a destination value before the file reached this handset. The value itself is not included in either copy.", "id" : "lt3.edit.audit", "title" : "Revision audit" } ], "title" : "A row moved after export" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "batch 8f2 and platform 6", "batch 8f2", "the shared batch", "batch and platform" ], "app" : "contacts", "discovery" : "Batch 8F2 and platform 6 connect the ticket copy to Passenger 06, without identifying the passenger.", "hints" : [ "Use fields that survive on both copies.", "The name is an alias; the batch and platform remain.", "Batch 8F2 and platform 6 link the records, not a person." ], "id" : "lt3-ticket-proof", "question" : "Which link between the ticket and the passenger row is independently visible?", "sources" : [ { "app" : "contacts", "body" : "Batch 8F2 · platform 6 · corrected time 23:14. The alias is a temporary archive label.", "id" : "lt3.ticket.copy", "title" : "Ticket copy · one-use alias" }, { "app" : "browser", "body" : "Passenger 06 · batch 8F2 · platform 6. No face image or named boarding scan was retained.", "id" : "lt3.passenger.row", "title" : "Masked passenger row" }, { "app" : "notes", "body" : "The shared batch links two records. It does not independently identify the person who held the ticket.", "id" : "lt3.ticket.limit", "title" : "Identity limit" } ], "title" : "What the ticket proves" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "Every clock in this case disagrees with another one. Find a clock in public that shows a different time from your phone. Keep the frame steady.", "type" : "message" }, { "questTitle" : "Find a clock that shows a different time from your phone.", "type" : "fieldMission" } ], "id" : "case_03_ch8", "legacyBeatIDs" : [ "case_03_ch8.beat.0", "case_03_ch8.beat.1", "case_03_ch8.beat.2", "case_03_ch8.beat.3", "case_03_ch8.beat.4", "case_03_ch8.beat.5", "case_03_ch8.beat.6", "case_03_ch8.beat.7", "case_03_ch8.beat.8", "case_03_ch8.beat.9" ], "title" : "The Return Copy" }, { "beatIDs" : [ "case_03_ch9.beat.0", "case_03_ch9.beat.1", "case_03_ch9.beat.2", "case_03_ch9.beat.3", "case_03_ch9.beat.4", "case_03_ch9.beat.5", "case_03_ch9.beat.6", "case_03_ch9.beat.7", "case_03_ch9.beat.8", "case_03_ch9.beat.9" ], "beats" : [ { "sender" : "HANDLER", "text" : "The station copy mentions a seat reservation that was never used to identify anyone. Compare the reservation, the carriage audit, and Dana's own saved notes. The record can tell us about a journey without turning the passenger into a target.", "type" : "message" }, { "body" : "Seat and carriage records are retained as operational logs. They do not contain a live location. The export intentionally masks passenger names and onward destinations.", "imageName" : null, "title" : "SUPPLEMENT 03-B · CARRIAGE AUDIT", "type" : "dossier" }, { "investigation" : { "answers" : [ "2", "two", "two carriages" ], "app" : "calendarApp", "discovery" : "The seat moved two carriages while keeping the same seat number; the archive does not identify who requested it.", "hints" : [ "Compare carriage 2 with carriage 4.", "Subtract the smaller carriage number from the larger.", "The reservation moved two carriages." ], "id" : "lt3-seat-change", "question" : "How many carriage numbers apart were the original and replacement seats?", "sources" : [ { "app" : "calendarApp", "body" : "Carriage 2 · seat 14A · issued 19:08. The ticket uses a one-use alias.", "id" : "lt3.seat.original", "title" : "Original reservation" }, { "app" : "mail", "body" : "Carriage 4 · seat 14A · reissued 21:02. The seat number stayed the same; only the carriage changed.", "id" : "lt3.seat.revised", "title" : "Reissue notice" }, { "app" : "notes", "body" : "A two-carriage reassignment was requested through the station service desk. The request record contains no reason or caller identity.", "id" : "lt3.seat.audit", "title" : "Reservation audit" } ], "title" : "The seat reassignment" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "door b", "b", "carriage 4 door b" ], "app" : "vitals", "discovery" : "Door B registered a close event at 23:16:04; the sensor cannot identify anyone.", "hints" : [ "Read the sensor's location field.", "The log records carriage 4 and door B.", "Door B registered the close event." ], "id" : "lt3-door-sensor", "question" : "Which carriage door registered the service event?", "sources" : [ { "app" : "vitals", "body" : "Carriage 4 · door B · close event at 23:16:04. The sensor reports a door state, not who used it.", "id" : "lt3.sensor.log", "title" : "Door sensor log" }, { "app" : "calendarApp", "body" : "The train departed at 23:14:32 corrected time. The carriage was in motion before the sensor event.", "id" : "lt3.sensor.train", "title" : "Service movement" }, { "app" : "notes", "body" : "The event can confirm that door B closed. It cannot show whether a person entered, exited, or was present.", "id" : "lt3.sensor.policy", "title" : "Sensor limitation" } ], "title" : "A door sensor without a name" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "3", "three", "three items" ], "app" : "browser", "discovery" : "The receipt and loading scan agree on three tagged items; their contents and owner remain unknown.", "hints" : [ "Count the two cases and the canvas bag.", "The loading scan independently lists the total.", "Three tagged items appear in the count." ], "id" : "lt3-bag-count", "question" : "How many tagged items appear on the retained count?", "sources" : [ { "app" : "browser", "body" : "Two small cases and one canvas bag were tagged under the same ticket batch.", "id" : "lt3.bag.receipt", "title" : "Baggage receipt" }, { "app" : "mail", "body" : "Three items were scanned to the coastal service. The scan records tags, not contents or ownership.", "id" : "lt3.bag.scan", "title" : "Loading scan" }, { "app" : "notes", "body" : "The receipt and scan counts agree. No inventory of the contents was made in this archive.", "id" : "lt3.bag.note", "title" : "Review note" } ], "title" : "The baggage count" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "it was cancelled", "cancelled system test", "no announcement played", "system test" ], "app" : "messages", "discovery" : "The station log does not support the undated note that a name was announced.", "hints" : [ "Compare the schedule status with the playback audit.", "A diagnostics tone is not a spoken announcement.", "The scheduled announcement was cancelled as a system test." ], "id" : "lt3-platform-announcement", "question" : "What does the audio log say about the 23:10 announcement?", "sources" : [ { "app" : "messages", "body" : "The 23:10 platform announcement was scheduled but marked 'cancelled · system test'. No voice recording was retained.", "id" : "lt3.announcement.log", "title" : "Station audio schedule" }, { "app" : "notes", "body" : "A margin says 'heard my name before doors'. The note has no date and does not match the station event log.", "id" : "lt3.announcement.note", "title" : "Passenger note · undated" }, { "app" : "vitals", "body" : "The speaker system ran a diagnostics tone at 23:10. The audit contains no speech file or named passenger field.", "id" : "lt3.announcement.audit", "title" : "Playback audit" } ], "title" : "The announcement that never played" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "2.20", "2.2", "220", "£2.20" ], "app" : "calculator", "discovery" : "The carriage change generated a £2.20 credit; the transaction carries no passenger identity.", "hints" : [ "Use the credit line on the adjustment receipt.", "18.40 minus 16.20 equals 2.20.", "The fare adjustment was £2.20." ], "id" : "lt3-fare-difference", "question" : "How much was credited after the carriage change? Enter pounds and pence.", "sources" : [ { "app" : "browser", "body" : "Paid fare: £18.40. The ticket was issued before the carriage reassignment.", "id" : "lt3.fare.original", "title" : "Original fare receipt" }, { "app" : "mail", "body" : "Credit: £2.20. Revised total: £16.20. The calculation matches the difference between the original and revised fare.", "id" : "lt3.fare.revised", "title" : "Adjustment receipt" }, { "app" : "notes", "body" : "The credit was automatic. It is not a payment to or from the passenger.", "id" : "lt3.fare.note", "title" : "Accounts note" } ], "title" : "The fare adjustment" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the ticket assigned carriage 4 and door b closed", "carriage 4 and door b", "the carriage assignment and door event", "carriage 4" ], "app" : "notes", "discovery" : "The records establish a carriage assignment and door event, not who sat there or crossed the door.", "hints" : [ "State the two facts, not a passenger identity.", "One record assigns the ticket; the other records the door state.", "The ticket assigned carriage 4 and door B later closed." ], "id" : "lt3-carriage-proof", "question" : "Which part of the journey is supported by two independent records?", "sources" : [ { "app" : "vitals", "body" : "Carriage 4 door B closed at 23:16:04. The train was already moving.", "id" : "lt3.proof.sensor", "title" : "Sensor export" }, { "app" : "browser", "body" : "The one-use ticket assigns carriage 4, seat 14A. The passenger field remains an alias.", "id" : "lt3.proof.ticket", "title" : "Reissued ticket" }, { "app" : "notes", "body" : "A seat assignment and a door sensor can establish the logged carriage and door event. Neither identifies a body in the carriage.", "id" : "lt3.proof.standard", "title" : "Evidence review standard" } ], "title" : "A carriage is not a person" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "Last errand for this file. Somebody sat by a window and waited. Find a seat like that somewhere public and empty. No people in the frame.", "type" : "message" }, { "questTitle" : "Find a seat by a window where someone could wait and watch.", "type" : "fieldMission" } ], "id" : "case_03_ch9", "legacyBeatIDs" : [ "case_03_ch9.beat.0", "case_03_ch9.beat.1", "case_03_ch9.beat.2", "case_03_ch9.beat.3", "case_03_ch9.beat.4", "case_03_ch9.beat.5", "case_03_ch9.beat.6", "case_03_ch9.beat.7", "case_03_ch9.beat.8", "case_03_ch9.beat.9" ], "title" : "The Seat Beside the Window" }, { "beatIDs" : [ "case_03_ch10.beat.0", "case_03_ch10.beat.1", "case_03_ch10.beat.2", "case_03_ch10.beat.3", "case_03_ch10.beat.4", "case_03_ch10.beat.5", "case_03_ch10.beat.6", "case_03_ch10.beat.7", "case_03_ch10.beat.8", "case_03_ch10.beat.9" ], "beats" : [ { "sender" : "M.", "text" : "The final appendix is a release decision. Dana's file may be connected to the ticket, but the train record stays masked. Decide what belongs in a report that can be checked without exposing a passenger.", "type" : "message" }, { "body" : "The station archive permits service timings, checksum evidence, and redacted carriage records to be compared. It does not authorize an identity search or disclosure of an onward destination.", "imageName" : null, "title" : "SUPPLEMENT 03-C · RELEASE REVIEW", "type" : "dossier" }, { "investigation" : { "answers" : [ "a61c", "a-61c" ], "app" : "browser", "discovery" : "The two retained arrival copies match at checksum suffix A61C; this establishes copy integrity only.", "hints" : [ "Compare the final four characters.", "Both copies end with the same suffix.", "The suffix is A61C." ], "id" : "lt3-hash-match", "question" : "Which checksum suffix appears on both retained arrival copies?", "sources" : [ { "app" : "browser", "body" : "Station export · receipt 8F2 · checksum suffix A61C. Captured before the passenger field was masked.", "id" : "lt3.hash.paper", "title" : "Paper receipt checksum" }, { "app" : "mail", "body" : "Receipt 8F2 · checksum suffix A61C · verification passed. The mirror contains the same timestamp and service code.", "id" : "lt3.hash.mirror", "title" : "Integrity mirror" }, { "app" : "notes", "body" : "A matching checksum supports that these two files are byte-for-byte consistent. It does not authenticate the truth of their original contents.", "id" : "lt3.hash.limit", "title" : "Checksum note" } ], "title" : "The checksum that held" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "service code and corrected times", "corrected times and checksum", "service code, times, and checksum", "service code and times" ], "app" : "notes", "discovery" : "The service code, corrected event times, and checksum are enough to audit the chronology.", "hints" : [ "The chronology can be checked without an identity.", "Keep operational fields; leave passenger fields masked.", "Release the service code, corrected times, and checksum." ], "id" : "lt3-disclosure-fields", "question" : "Which two fields are enough to check the service chronology?", "sources" : [ { "app" : "notes", "body" : "Service code, corrected event times, and checksum are required. Passenger name and destination are not required to reproduce the timing calculation.", "id" : "lt3.release.audit", "title" : "Review checklist" }, { "app" : "browser", "body" : "CL-06 · 23:14:32 departure · 06:18 arrival receipt · checksum A61C. Passenger and destination remain masked.", "id" : "lt3.release.copy", "title" : "Public-safe copy" }, { "app" : "mail", "body" : "Release only the fields needed to explain the finding. Do not reconstruct redacted values from a cross-case reference.", "id" : "lt3.release.policy", "title" : "Archive release policy" } ], "title" : "The smallest useful release" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "7 hours 4 minutes", "7:04", "seven hours and four minutes", "424 minutes" ], "app" : "calculator", "discovery" : "The logged interval is 7 hours and 4 minutes; it describes the service records, not a named passenger's movements.", "hints" : [ "From 23:14 to midnight is 46 minutes.", "Add 6 hours 18 minutes after midnight.", "The elapsed time is 7 hours and 4 minutes." ], "id" : "lt3-arrival-duration", "question" : "How many hours and minutes elapsed from 23:14 departure to 06:18 arrival?", "sources" : [ { "app" : "calendarApp", "body" : "The train departed at 23:14 corrected time.", "id" : "lt3.duration.departure", "title" : "Corrected departure" }, { "app" : "browser", "body" : "The station archive logged arrival at 06:18 the following morning.", "id" : "lt3.duration.arrival", "title" : "Arrival receipt" }, { "app" : "notes", "body" : "The duration crosses midnight. Add the time to midnight to the time after midnight.", "id" : "lt3.duration.rule", "title" : "Elapsed-time note" } ], "title" : "Time between stations" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "passenger name", "the passenger's name", "identity", "name" ], "app" : "contacts", "discovery" : "Both arrival copies keep the passenger's name masked, and the release policy does not permit reconstruction.", "hints" : [ "Look at the fields explicitly listed on both copies.", "Batch and service data remain; the person field does not.", "The passenger name is masked in both copies." ], "id" : "lt3-redaction-check", "question" : "Which identity field is present in neither arrival copy?", "sources" : [ { "app" : "contacts", "body" : "Passenger field: masked. Destination field: blank. Batch 8F2 remains visible for audit.", "id" : "lt3.redaction.first", "title" : "Arrival stub" }, { "app" : "browser", "body" : "The second copy retains service CL-06 and checksum A61C. No passenger name or forwarding location is included.", "id" : "lt3.redaction.second", "title" : "Station mirror" }, { "app" : "notes", "body" : "Masked data must stay masked when copies are joined. A related case file is not authorization to restore it.", "id" : "lt3.redaction.rule", "title" : "Privacy rule" } ], "title" : "The name remains withheld" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "coastal service records desk", "records desk", "the station records desk" ], "app" : "mail", "discovery" : "The coastal service records desk created the mirror; the individual clerk is not identified.", "hints" : [ "Read the creation field, not the receiving-device field.", "The handset received the mirror; the station office created it.", "The coastal service records desk created the integrity mirror." ], "id" : "lt3-copy-owner", "question" : "Which office created the integrity mirror?", "sources" : [ { "app" : "mail", "body" : "Created by the coastal service records desk at 08:02. Reviewer H's handset is listed only as the receiving device.", "id" : "lt3.owner.header", "title" : "Mirror file header" }, { "app" : "browser", "body" : "The records desk signed the export with key R-12. The handset relay added no content to the file.", "id" : "lt3.owner.transfer", "title" : "Transfer log" }, { "app" : "notes", "body" : "A verified system signature identifies the exporting office. It does not identify the clerk who pressed the export command.", "id" : "lt3.owner.limit", "title" : "Custody note" } ], "title" : "Who made the mirror?" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "dana arrived safely", "dana mercer arrived safely", "the passenger was dana", "the passenger's identity" ], "app" : "vitals", "discovery" : "The service chronology is supported, but the archive cannot prove Dana boarded or arrived safely.", "hints" : [ "Compare the named conclusion with the masked records.", "The service chronology is supported; the passenger identity is not.", "The records do not prove Dana boarded or arrived safely." ], "id" : "lt3-report-limit", "question" : "Which statement is not established by the journey records?", "sources" : [ { "app" : "vitals", "body" : "Service CL-06 departed at 23:14:32. A batch-linked arrival receipt was logged at 06:18.", "id" : "lt3.limit.facts", "title" : "Verified chronology" }, { "app" : "contacts", "body" : "The passenger field is masked in the ticket, manifest, and receipt. No named boarding scan exists in this archive.", "id" : "lt3.limit.identity", "title" : "Identity index" }, { "app" : "notes", "body" : "'Dana Mercer boarded the train and arrived safely.' The archive does not independently identify the passenger or establish what happened after arrival.", "id" : "lt3.limit.draft", "title" : "Draft conclusion" } ], "title" : "The line the report must not cross" }, "type" : "investigation" }, { "choice" : { "id" : "lt3-release-choice", "options" : [ { "consequence" : "You released only the corrected service chronology and checksum.", "id" : "lt3-release-minimal", "response" : "M.: Anyone can reproduce the timing. Nobody gets a name the record cannot prove.", "text" : "Share the corrected times and checksum; keep the passenger fields masked." }, { "consequence" : "You retained the verified mirror locally pending the station's review.", "id" : "lt3-retain-copy", "response" : "HANDLER: Logged. The local copy remains intact and the passenger fields remain sealed.", "text" : "Keep the mirror local until the station finishes its own review." } ], "prompt" : "What should the final station report release?" }, "type" : "choice" }, { "body" : "The service chronology and integrity mirror are verified. A batch-linked passenger appears in the arrival record, but the station archive never names that passenger or confirms what happened after arrival. The report preserves the corrected times and leaves the identity sealed. The journey is documented; its passenger remains an open question.", "imageName" : null, "title" : "CASE CLOSED — LAST TRAIN", "type" : "dossier" } ], "id" : "case_03_ch10", "legacyBeatIDs" : [ "case_03_ch10.beat.0", "case_03_ch10.beat.1", "case_03_ch10.beat.2", "case_03_ch10.beat.3", "case_03_ch10.beat.4", "case_03_ch10.beat.5", "case_03_ch10.beat.6", "case_03_ch10.beat.7", "case_03_ch10.beat.8", "case_03_ch10.beat.9" ], "title" : "A Journey Without a Name" } ], "continuationChapterID" : "case_03_ch8", "estimatedPlayTime" : "About 2–3 hours", "id" : "case_03", "investigationCount" : 33, "isFree" : false, "requiredCompletedCaseID" : "case_02", "synopsis" : "A one-way ticket was bought in cash, under a name with no other record anywhere. The Handler wants to know who's really travelling. The answer closes out everything COLD OPEN and QUIET HOUSE left hanging.", "tagline" : "A ticket to somewhere, bought by someone who doesn't exist.", "title" : "LAST TRAIN" }, { "chapters" : [ { "beatIDs" : [ "case_04_ch0.beat.0", "case_04_ch0.beat.1", "case_04_ch0.beat.2", "case_04_ch0.beat.3" ], "beats" : [ { "sender" : "M.", "text" : "The ledger was a map of payments, not the whole network. One row points to a packet returned unopened. I found its archive receipt on the handset copy you kept.", "type" : "message" }, { "sender" : "HANDLER", "text" : "Before we start: this is record analysis. There is no real drop location to visit, no parcel to collect, and no live exchange behind the DEADDROP app.", "type" : "message" }, { "body" : "Archive item DL-04. Original recipient field removed before import. The remaining custody records were copied to this handset for review; no address or live person is identified.", "imageName" : null, "title" : "DEAD LETTER — INTAKE", "type" : "dossier" }, { "investigation" : { "answers" : [ "recipient", "recipient field", "recipient name" ], "app" : "deaddrop", "discovery" : "The recipient field was intentionally removed before the packet entered the local archive.", "hints" : [ "Open both records and compare the intake receipt with the redaction note.", "The receipt marks one line as removed; the note names that import rule.", "The removed field is the recipient." ], "id" : "recipient-field", "question" : "Which field was deliberately removed from the returned packet?", "sources" : [ { "app" : "deaddrop", "body" : "Archive item: DL-04\nStatus: returned unopened\nRecipient: [field removed]\nSender: retained in sealed index\nPhysical routing data: not imported", "id" : "deadletter.intake", "title" : "DL-04 · Intake receipt" }, { "app" : "contacts", "body" : "The import rule removed the recipient field before the archive was copied. The sender and checksum were retained so the record could still be authenticated.", "id" : "deadletter.redaction-note", "title" : "M. · redaction note" } ], "title" : "The missing field" }, "type" : "investigation" } ], "id" : "case_04_ch0", "legacyBeatIDs" : [ "case_04_ch0.beat.0", "case_04_ch0.beat.1", "case_04_ch0.beat.2", "case_04_ch0.beat.3" ], "title" : "Return Receipt" }, { "beatIDs" : [ "case_04_ch1.beat.0", "case_04_ch1.beat.1", "case_04_ch1.beat.2" ], "beats" : [ { "sender" : "HANDLER", "text" : "The recipient was removed on purpose. The packet was still logged twice. Compare the archive receipt with the clock note before you call the second timestamp a delay.", "type" : "message" }, { "investigation" : { "answers" : [ "23:14", "2314" ], "app" : "deaddrop", "discovery" : "The packet was logged at 23:14 actual time. The apparent ten-minute delay was clock drift.", "hints" : [ "Open both listed records before submitting.", "The station board is ten minutes fast; subtract ten minutes from 23:24.", "The corrected receipt time is 23:14." ], "id" : "corrected-time", "question" : "What was the corrected receipt time? Enter HH:MM.", "sources" : [ { "app" : "deaddrop", "body" : "Archive timestamp: 23:24\nClock source: station board\nCorrection note: use the station offset in the Last Train case.", "id" : "deadletter.clock-receipt", "title" : "DL-04 · Station receipt" }, { "app" : "calendarApp", "body" : "Station clocks run ten minutes fast by agreement. This offset applies to the archived receipt as well as the departure board.", "id" : "deadletter.clock-offset", "title" : "Station clock service note" } ], "title" : "Ten minutes ahead" }, "type" : "investigation" }, { "body" : "The corrected time matches the independent station copy. Nothing in the record supports a physical pickup or a meeting. The next question is why someone wanted two copies to disagree.", "imageName" : null, "title" : "CUSTODY WINDOW", "type" : "dossier" } ], "id" : "case_04_ch1", "legacyBeatIDs" : [ "case_04_ch1.beat.0", "case_04_ch1.beat.1", "case_04_ch1.beat.2" ], "title" : "Clock Drift" }, { "beatIDs" : [ "case_04_ch2.beat.0", "case_04_ch2.beat.1", "case_04_ch2.beat.2", "case_04_ch2.beat.3", "case_04_ch2.beat.4" ], "beats" : [ { "sender" : "M.", "text" : "There is a route annotation in the packet, but it describes how the archive was assembled. It is not a route for you to follow.", "type" : "message" }, { "correctOrder" : [ 3, 1, 4, 0, 2 ], "imageName" : "RouteMap", "points" : [ { "x" : 0.20000000000000001, "y" : 0.23999999999999999 }, { "x" : 0.47999999999999998, "y" : 0.17999999999999999 }, { "x" : 0.78000000000000003, "y" : 0.37 }, { "x" : 0.68999999999999995, "y" : 0.68999999999999995 }, { "x" : 0.27000000000000002, "y" : 0.80000000000000004 } ], "type" : "mapRoute" }, { "investigation" : { "answers" : [ "handling note", "m handling note", "m" ], "app" : "maps", "discovery" : "The map sequence indexes pages in the digital archive; it does not identify a real-world route.", "hints" : [ "Read both records. One gives an order; the other explains what that order means.", "Look for the item that explicitly says the sequence is not a physical route.", "M.'s handling note identifies it as page order only." ], "id" : "route-order", "question" : "Which record says the sequence is only an archive index, not a place to visit?", "sources" : [ { "app" : "maps", "body" : "Index sequence: 4 → 2 → 5 → 1 → 3. This is the order used to assemble the digital archive copy.", "id" : "deadletter.route-annotation", "title" : "DL-04 · Route annotation" }, { "app" : "deaddrop", "body" : "The five marks are page-order references. No street, address or physical pickup point was included in the archive. Do not interpret them as a route to follow.", "id" : "deadletter.no-field-route", "title" : "M. · handling note" } ], "title" : "Route, not destination" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "A returned packet has to be posted before it can come back. Find a postbox: any postbox. I want to see what the start of a paper trail looks like.", "type" : "message" }, { "questTitle" : "Find a postbox.", "type" : "fieldMission" } ], "id" : "case_04_ch2", "legacyBeatIDs" : [ "case_04_ch2.beat.0", "case_04_ch2.beat.1", "case_04_ch2.beat.2", "case_04_ch2.beat.3", "case_04_ch2.beat.4" ], "title" : "The Quiet Route" }, { "beatIDs" : [ "case_04_ch3.beat.0", "case_04_ch3.beat.1", "case_04_ch3.beat.2", "case_04_ch3.beat.3" ], "beats" : [ { "sender" : "HANDLER", "text" : "The route note names a checksum, not a destination. Use the archive index to open the comparison record. The original stays here.", "type" : "message" }, { "body" : "The archive uses a four-part retrieval key. Read the packet annotations in the order they were recorded: 3 · 1 · 4 · 2.", "imageName" : null, "title" : "INDEX CARD", "type" : "dossier" }, { "answer" : "3142", "prompt" : "Enter the four-part retrieval key from the index card.", "type" : "cipher" }, { "investigation" : { "answers" : [ "a", "copy a" ], "app" : "deaddrop", "discovery" : "Copy A matches the source fingerprint exactly. The audit can be verified without exposing the recipient.", "hints" : [ "Open both records and compare each fingerprint group from left to right.", "Only one copy has both groups in the same order as the source.", "Copy A matches 8C41-2A." ], "id" : "copy-integrity", "question" : "Which copy matches the source fingerprint: A, B or C?", "sources" : [ { "app" : "deaddrop", "body" : "Source fingerprint: 8C41-2A\nCopy A: 8C41-2A\nCopy B: 8C41-2B\nCopy C: 8C14-2A", "id" : "deadletter.copy-index", "title" : "DL-04 · Copy index" }, { "app" : "notes", "body" : "A copy is unchanged only when every fingerprint group matches the source, in the same order. Similar-looking groups are not a match.", "id" : "deadletter.checksum-guide", "title" : "Checksum guide" } ], "title" : "The faithful copy" }, "type" : "investigation" } ], "id" : "case_04_ch3", "legacyBeatIDs" : [ "case_04_ch3.beat.0", "case_04_ch3.beat.1", "case_04_ch3.beat.2", "case_04_ch3.beat.3" ], "title" : "A Faithful Copy" }, { "beatIDs" : [ "case_04_ch4.beat.0", "case_04_ch4.beat.1", "case_04_ch4.beat.2" ], "beats" : [ { "sender" : "M.", "text" : "You can prove the copy is intact without passing along the private fields. Keep the original local. Decide what the report actually needs.", "type" : "message" }, { "choice" : { "id" : "dead-letter-share", "options" : [ { "consequence" : "You shared a redacted, independently checkable audit while keeping the original local.", "id" : "redacted-mirror", "response" : "M.: Received. Timestamp and checksum are intact; the private fields stayed out.", "text" : "Share the redacted custody audit with M." }, { "consequence" : "You kept the source on this handset and shared only a checksum for verification.", "id" : "local-fingerprint", "response" : "H.: Confirmed. The fingerprint matches. No address or recipient was transmitted.", "text" : "Keep the original here; share only its checksum with H." } ], "prompt" : "The audit is sound. What do you release?" }, "type" : "choice" }, { "body" : "Both choices preserve the original. The case can be resolved without publishing an identity, a home address, or a physical handoff point.", "imageName" : null, "title" : "DISCLOSURE CHECK", "type" : "dossier" } ], "id" : "case_04_ch4", "legacyBeatIDs" : [ "case_04_ch4.beat.0", "case_04_ch4.beat.1", "case_04_ch4.beat.2" ], "title" : "Minimum Disclosure" }, { "beatIDs" : [ "case_04_ch5.beat.0", "case_04_ch5.beat.1", "case_04_ch5.beat.2", "case_04_ch5.beat.3", "case_04_ch5.beat.4", "case_04_ch5.beat.5" ], "beats" : [ { "sender" : "HANDLER", "text" : "The archive agrees: the packet was deliberately returned, the timestamps reconcile, and the copy has not been altered. Your disclosure choice is attached to the report.", "type" : "message" }, { "sender" : "M.", "text" : "No address, no rendezvous, no mystery box in the street. Just the record, checked twice. That is enough for this one.", "type" : "message" }, { "body" : "The returned packet was a controlled archive copy, not a request for a physical handoff. Its recipient was intentionally withheld. You verified the custody chain and chose a limited disclosure; the source record remains on this handset.", "imageName" : null, "title" : "CASE CLOSED — DEAD LETTER", "type" : "dossier" }, { "sender" : "HANDLER", "text" : "You followed the evidence only as far as it could be trusted. Good work. The network is smaller than it looked — and there is still one name missing from its index.", "type" : "message" }, { "sender" : "HANDLER", "text" : "One more thing before we close this. Names get worn off places. Find a sign or nameplate that has faded, and read what's left.", "type" : "message" }, { "questTitle" : "Find a sign or nameplate that has faded.", "type" : "fieldMission" } ], "id" : "case_04_ch5", "legacyBeatIDs" : [ "case_04_ch5.beat.0", "case_04_ch5.beat.1", "case_04_ch5.beat.2", "case_04_ch5.beat.3", "case_04_ch5.beat.4", "case_04_ch5.beat.5" ], "title" : "No Forwarding Address" }, { "beatIDs" : [ "case_04_ch6.beat.0", "case_04_ch6.beat.1", "case_04_ch6.beat.2", "case_04_ch6.beat.3", "case_04_ch6.beat.4", "case_04_ch6.beat.5", "case_04_ch6.beat.6", "case_04_ch6.beat.7" ], "beats" : [ { "sender" : "M.", "text" : "The sealed index has one blank row where a person’s name should be. We can work out why it was removed without trying to restore the name.", "type" : "message" }, { "investigation" : { "answers" : [ "the name was removed before import", "removed before import", "nothing about the identity" ], "app" : "deaddrop", "discovery" : "The export proves a row was removed before import but contains no recoverable identity.", "hints" : [ "Open the archived record.", "The deletion predates this handset's archive.", "The export proves a row was removed before import but contains no recoverable identity." ], "id" : "index-gap", "question" : "What does the blank row tell you about the missing recipient?", "sources" : [ { "app" : "deaddrop", "body" : "Row 04 is present with a deletion marker dated before import. No original text, hash fragment or initials remain.", "id" : "dl2.index-gap.source", "title" : "Index export" }, { "app" : "browser", "body" : "The export profile removes protected recipient fields before creating the handset package. Deleted values are not included in its audit copy.", "id" : "dl2.index-gap.cross-check", "title" : "Export policy snapshot" } ], "title" : "The blank index row" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "records counsel", "privacy review", "records counsel privacy review" ], "app" : "contacts", "discovery" : "Records counsel authorized the privacy redaction; the individual reviewer remains unnamed.", "hints" : [ "Open the archived record.", "Read the role attached to the signature.", "Records counsel authorized the privacy redaction; the individual reviewer remains unnamed." ], "id" : "redaction-authority", "question" : "Which authority is recorded for the redaction?", "sources" : [ { "app" : "contacts", "body" : "Privacy review signed by records counsel. Reviewer identity is replaced with a role code; no individual name was exported.", "id" : "dl2.redaction-authority.source", "title" : "Custody approval" }, { "app" : "mail", "body" : "Receipt RC-2 confirms that records counsel approved rule R-04 before export. The individual signer's name was withheld from the handset copy.", "id" : "dl2.redaction-authority.cross-check", "title" : "Approval receipt" } ], "title" : "Who approved the redaction?" }, "type" : "investigation" }, { "body" : "The missing row was suppressed before the archive export. The export contains no recoverable name, and the review has no reason to reconstruct one.", "imageName" : null, "title" : "INDEX REVIEW", "type" : "dossier" }, { "investigation" : { "answers" : [ "original scan", "the original", "original" ], "app" : "deaddrop", "discovery" : "The original scan was imported first; the manifest does not prove when it was created.", "hints" : [ "Open the archived record.", "Read the earliest local import time.", "The original scan was imported first; the manifest does not prove when it was created." ], "id" : "copy-sequence", "question" : "Which copy was imported first?", "sources" : [ { "app" : "deaddrop", "body" : "Original scan: 13:02. Integrity mirror: 13:09. Redacted review copy: 13:14. These are import times on this device.", "id" : "dl2.copy-sequence.source", "title" : "Copy manifest" }, { "app" : "calendarApp", "body" : "The local import queue lists the original scan first, then the integrity mirror, then the redacted review copy. These entries describe handset import order only.", "id" : "dl2.copy-sequence.cross-check", "title" : "Import queue" } ], "title" : "The copy sequence" }, "type" : "investigation" }, { "answer" : "0412", "prompt" : "The retained index uses the two visible packet numbers in order: 0 and 4, followed by the copy suffix 1 and 2.", "type" : "cipher" }, { "investigation" : { "answers" : [ "90 days", "90", "ninety days" ], "app" : "calendarApp", "discovery" : "The redacted working copy is retained for 90 days; integrity metadata follows a separate schedule.", "hints" : [ "Open the archived record.", "Use the duration for the redacted working copy.", "The redacted working copy is retained for 90 days; integrity metadata follows a separate schedule." ], "id" : "retention-window", "question" : "How long does policy retain the redacted working copy?", "sources" : [ { "app" : "calendarApp", "body" : "Redacted working copy: 90 days from import. Integrity metadata: retained for one year. Source image: held under the original authority, outside this review.", "id" : "dl2.retention-window.source", "title" : "Retention schedule" }, { "app" : "notes", "body" : "The working copy expires after 90 elapsed days. The one-year metadata schedule applies to checksums and custody events, not the source image.", "id" : "dl2.retention-window.cross-check", "title" : "Retention rule extract" } ], "title" : "The retention key" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "The key opens the retention schedule. It confirms when the record expires, not who the redacted recipient was.", "type" : "message" } ], "id" : "case_04_ch6", "legacyBeatIDs" : [ "case_04_ch6.beat.0", "case_04_ch6.beat.1", "case_04_ch6.beat.2", "case_04_ch6.beat.3", "case_04_ch6.beat.4", "case_04_ch6.beat.5", "case_04_ch6.beat.6", "case_04_ch6.beat.7" ], "title" : "The Missing Index Row" }, { "beatIDs" : [ "case_04_ch7.beat.0", "case_04_ch7.beat.1", "case_04_ch7.beat.2", "case_04_ch7.beat.3", "case_04_ch7.beat.4" ], "beats" : [ { "investigation" : { "answers" : [ "10 september", "september 10", "10/09", "09/10" ], "app" : "calendarApp", "discovery" : "The redacted working copy reaches its 90-day review date on 10 September.", "hints" : [ "Open the archived record.", "Count 90 elapsed days after 12 June.", "The redacted working copy reaches its 90-day review date on 10 September." ], "id" : "expiry-check", "question" : "If import occurred on 12 June, on what date is the 90-day review due?", "sources" : [ { "app" : "calendarApp", "body" : "Import date: 12 June. Retention period: 90 days. The calendar uses elapsed days, not inclusive counting.", "id" : "dl2.expiry-check.source", "title" : "Review calendar" }, { "app" : "calculator", "body" : "Counting 90 elapsed days after 12 June lands on 10 September. The import date is day zero.", "id" : "dl2.expiry-check.cross-check", "title" : "Date calculation" } ], "title" : "The review date" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "custody and integrity", "integrity", "checksum and custody" ], "app" : "mail", "discovery" : "The auditor approved custody and integrity, not the truth of the packet's claims.", "hints" : [ "Open the archived record.", "Read the scope after the semicolon.", "The auditor approved custody and integrity, not the truth of the packet's claims." ], "id" : "audit-signoff", "question" : "What did the auditor sign off on?", "sources" : [ { "app" : "mail", "body" : "Checksum verified, source retained, recipient field still withheld. Sign-off applies to custody and integrity only; it does not validate the packet's original claims.", "id" : "dl2.audit-signoff.source", "title" : "Closeout email" }, { "app" : "vitals", "body" : "Status: integrity and custody verified. Content truth: outside audit scope. No identity or motive determination was recorded.", "id" : "dl2.audit-signoff.cross-check", "title" : "Audit status" } ], "title" : "The final audit sign-off" }, "type" : "investigation" }, { "choice" : { "id" : "dead-letter-retention", "options" : [ { "consequence" : "You let the redacted working copy expire and retained the policy audit.", "id" : "expire-redacted", "response" : "M.: The source policy remains in force. We keep the audit trail, not a shadow copy of a withheld identity.", "text" : "Let the redacted working copy expire on schedule." }, { "consequence" : "You renewed the integrity audit while allowing the private record to expire.", "id" : "renew-audit", "response" : "HANDLER: Approved. That preserves integrity evidence without extending the personal data.", "text" : "Renew only the checksum and custody audit." } ], "prompt" : "The retained copy reaches its review date. What do you recommend?" }, "type" : "choice" }, { "body" : "The missing index row was deliberately withheld before import. Its custody and expiry rules are now verified. The identity remains unknown, and the archive does not authorize recovering it.", "imageName" : null, "title" : "CASE CLOSED — DEAD LETTER", "type" : "dossier" }, { "sender" : "M.", "text" : "A blank can be the right answer. The paper trail is closed without turning a privacy boundary into another puzzle to break.", "type" : "message" } ], "id" : "case_04_ch7", "legacyBeatIDs" : [ "case_04_ch7.beat.0", "case_04_ch7.beat.1", "case_04_ch7.beat.2", "case_04_ch7.beat.3", "case_04_ch7.beat.4" ], "title" : "A Name Left Blank" }, { "beatIDs" : [ "case_04_ch8.beat.0", "case_04_ch8.beat.1", "case_04_ch8.beat.2", "case_04_ch8.beat.3", "case_04_ch8.beat.4", "case_04_ch8.beat.5", "case_04_ch8.beat.6", "case_04_ch8.beat.7", "case_04_ch8.beat.8", "case_04_ch8.beat.9" ], "beats" : [ { "sender" : "M.", "text" : "The redacted packet was returned, but a newer integrity mirror exists. It contains the exact sequence of edits that produced the blank row. The name is not in it. We can still audit the decision.", "type" : "message" }, { "body" : "The review is limited to a sealed offline archive. No address, recipient identity, or external lookup is available. The blank row is an intentional privacy boundary, not an invitation to guess.", "imageName" : null, "title" : "SUPPLEMENT 04-A · MIRROR INDEX", "type" : "dossier" }, { "investigation" : { "answers" : [ "8", "8 minutes", "eight minutes" ], "app" : "mail", "discovery" : "The raw receipt stamps are eight minutes apart; the import clock audit later corrects that apparent interval.", "hints" : [ "Compare the raw stamps, without correcting either yet.", "The receipt values differ by eight minutes.", "The raw receipts are eight minutes apart; a later audit corrects the import clock." ], "id" : "dl3-mirror-created", "question" : "How many minutes after the redacted copy was the integrity mirror created?", "sources" : [ { "app" : "mail", "body" : "Redacted copy sealed at 13:14:08. The source image remained in the original custody store.", "id" : "dl3.mirror.redacted", "title" : "Redacted copy receipt" }, { "app" : "browser", "body" : "Mirror created at 13:22:08. It contains hashes and deletion markers, no deleted text.", "id" : "dl3.mirror.integrity", "title" : "Integrity mirror receipt" }, { "app" : "notes", "body" : "These are raw receipt stamps. The import service's clock offset has not yet been applied; retain the original values before correcting them.", "id" : "dl3.mirror.note", "title" : "Timing note" } ], "title" : "When the mirror was made" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the redacted review copy", "redacted copy", "the review copy" ], "app" : "deaddrop", "discovery" : "Digest D0-41 identifies the redacted review copy, not the missing source image.", "hints" : [ "Follow digest D0-41 through the receipt.", "It is attached to the review copy, not the original scan.", "The retained hash identifies the redacted review copy." ], "id" : "dl3-hash-scope", "question" : "Which object does the retained hash identify?", "sources" : [ { "app" : "deaddrop", "body" : "Digest D0-41 is attached to the redacted review copy. The original scan has a different digest in the custody store.", "id" : "dl3.hash.manifest", "title" : "Hash manifest" }, { "app" : "mail", "body" : "The mirror verifies D0-41 against the redacted copy received at 13:14. It does not compare the copy with the unavailable source image.", "id" : "dl3.hash.receipt", "title" : "Integrity receipt" }, { "app" : "notes", "body" : "A hash identifies the exact bytes that were hashed. It does not prove that the source was complete or true.", "id" : "dl3.hash.standard", "title" : "Integrity standard" } ], "title" : "What the hash covers" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "records counsel", "counsel", "role code rc-2" ], "app" : "contacts", "discovery" : "Records counsel is the authorized role; the individual reviewer remains unnamed.", "hints" : [ "Match RC-2 across the authority register and audit.", "RC-2 is a role, not a personal name.", "Records counsel is listed as the authorized role." ], "id" : "dl3-editor-role", "question" : "Which role is recorded as the editor of the redaction rule?", "sources" : [ { "app" : "contacts", "body" : "Role code RC-2 · records counsel · permission: suppress protected recipient fields before export.", "id" : "dl3.editor.card", "title" : "Authority register" }, { "app" : "deaddrop", "body" : "Rule R-04 applied before the first handset import. The individual reviewer name was replaced by role code RC-2.", "id" : "dl3.editor.audit", "title" : "Rule audit" }, { "app" : "notes", "body" : "The role can establish delegated authority. It does not reveal the human identity behind that role code.", "id" : "dl3.editor.limit", "title" : "Reviewer caution" } ], "title" : "The editor's role" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "2.2", "22", "version 2.2" ], "app" : "browser", "discovery" : "The manifest skips version 2.2; it provides no content or reason for that gap.", "hints" : [ "Read the sequence between 2.1 and 2.3.", "Only the label is missing; no file body is present.", "Version 2.2 is absent from the local manifest." ], "id" : "dl3-version-gap", "question" : "Which packet version is missing between 2.1 and 2.3?", "sources" : [ { "app" : "browser", "body" : "Working copy 2.1 · redacted review 2.3 · integrity mirror 2.4. The index is complete for this export window.", "id" : "dl3.version.index", "title" : "Packet version index" }, { "app" : "calendarApp", "body" : "At 13:10, rule R-04 was applied. At 13:14, version 2.3 was sealed. No 2.2 file appears in the local manifest.", "id" : "dl3.version.events", "title" : "Export events" }, { "app" : "notes", "body" : "A skipped version number can reflect a withdrawn draft or a numbering convention. This archive contains no 2.2 payload.", "id" : "dl3.version.note", "title" : "Version policy" } ], "title" : "The skipped version" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "2", "2 minutes", "two" ], "app" : "calendarApp", "discovery" : "The import clock ran two minutes ahead; corrected timestamps should subtract two minutes.", "hints" : [ "Compare 13:22 with 13:20.", "The import clock is ahead by two minutes.", "Subtract two minutes from import timestamps." ], "id" : "dl3-copy-clock", "question" : "How far ahead did the import clock run? Enter minutes.", "sources" : [ { "app" : "calendarApp", "body" : "The import service recorded 13:22 when the master clock read 13:20. The offset was stable during the export.", "id" : "dl3.clock.import", "title" : "Import clock audit" }, { "app" : "vitals", "body" : "A signed time check shows the station clock was synchronized within one second.", "id" : "dl3.clock.station", "title" : "Master clock check" }, { "app" : "notes", "body" : "Subtract the import clock offset from local import timestamps before comparing them to the station event log.", "id" : "dl3.clock.rule", "title" : "Correction note" } ], "title" : "The clock correction" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "external custody store", "not on this handset", "outside this review", "external store" ], "app" : "deaddrop", "discovery" : "The original scan is outside this handset's custody scope and cannot be opened from the review copy.", "hints" : [ "Follow reference O-17 in the source index.", "The handset has the review copy, not the original.", "The original is in an external custody store outside this review." ], "id" : "dl3-original-unavailable", "question" : "Where is the original scan held?", "sources" : [ { "app" : "deaddrop", "body" : "The original scan is referenced as O-17. The record points to an external custody store not mounted on this handset.", "id" : "dl3.source.index", "title" : "Source-store index" }, { "app" : "mail", "body" : "The integrity mirror contains a hash and deletion marker only. It does not embed the source image.", "id" : "dl3.source.mirror", "title" : "Mirror receipt" }, { "app" : "notes", "body" : "This handset holds only the redacted review copy. No credentials or route to the original custody store were provided.", "id" : "dl3.source.boundary", "title" : "Scope boundary" } ], "title" : "The source that is not here" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "The last thing this packet needs is a public copy. Find a notice fixed to a public board, something anyone can read. That's what honest disclosure looks like.", "type" : "message" }, { "questTitle" : "Find a notice fixed to a public board.", "type" : "fieldMission" } ], "id" : "case_04_ch8", "legacyBeatIDs" : [ "case_04_ch8.beat.0", "case_04_ch8.beat.1", "case_04_ch8.beat.2", "case_04_ch8.beat.3", "case_04_ch8.beat.4", "case_04_ch8.beat.5", "case_04_ch8.beat.6", "case_04_ch8.beat.7", "case_04_ch8.beat.8", "case_04_ch8.beat.9" ], "title" : "The Copy After the Copy" }, { "beatIDs" : [ "case_04_ch9.beat.0", "case_04_ch9.beat.1", "case_04_ch9.beat.2", "case_04_ch9.beat.3", "case_04_ch9.beat.4", "case_04_ch9.beat.5", "case_04_ch9.beat.6", "case_04_ch9.beat.7", "case_04_ch9.beat.8" ], "beats" : [ { "sender" : "HANDLER", "text" : "We can confirm what the export removed and when its working copy should expire. The archive's retention rules are part of the evidence too. Check whether the audit is keeping more personal data than the case needs.", "type" : "message" }, { "body" : "The original remains under its separate legal authority. This review concerns a redacted working copy and its integrity metadata only.", "imageName" : null, "title" : "SUPPLEMENT 04-B · RETENTION REVIEW", "type" : "dossier" }, { "investigation" : { "answers" : [ "12 june", "june 12", "12/06" ], "app" : "calendarApp", "discovery" : "The 90-day retention period starts on the 12 June import date.", "hints" : [ "Use the import receipt, not the source scan date.", "The review copy entered the handset on 12 June.", "The retention clock starts on 12 June." ], "id" : "dl3-retention-start", "question" : "Which date starts the 90-day retention period?", "sources" : [ { "app" : "calendarApp", "body" : "The redacted working copy entered this review on 12 June at 13:14.", "id" : "dl3.retention.import", "title" : "Import receipt" }, { "app" : "browser", "body" : "The 90-day period begins when the working copy is imported, not when the source image was created.", "id" : "dl3.retention.policy", "title" : "Retention policy" }, { "app" : "notes", "body" : "The policy counts elapsed calendar days. The import date is day zero.", "id" : "dl3.retention.note", "title" : "Counting rule" } ], "title" : "When retention began" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "one year", "1 year", "365 days" ], "app" : "browser", "discovery" : "Integrity metadata is retained for one year after the redacted working copy expires.", "hints" : [ "Do not confuse the working copy with its audit metadata.", "The second schedule retains metadata longer.", "Integrity metadata is kept for one year." ], "id" : "dl3-integrity-expiry", "question" : "How long is integrity metadata retained?", "sources" : [ { "app" : "browser", "body" : "Redacted working copy: 90 days from import. Review again on 10 September.", "id" : "dl3.expiry.working", "title" : "Retention schedule" }, { "app" : "calendarApp", "body" : "Integrity metadata: one year from import. This includes checksum, custody, and expiry event, not the withheld recipient field.", "id" : "dl3.expiry.metadata", "title" : "Metadata schedule" }, { "app" : "notes", "body" : "The metadata outlives the redacted copy so auditors can verify when the copy was removed.", "id" : "dl3.expiry.policy", "title" : "Retention rationale" } ], "title" : "Two clocks, two records" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "a completed deletion receipt", "deletion receipt", "a receipt in the integrity log", "completed receipt" ], "app" : "vitals", "discovery" : "The scheduled event is still pending; only a completed deletion receipt will prove removal.", "hints" : [ "Distinguish a future calendar event from a completed audit record.", "The status is still pending.", "A completed deletion receipt in the integrity log is required." ], "id" : "dl3-delete-proof", "question" : "Which event would prove the working copy was removed on schedule?", "sources" : [ { "app" : "notes", "body" : "At day 90, the working-copy object is removed and a deletion receipt is appended to the integrity log.", "id" : "dl3.delete.policy", "title" : "Deletion procedure" }, { "app" : "calendarApp", "body" : "A scheduled event is set for 10 September. Its status is 'pending' in this archive.", "id" : "dl3.delete.calendar", "title" : "Retention event" }, { "app" : "vitals", "body" : "No completed deletion receipt appears yet. A scheduled event proves intent, not completion.", "id" : "dl3.delete.scope", "title" : "Current status" } ], "title" : "Proof of scheduled deletion" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "hash, import time, expiry result, and custody events", "integrity metadata", "hash and custody metadata", "process metadata" ], "app" : "notes", "discovery" : "Only process-level integrity and custody metadata survives the working copy's expiry.", "hints" : [ "Read the metadata schema after the working copy is removed.", "It keeps audit fields, not the image or personal identity.", "The hash, import time, expiry result, and role-level custody events remain." ], "id" : "dl3-scope-compare", "question" : "Which fields remain after the working copy expires?", "sources" : [ { "app" : "calendarApp", "body" : "After expiry, the original working copy is removed. Integrity metadata remains for one year.", "id" : "dl3.scope.schedule", "title" : "Retention schedule" }, { "app" : "deaddrop", "body" : "Retained fields: object hash, import time, expiry result, and role-level custody events. No image, recipient name, or address is retained.", "id" : "dl3.scope.metadata", "title" : "Metadata schema" }, { "app" : "browser", "body" : "The surviving record exists to verify process, not to recreate the withheld content.", "id" : "dl3.scope.policy", "title" : "Minimal retention rule" } ], "title" : "What survives deletion" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "temporary mirror", "copy b", "the second copy", "mirror imported 14 june" ], "app" : "mail", "discovery" : "The temporary mirror lacks an approved retention schedule even though it matches the redacted working copy.", "hints" : [ "Both copies have the same digest; compare their retention fields.", "Only one has an approved expiry schedule.", "The temporary mirror lacks its own retention record." ], "id" : "dl3-second-copy", "question" : "Which copy shares the same checksum but lacks an approved retention record?", "sources" : [ { "app" : "mail", "body" : "Redacted working copy · digest D0-41 · expiry 10 September · signed retention schedule attached.", "id" : "dl3.duplicate.a", "title" : "Review copy A" }, { "app" : "deaddrop", "body" : "Temporary mirror · digest D0-41 · imported 14 June · no retention schedule or deletion event attached.", "id" : "dl3.duplicate.b", "title" : "Review copy B" }, { "app" : "notes", "body" : "A matching digest confirms identical bytes. A duplicate copy still needs its own custody and deletion authority.", "id" : "dl3.duplicate.rule", "title" : "Duplicate handling" } ], "title" : "A duplicate that should not remain" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "9", "nine", "9 days" ], "app" : "calculator", "discovery" : "Nine elapsed days remain before the scheduled retention review.", "hints" : [ "Subtract the day numbers in September.", "10 minus 1 is nine elapsed days.", "Nine days remain." ], "id" : "dl3-retention-date", "question" : "How many days remain from 1 September until the 10 September review date?", "sources" : [ { "app" : "calendarApp", "body" : "Current review date: 1 September. Retention review: 10 September.", "id" : "dl3.date.today", "title" : "Review calendar" }, { "app" : "notes", "body" : "Count elapsed days after 1 September. The review day is the deadline, not an additional grace period.", "id" : "dl3.date.rule", "title" : "Calendar rule" }, { "app" : "vitals", "body" : "The deletion receipt must be present by the 10 September review.", "id" : "dl3.date.event", "title" : "Expiry event" } ], "title" : "The review date" }, "type" : "investigation" }, { "choice" : { "id" : "dl3-retention-action", "options" : [ { "consequence" : "You recommended deleting the unapproved mirror while retaining process metadata.", "id" : "dl3-delete-mirror", "response" : "M.: That leaves an audit trail without a second copy of the sensitive file.", "text" : "Remove the mirror and keep only its deletion receipt." }, { "consequence" : "You placed the mirror on a short policy hold pending written authority.", "id" : "dl3-seek-authority", "response" : "HANDLER: Logged as a temporary hold. The review deadline stays visible.", "text" : "Hold the mirror briefly while records counsel confirms its schedule." } ], "prompt" : "The duplicate mirror has no deletion authority. What do you recommend?" }, "type" : "choice" } ], "id" : "case_04_ch9", "legacyBeatIDs" : [ "case_04_ch9.beat.0", "case_04_ch9.beat.1", "case_04_ch9.beat.2", "case_04_ch9.beat.3", "case_04_ch9.beat.4", "case_04_ch9.beat.5", "case_04_ch9.beat.6", "case_04_ch9.beat.7", "case_04_ch9.beat.8" ], "title" : "The Retention Clock" }, { "beatIDs" : [ "case_04_ch10.beat.0", "case_04_ch10.beat.1", "case_04_ch10.beat.2", "case_04_ch10.beat.3", "case_04_ch10.beat.4", "case_04_ch10.beat.5", "case_04_ch10.beat.6", "case_04_ch10.beat.7", "case_04_ch10.beat.8", "case_04_ch10.beat.9" ], "beats" : [ { "sender" : "M.", "text" : "The retained metadata answers the process questions. It does not restore the recipient. Write the closeout so another reviewer can check every step without inheriting a shadow copy of the name.", "type" : "message" }, { "body" : "A defensible closeout names the evidence examined, separates verified events from interpretations, and records when a protected field is intentionally unavailable.", "imageName" : null, "title" : "SUPPLEMENT 04-C · CLOSEOUT STANDARD", "type" : "dossier" }, { "investigation" : { "answers" : [ "the redacted copy was sealed", "redacted copy sealed", "the redacted copy", "copy sealed at 13:14" ], "app" : "deaddrop", "discovery" : "The redacted copy was sealed before the integrity mirror was created.", "hints" : [ "Correct the import clock before sorting.", "The redacted copy is sealed at 13:14, before the corrected 13:20 mirror event.", "The redacted copy was sealed immediately before the mirror was created." ], "id" : "dl3-audit-order", "question" : "Which event happened immediately before the integrity mirror was created?", "sources" : [ { "app" : "notes", "body" : "The order uses corrected station times. Import-clock values must be reduced by two minutes.", "id" : "dl3.order.rule", "title" : "Event order" }, { "app" : "calendarApp", "body" : "Rule applied 13:10 · redacted copy sealed 13:14:08 · mirror created 13:22:08 import time, corrected to 13:20:08.", "id" : "dl3.order.timeline", "title" : "Corrected timeline" }, { "app" : "mail", "body" : "The redacted copy receipt precedes the mirror receipt. The source image was never attached to either handset copy.", "id" : "dl3.order.receipt", "title" : "Seal receipt" } ], "title" : "Rebuild the audit order" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "authority to apply rule r-04", "the redaction authority", "delegated authority", "the redaction rule" ], "app" : "contacts", "discovery" : "The RC-2 signature authenticates delegated authority for the redaction rule, not the underlying claims.", "hints" : [ "Read the approval scope on the authority card.", "The signature is for a rule, not the contents of the packet.", "It authenticates authority to apply rule R-04." ], "id" : "dl3-role-signature", "question" : "What does the RC-2 signature authenticate?", "sources" : [ { "app" : "contacts", "body" : "Records counsel · approval scope: apply rule R-04 to protected recipient fields before export.", "id" : "dl3.role.signature", "title" : "Authority card RC-2" }, { "app" : "deaddrop", "body" : "RC-2 signature is valid for the export policy. The individual signer's name was not retained.", "id" : "dl3.role.log", "title" : "Rule application log" }, { "app" : "notes", "body" : "The role signature authenticates delegated authority for the redaction rule. It does not attest to the packet's original claims.", "id" : "dl3.role.limit", "title" : "Signature limit" } ], "title" : "A role signature" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "before the first handset import", "before import", "before local import", "the first local copy was already redacted" ], "app" : "messages", "discovery" : "The first handset copy was already redacted; this review cannot determine what the external source contained.", "hints" : [ "Compare the earliest handset copy with the source-store reference.", "The first local copy already contains the deletion marker.", "The recipient was removed before the first handset import; the original value is unavailable." ], "id" : "dl3-recipient-absence", "question" : "At what stage was the recipient name removed?", "sources" : [ { "app" : "deaddrop", "body" : "The external source is listed as O-17. No source payload was included in this case export.", "id" : "dl3.absence.source", "title" : "Source-store reference" }, { "app" : "mail", "body" : "The earliest handset receipt already has a blank recipient field and deletion marker R-04.", "id" : "dl3.absence.first", "title" : "First local copy" }, { "app" : "notes", "body" : "There is no earlier local version with recipient text. The available evidence cannot establish what the source store contained.", "id" : "dl3.absence.audit", "title" : "Import audit" } ], "title" : "The name never entered the handset" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "hash, import time, and deletion receipt", "digest, import time, expiry result", "integrity and deletion metadata", "object hash, import timestamp, expiry result" ], "app" : "browser", "discovery" : "The closeout should retain the hash, import time, and deletion receipt, not the protected content.", "hints" : [ "Retain only fields needed to verify process.", "The policy calls for integrity and deletion evidence, not content.", "Keep the hash, import timestamp, and completed deletion receipt." ], "id" : "dl3-closeout-fields", "question" : "Which three process fields should the closeout retain?", "sources" : [ { "app" : "browser", "body" : "Retain the object hash, import timestamp, and expiry result. Do not retain deleted personal fields or a duplicate image.", "id" : "dl3.closeout.policy", "title" : "Closeout policy" }, { "app" : "deaddrop", "body" : "Required fields: digest, local import time, completed deletion receipt. Custody events are role-coded.", "id" : "dl3.closeout.schema", "title" : "Audit schema" }, { "app" : "notes", "body" : "The closeout must allow a later auditor to verify integrity and deletion without reconstructing the recipient.", "id" : "dl3.closeout.note", "title" : "Review note" } ], "title" : "The three things worth retaining" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the motive for the redaction", "that a particular person was protected", "why the name was removed", "the individual identity" ], "app" : "vitals", "discovery" : "The archive establishes a rule and role-level approval, but not the redaction's motive or the recipient's identity.", "hints" : [ "Separate the recorded rule from the proposed reason.", "Authority is recorded; motive is not.", "The archive cannot establish the motive or who was protected." ], "id" : "dl3-claim-boundary", "question" : "Which statement exceeds the handset's evidence?", "sources" : [ { "app" : "vitals", "body" : "A row was deleted before import. Rule R-04 was applied by role RC-2. The redacted copy and its mirror have matching digest D0-41.", "id" : "dl3.boundary.facts", "title" : "Verified facts" }, { "app" : "messages", "body" : "'Records counsel removed the recipient to protect a particular person.' The archive records a role and a rule, but not the motive or identity.", "id" : "dl3.boundary.inference", "title" : "Draft interpretation" }, { "app" : "notes", "body" : "State what a source records. Do not infer a person's motive from a role-level signature.", "id" : "dl3.boundary.guide", "title" : "Evidence wording" } ], "title" : "The claim the archive cannot make" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the redacted packet is intact and returned", "intact and returned", "custody and integrity are verified", "the returned copy matches" ], "app" : "deaddrop", "discovery" : "The redacted packet's integrity and return are verified; its withheld identity and original claims remain outside scope.", "hints" : [ "Combine the matching digest with the custody receipt.", "The records establish integrity and return, not truth.", "The redacted packet is intact and returned to the review store." ], "id" : "dl3-final-audit", "question" : "What is the strongest supported conclusion about the returned packet?", "sources" : [ { "app" : "deaddrop", "body" : "The redacted working copy and integrity mirror both match D0-41.", "id" : "dl3.final.hash", "title" : "Returned packet digest" }, { "app" : "mail", "body" : "The packet was returned to the local review store at 14:03. The source image remains outside this device.", "id" : "dl3.final.custody", "title" : "Custody receipt" }, { "app" : "notes", "body" : "Matching digest and custody receipt confirm that this redacted packet is intact and returned. They do not validate its original claims.", "id" : "dl3.final.limit", "title" : "Final review standard" } ], "title" : "The final integrity check" }, "type" : "investigation" }, { "choice" : { "id" : "dl3-closeout-choice", "options" : [ { "consequence" : "You retained process metadata and allowed the redacted working copy to expire.", "id" : "dl3-close-metadata", "response" : "M.: The record remains checkable without becoming a second archive of the private field.", "text" : "Keep the process audit and let the working copy expire." }, { "consequence" : "You returned the mirror with its digest and deletion receipt recorded.", "id" : "dl3-return-mirror", "response" : "HANDLER: Logged. The receipt closes the transfer without retaining another copy.", "text" : "Return the mirror to custody with its digest and expiry receipt." } ], "prompt" : "What does a responsible closeout preserve?" }, "type" : "choice" }, { "body" : "The redacted packet's checksum, role-level authorization, custody, and retention process are verified. The recipient's name was absent before the first handset import. The source image is outside this review, and no identity or motive can be reconstructed from the retained records. The blank row stays blank.", "imageName" : null, "title" : "CASE CLOSED — DEAD LETTER", "type" : "dossier" } ], "id" : "case_04_ch10", "legacyBeatIDs" : [ "case_04_ch10.beat.0", "case_04_ch10.beat.1", "case_04_ch10.beat.2", "case_04_ch10.beat.3", "case_04_ch10.beat.4", "case_04_ch10.beat.5", "case_04_ch10.beat.6", "case_04_ch10.beat.7", "case_04_ch10.beat.8", "case_04_ch10.beat.9" ], "title" : "The Blank Is the Record" } ], "continuationChapterID" : "case_04_ch8", "estimatedPlayTime" : "About 2 hours", "id" : "case_04", "investigationCount" : 28, "isFree" : false, "requiredCompletedCaseID" : "case_03", "synopsis" : "The ledger trail did not end at the station. Reconstruct one returned archive packet, decide what can safely be shared, and leave the physical world out of it.", "tagline" : "A sealed packet came back from a route no one remembers opening.", "title" : "DEAD LETTER" }, { "chapters" : [ { "beatIDs" : [ "case_05_ch0.beat.0", "case_05_ch0.beat.1", "case_05_ch0.beat.2", "case_05_ch0.beat.3", "case_05_ch0.beat.4" ], "beats" : [ { "sender" : "M.", "text" : "A city archivist named Nadia Bell was killed during a break-in at the Bellwether Records Room. Her phone was found in her coat pocket. The case was closed as a burglary gone wrong. Her family asked for one careful review before the handset is sealed.", "type" : "message" }, { "sender" : "HANDLER", "text" : "This is a phone-only review. Every record is an offline copy from Nadia's handset. Don't contact anyone, visit a location, or treat a clue as a real-world instruction.", "type" : "message" }, { "body" : "Owner: Nadia Bell, records conservator. Device recovered by responding officers and copied under warrant. Network access disabled before review. No live accounts, calls, or locations are available from this archive.", "imageName" : null, "title" : "DEVICE INTAKE · NB-17", "type" : "dossier" }, { "sender" : "M.", "text" : "Start with the last confirmed appointment and the message she sent just before it. Which person was she expecting to meet?", "type" : "message" }, { "investigation" : { "answers" : [ "Julian Cross", "Julian", "Cross" ], "app" : "messages", "discovery" : "Nadia's message and original calendar entry identify Julian Cross as the expected visitor.", "hints" : [ "Open the message and the original calendar entry.", "The event names the person Nadia asked to meet.", "She was expecting Julian Cross." ], "id" : "expected-visitor", "question" : "Who was Nadia expecting to meet?", "sources" : [ { "app" : "messages", "body" : "I found the second key. Meet me in the records room at half past eight. Please come alone.", "id" : "lastknown.msg-meet", "title" : "Nadia · 20:42" }, { "app" : "calendarApp", "body" : "Original event: Records room review · 20:30 · Julian Cross. Edited at 20:51.", "id" : "lastknown.calendar-original", "title" : "Calendar · Records review" } ], "title" : "The expected visitor" }, "type" : "investigation" } ], "id" : "case_05_ch0", "legacyBeatIDs" : [ "case_05_ch0.beat.0", "case_05_ch0.beat.1", "case_05_ch0.beat.2", "case_05_ch0.beat.3", "case_05_ch0.beat.4" ], "title" : "Recovered Device" }, { "beatIDs" : [ "case_05_ch1.beat.0", "case_05_ch1.beat.1", "case_05_ch1.beat.2", "case_05_ch1.beat.3", "case_05_ch1.beat.4" ], "beats" : [ { "sender" : "HANDLER", "text" : "Nadia's calendar has two versions of the same evening. The edit history says one entry was changed after her final outgoing message. Identify the original meeting time.", "type" : "message" }, { "investigation" : { "answers" : [ "20:30", "2030" ], "app" : "calendarApp", "discovery" : "The original meeting time was 20:30; the event was changed to 21:15 at 20:51.", "hints" : [ "Read the event's previous start time.", "The message gives the same time in words.", "The original appointment was 20:30." ], "id" : "original-time", "question" : "What time was the meeting originally scheduled? Enter HH:MM.", "sources" : [ { "app" : "calendarApp", "body" : "Records room review. Previous start: 20:30. New start: 21:15. Change saved: 20:51.", "id" : "lastknown.calendar-edit", "title" : "Event edit history" }, { "app" : "messages", "body" : "20:42 · I found the second key. Meet me in the records room at half past eight.", "id" : "lastknown.msg-send", "title" : "Nadia · sent message" } ], "title" : "The original appointment" }, "type" : "investigation" }, { "body" : "The appointment was moved from 20:30 to 21:15. Nadia's message was sent at 20:42. The later calendar time cannot explain why she was already waiting at the records room.", "imageName" : null, "title" : "TIMELINE NOTE", "type" : "dossier" }, { "sender" : "M.", "text" : "A changed appointment is a lead, not proof of a crime. Check whether the phone was with Nadia when the edit was made.", "type" : "message" }, { "investigation" : { "answers" : [ "phone", "recent calls", "outgoing call" ], "app" : "phone", "discovery" : "The handset made an outgoing call at 20:47, four minutes before the appointment was edited.", "hints" : [ "Read the call log and compare its time to the edit.", "The outgoing call is four minutes before the event change.", "The Phone recent-calls record shows the handset active at 20:47." ], "id" : "device-holder", "question" : "Which app record confirms the handset was active before the calendar edit?", "sources" : [ { "app" : "phone", "body" : "20:47 · Nadia Bell → Records Room desk extension · connected · 00:18.", "id" : "lastknown.phone-outgoing", "title" : "Recent calls · outgoing" }, { "app" : "calendarApp", "body" : "Records room review changed at 20:51 from this handset. The edit did not change the event owner.", "id" : "lastknown.calendar-edit2", "title" : "Event edit history" } ], "title" : "Was Nadia's phone with her?" }, "type" : "investigation" } ], "id" : "case_05_ch1", "legacyBeatIDs" : [ "case_05_ch1.beat.0", "case_05_ch1.beat.1", "case_05_ch1.beat.2", "case_05_ch1.beat.3", "case_05_ch1.beat.4" ], "title" : "The Appointment" }, { "beatIDs" : [ "case_05_ch2.beat.0", "case_05_ch2.beat.1", "case_05_ch2.beat.2", "case_05_ch2.beat.3", "case_05_ch2.beat.4" ], "beats" : [ { "sender" : "HANDLER", "text" : "The handset's local screen-time record and Nadia's note disagree about who had the phone. Reconcile the timestamps before you accuse anyone.", "type" : "message" }, { "investigation" : { "answers" : [ "3", "three" ], "app" : "notes", "discovery" : "The calendar edit occurred during a three-minute unlocked session while Nadia had set the phone down.", "hints" : [ "Use the unlock and lock times in the local audit.", "Subtract 20:50 from 20:53.", "The handset was unlocked for three minutes." ], "id" : "screen-time", "question" : "How long was the handset unlocked during the edit window? Enter the number of minutes.", "sources" : [ { "app" : "notes", "body" : "Left phone on the blue desk at 20:49. Came back at 20:54. The screen was awake, calendar open.", "id" : "lastknown.note-session", "title" : "Nadia · pocket note" }, { "app" : "calendarApp", "body" : "Appointment changed at 20:51. Screen unlock: 20:50. Screen locked: 20:53.", "id" : "lastknown.calendar-audit", "title" : "Local edit audit" } ], "title" : "The borrowed minute" }, "type" : "investigation" }, { "answer" : "mcpb", "prompt" : "Nadia saved a short index in Notes: use the first letter of each confirmed source — Messages, Calendar, Phone, Browser. Enter the four-letter index.", "type" : "cipher" }, { "sender" : "M.", "text" : "The index opens the saved browser cache. It's a read-only export from the phone, not a live website.", "type" : "message" }, { "investigation" : { "answers" : [ "duplicate archive key register", "duplicate keys", "archive key register" ], "app" : "browser", "discovery" : "Nadia searched the offline browser cache for the duplicate archive key register.", "hints" : [ "Read the cached search and Nadia's note about the keys.", "The search refers to a second or duplicate key.", "She searched for the duplicate archive key register." ], "id" : "cached-search", "question" : "What did Nadia search for before the appointment was changed?", "sources" : [ { "app" : "browser", "body" : "Search: duplicate archive key register. Saved result: Bellwether Records Room access policy.", "id" : "lastknown.browser-cache", "title" : "Offline cache · 20:36" }, { "app" : "notes", "body" : "Two keys issued. One assigned to me, one to Julian. Register copy has a different last digit than the intake sheet.", "id" : "lastknown.note-key", "title" : "Nadia · work note" } ], "title" : "A cached search" }, "type" : "investigation" } ], "id" : "case_05_ch2", "legacyBeatIDs" : [ "case_05_ch2.beat.0", "case_05_ch2.beat.1", "case_05_ch2.beat.2", "case_05_ch2.beat.3", "case_05_ch2.beat.4" ], "title" : "A Borrowed Minute" }, { "beatIDs" : [ "case_05_ch3.beat.0", "case_05_ch3.beat.1", "case_05_ch3.beat.2", "case_05_ch3.beat.3", "case_05_ch3.beat.4" ], "beats" : [ { "sender" : "HANDLER", "text" : "One witness said they were across town when Nadia's phone was used to change the appointment. Compare the cached trip receipt with the call log. Which claim fails?", "type" : "message" }, { "investigation" : { "answers" : [ "20:47 call", "records desk call", "records room desk call" ], "app" : "phone", "discovery" : "The 20:47 records-desk call and the 20:51 edit contradict the timeline in Julian's statement.", "hints" : [ "Compare the call log with Julian's statement and saved receipt.", "The statement places him away before the handset's 20:51 calendar change.", "The 20:47 records-desk call falls inside the disputed window." ], "id" : "alibi-window", "question" : "Which call overlaps Julian's claimed location window?", "sources" : [ { "app" : "phone", "body" : "20:47 · outgoing call from Nadia's handset to the records room desk extension · connected for 18 seconds.", "id" : "lastknown.phone-call", "title" : "Recent calls · records desk" }, { "app" : "browser", "body" : "Julian Cross's ticket receipt shows purchase at 21:02. In his statement he said he was already on the 20:40 train when Nadia's appointment changed at 20:51.", "id" : "lastknown.browser-receipt", "title" : "Saved transit receipt" } ], "title" : "The alibi window" }, "type" : "investigation" }, { "body" : "A handset can establish that a record exists and when it was saved. It cannot identify a person by itself. Keep the difference between device evidence and identity evidence clear.", "imageName" : null, "title" : "ALIBI CHECK", "type" : "dossier" }, { "sender" : "M.", "text" : "The false time window points to someone with access to the office and the phone. Nadia's draft names the person she planned to confront.", "type" : "message" }, { "investigation" : { "answers" : [ "Julian Cross", "Julian", "Cross" ], "app" : "messages", "discovery" : "Nadia's unsent draft says she planned to confront Julian about the duplicate key register.", "hints" : [ "Open Nadia's draft and the contact's work card.", "The draft begins with the name she planned to address.", "Nadia planned to confront Julian Cross." ], "id" : "draft-name", "question" : "Who did Nadia plan to confront about the duplicate key?", "sources" : [ { "app" : "messages", "body" : "Julian — I checked the duplicate key register against intake. We need to talk before you leave tonight.", "id" : "lastknown.msg-draft", "title" : "Draft · unsent" }, { "app" : "contacts", "body" : "Records archivist. Assigned key: B-17. Emergency contact details withheld from this review.", "id" : "lastknown.contacts-key", "title" : "Julian Cross · work contact" } ], "title" : "The unsent draft" }, "type" : "investigation" } ], "id" : "case_05_ch3", "legacyBeatIDs" : [ "case_05_ch3.beat.0", "case_05_ch3.beat.1", "case_05_ch3.beat.2", "case_05_ch3.beat.3", "case_05_ch3.beat.4" ], "title" : "The False Alibi" }, { "beatIDs" : [ "case_05_ch4.beat.0", "case_05_ch4.beat.1", "case_05_ch4.beat.2" ], "beats" : [ { "sender" : "HANDLER", "text" : "You have a changed appointment, a handset-use window, and a failed alibi. Before the final report, separate the facts from the inference.", "type" : "message" }, { "investigation" : { "answers" : [ "timeline", "device timeline", "the device timeline", "records establish device activity" ], "app" : "notes", "discovery" : "The phone establishes its activity timeline; identifying the person who held it requires independent evidence.", "hints" : [ "Compare the exact timeline with the case review standard.", "One statement is a timestamped record; another would claim a person's identity.", "The handset directly establishes its own activity timeline." ], "id" : "sequence", "question" : "Which statement is directly established by this handset's records?", "sources" : [ { "app" : "notes", "body" : "20:42 message sent · 20:47 outgoing call · 20:50 screen unlocked · 20:51 appointment edited · 20:53 screen locked.", "id" : "lastknown.report-timeline", "title" : "Verified timeline" }, { "app" : "browser", "body" : "Device records establish activity on a device. Without independent identification, they do not prove who held it or establish cause of death.", "id" : "lastknown.report-limit", "title" : "Case review standard" } ], "title" : "Fact, inference, or unknown?" }, "type" : "investigation" }, { "choice" : { "id" : "last-known-report", "options" : [ { "consequence" : "You named the strongest suspect as a lead and clearly marked the need for independent corroboration.", "id" : "corroborate", "response" : "M.: That's a defensible lead. The records justify reopening the case; independent evidence must establish identity and cause.", "text" : "Name the suspect and request independent corroboration." }, { "consequence" : "You kept the report to facts the handset can establish and left identity for independent evidence.", "id" : "device-only", "response" : "M.: Careful and accurate. The timeline stands on its own; investigators can compare it with evidence outside this handset.", "text" : "Report only the verified device timeline." } ], "prompt" : "The records support a suspect, but the handset cannot identify who held it at every moment. What goes into the report?" }, "type" : "choice" } ], "id" : "case_05_ch4", "legacyBeatIDs" : [ "case_05_ch4.beat.0", "case_05_ch4.beat.1", "case_05_ch4.beat.2" ], "title" : "What the Phone Can Prove" }, { "beatIDs" : [ "case_05_ch5.beat.0", "case_05_ch5.beat.1", "case_05_ch5.beat.2", "case_05_ch5.beat.3" ], "beats" : [ { "sender" : "HANDLER", "text" : "The corrected timeline is consistent across Nadia's calendar, messages, call log and saved browser records. One account of the evening does not fit.", "type" : "message" }, { "body" : "The phone records establish that Nadia expected archivist Julian Cross at 20:30; the appointment was later moved using the handset during a window when Cross claimed to be elsewhere. Nadia's unsent draft says she planned to confront him about duplicate archive keys. Together these records support reopening the burglary investigation. They do not, on their own, prove who caused Nadia's death. Your report preserves that distinction.", "imageName" : null, "title" : "CASE REVIEW — NADIA BELL", "type" : "dossier" }, { "sender" : "M.", "text" : "Her phone couldn't tell us everything. It told us enough to stop treating the first explanation as the only one. You did right by Nadia.", "type" : "message" }, { "body" : "The handset-only review reconstructed Nadia Bell's final evening, exposed an alibi contradiction and identified a credible investigative lead. The report records what the phone proves, what it suggests, and what still requires independent evidence.", "imageName" : null, "title" : "CASE CLOSED — LAST KNOWN", "type" : "dossier" } ], "id" : "case_05_ch5", "legacyBeatIDs" : [ "case_05_ch5.beat.0", "case_05_ch5.beat.1", "case_05_ch5.beat.2", "case_05_ch5.beat.3" ], "title" : "Last Known" }, { "beatIDs" : [ "case_05_ch6.beat.0", "case_05_ch6.beat.1", "case_05_ch6.beat.2", "case_05_ch6.beat.3", "case_05_ch6.beat.4", "case_05_ch6.beat.5", "case_05_ch6.beat.6", "case_05_ch6.beat.7" ], "beats" : [ { "sender" : "M.", "text" : "The second key from Nadia's draft was checked after the first review. The inventory copy lists a room access card with a serial that doesn't match intake.", "type" : "message" }, { "investigation" : { "answers" : [ "b18", "b-18", "b 18" ], "app" : "notes", "discovery" : "The intake sheet omits duplicate key B-18, assigned to Julian Cross; its return field is blank.", "hints" : [ "Compare the register with the intake sheet.", "The unlisted serial is the duplicate key assigned to Julian.", "B-18 is missing from intake." ], "id" : "key-register", "question" : "Which serial was missing from the intake sheet?", "sources" : [ { "app" : "notes", "body" : "Master key B-17 · Nadia Bell. Duplicate key B-18 · Julian Cross. Intake sheet lists only B-17; the handwritten correction is dated the morning after the incident.", "id" : "lastknown2.notes-register", "title" : "Key register · local copy" }, { "app" : "contacts", "body" : "Nadia signed for B-17. Julian signed for B-18. Both signatures are present; the return field for B-18 is blank.", "id" : "lastknown2.contacts-keys", "title" : "Custody roster" } ], "title" : "The duplicate key register" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "21:07", "2107" ], "app" : "calendarApp", "discovery" : "Credential B-18 was accepted at 21:07 on the following evening; the log does not identify its holder.", "hints" : [ "Read the reader audit's event time.", "The event occurred before the original 20:30 appointment? Check the displayed date: this is the following evening.", "The credential was presented at 21:07." ], "id" : "access-window", "question" : "At what time was the archive reader used?", "sources" : [ { "app" : "calendarApp", "body" : "Local access reader: credential B-18 presented at 21:07. Door result: accepted. No camera identification is attached.", "id" : "lastknown2.calendar-reader", "title" : "Reader audit · NB-17" }, { "app" : "messages", "body" : "Julian — I found the second key. Meet me in the records room at half past eight.", "id" : "lastknown2.phone-draft", "title" : "Nadia · unsent draft" } ], "title" : "The access window" }, "type" : "investigation" }, { "body" : "The recovered card was used once after Nadia's final message. That proves the card was presented to the reader; it does not prove who carried it or who entered the room.", "imageName" : null, "title" : "ACCESS AUDIT", "type" : "dossier" }, { "investigation" : { "answers" : [ "1", "one", "once" ], "app" : "phone", "discovery" : "The retained export shows one accepted B-18 event and two denials, without identifying the person who presented it.", "hints" : [ "Count only the events marked accepted.", "Two entries are denied; one is accepted.", "There was one accepted use." ], "id" : "reader-log", "question" : "How many times was credential B-18 accepted in the retained log?", "sources" : [ { "app" : "phone", "body" : "20:58 · denied · B-18. 21:07 · accepted · B-18. 21:19 · denied · B-18. Only the accepted event opened the archive door.", "id" : "lastknown2.phone-reader-log", "title" : "Door reader export" }, { "app" : "notes", "body" : "The export stores credential outcomes. It has no camera, biometric match or name attached to an event.", "id" : "lastknown2.notes-reader-limit", "title" : "Reader limitation" } ], "title" : "One accepted credential" }, "type" : "investigation" }, { "answer" : "2107", "prompt" : "The audit card groups the reader's final four digits by hour then minute. Enter the logged minute, 21:07.", "type" : "cipher" }, { "investigation" : { "answers" : [ "report and disable it", "report it and disable it", "disable the credential", "report, disable, and review the log" ], "app" : "browser", "discovery" : "The policy required B-18 to be reported and disabled, but the handset only contains an unsubmitted draft.", "hints" : [ "Read the policy, then check whether the draft was submitted.", "The required actions are reporting, disabling and reviewing the log.", "The policy requires a report, credential disablement and log review." ], "id" : "duplicate-key", "question" : "What does the policy say must happen when a duplicate key is missing?", "sources" : [ { "app" : "browser", "body" : "A missing credential must be reported, disabled, and reviewed against the access log. A name on the issue register is not proof that the assigned person used it.", "id" : "lastknown2.browser-policy", "title" : "Offline access policy" }, { "app" : "mail", "body" : "The B-18 missing-key report was saved but not submitted. The signature field is blank; author metadata was stripped in the export.", "id" : "lastknown2.mail-key-report", "title" : "Incident intake · draft" } ], "title" : "The key policy" }, "type" : "investigation" }, { "sender" : "HANDLER", "text" : "The key register and reader log give us a stronger lead on access, but no single record tells us who was at the door.", "type" : "message" } ], "id" : "case_05_ch6", "legacyBeatIDs" : [ "case_05_ch6.beat.0", "case_05_ch6.beat.1", "case_05_ch6.beat.2", "case_05_ch6.beat.3", "case_05_ch6.beat.4", "case_05_ch6.beat.5", "case_05_ch6.beat.6", "case_05_ch6.beat.7" ], "title" : "The Archive Door" }, { "beatIDs" : [ "case_05_ch7.beat.0", "case_05_ch7.beat.1", "case_05_ch7.beat.2", "case_05_ch7.beat.3", "case_05_ch7.beat.4", "case_05_ch7.beat.5" ], "beats" : [ { "investigation" : { "answers" : [ "the duplicate key", "that he did not have the duplicate key", "which key nadia had" ], "app" : "messages", "discovery" : "Julian's revised statement removes his categorical denial about the duplicate key and adds uncertainty about Nadia's keys.", "hints" : [ "Compare the second sentence in both statements.", "The revised copy removes a categorical statement about the key.", "He no longer says he did not have the duplicate key." ], "id" : "statement-change", "question" : "Which detail was removed from the revised statement?", "sources" : [ { "app" : "messages", "body" : "I left before eight and did not have the duplicate key. Nadia had both keys when I saw her.", "id" : "lastknown2.messages-statement-first", "title" : "Julian · first statement" }, { "app" : "messages", "body" : "I left before eight. I do not remember which key Nadia had.", "id" : "lastknown2.messages-statement-revised", "title" : "Julian · revised statement" }, { "app" : "notes", "body" : "The sentence about not having the duplicate key was removed. The new copy adds uncertainty about which key Nadia had.", "id" : "lastknown2.notes-revision", "title" : "Statement revision log" } ], "title" : "The second statement" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the backup matches", "matching hash", "the files match", "unchanged copy" ], "app" : "browser", "discovery" : "The compared backup matches the recovered copy by checksum, supporting integrity but not authorship or truth.", "hints" : [ "Compare the two checksum suffixes.", "Both end in 9C71.", "The backup file matches; that confirms integrity, not the truth of its contents." ], "id" : "backup-integrity", "question" : "What does the backup comparison confirm?", "sources" : [ { "app" : "browser", "body" : "SHA-256 suffix 9C71 · created 18:02 · calendar event at 20:30 · key note includes B-18.", "id" : "lastknown2.browser-backup-a", "title" : "Local backup · before incident" }, { "app" : "browser", "body" : "SHA-256 suffix 9C71 · imported under warrant · calendar edit and message draft present.", "id" : "lastknown2.browser-backup-b", "title" : "Recovered handset · after incident" }, { "app" : "notes", "body" : "Matching hashes confirm the compared backup file is unchanged. They do not authenticate every event described in that file.", "id" : "lastknown2.notes-backup-limit", "title" : "Forensic review note" } ], "title" : "The untouched backup" }, "type" : "investigation" }, { "choice" : { "id" : "last-known-family-report", "options" : [ { "consequence" : "You shared Nadia's verified timeline and clearly marked the access lead as unproven.", "id" : "share-limited", "response" : "M.: They deserve what the handset can tell them, with the limit right beside it.", "text" : "Share the timeline and mark the access lead unproven." }, { "consequence" : "You shared the verified device chronology and left names to investigators.", "id" : "hold-names", "response" : "HANDLER: A careful line. The family gets the chronology without being asked to carry an accusation.", "text" : "Share the device timeline only; hold the names for investigators." } ], "prompt" : "Nadia's family asks for the archive review. What can you share?" }, "type" : "choice" }, { "investigation" : { "answers" : [ "that julian caused nadia's death", "who caused nadia's death", "identity of the person at the door", "the suspect's identity" ], "app" : "vitals", "discovery" : "The device archive cannot identify the credential holder or prove who caused Nadia's death.", "hints" : [ "Separate the timestamped access record from the draft accusation.", "The log records a credential, not a person or a death.", "The handset cannot establish who caused Nadia's death." ], "id" : "final-boundary", "question" : "Which conclusion is outside the handset's evidence?", "sources" : [ { "app" : "vitals", "body" : "B-18 was accepted once at 21:07. The access record has no camera match. The revised statement removes a denial about the key.", "id" : "lastknown2.vitals-facts", "title" : "Verified facts" }, { "app" : "notes", "body" : "‘Julian entered the archive and caused Nadia's death.’ No source on this handset identifies the credential holder or cause of death.", "id" : "lastknown2.notes-conclusion", "title" : "Draft report" } ], "title" : "What the handset cannot say" }, "type" : "investigation" }, { "body" : "The archived key register and reader log support a possible access link. A changed statement and intact backup strengthen the investigative lead, but no handset record identifies the person at the door or proves cause of death. Nadia's family receives the verified chronology; the identity question remains with investigators.", "imageName" : null, "title" : "SUPPLEMENTAL REVIEW — NADIA BELL", "type" : "dossier" }, { "sender" : "M.", "text" : "That is a report that can help without pretending the phone solved a murder by itself. Nadia's file is ready to be returned to investigators.", "type" : "message" } ], "id" : "case_05_ch7", "legacyBeatIDs" : [ "case_05_ch7.beat.0", "case_05_ch7.beat.1", "case_05_ch7.beat.2", "case_05_ch7.beat.3", "case_05_ch7.beat.4", "case_05_ch7.beat.5" ], "title" : "The Second Statement" }, { "beatIDs" : [ "case_05_ch8.beat.0", "case_05_ch8.beat.1", "case_05_ch8.beat.2", "case_05_ch8.beat.3", "case_05_ch8.beat.4", "case_05_ch8.beat.5", "case_05_ch8.beat.6", "case_05_ch8.beat.7" ], "beats" : [ { "sender" : "M.", "text" : "The original handset review exposed a gap in the key register. Nadia's backup has now been authenticated. We can examine access more closely, but a credential is still not a person.", "type" : "message" }, { "body" : "This is a closed-circle review of Nadia Bell's recovered phone. All records are offline copies. No one is contacted, no location is queried, and no external case database is used.", "imageName" : null, "title" : "SUPPLEMENT 05-A · DEVICE EVIDENCE", "type" : "dossier" }, { "investigation" : { "answers" : [ "arc-4", "evening archive supervisor", "the evening archive supervisor" ], "app" : "contacts", "discovery" : "B-18 was issued under role code ARC-4; the handset does not identify who physically held it.", "hints" : [ "Read the issue record before the role roster.", "The register contains a role code, not an employee name.", "Key B-18 was signed out under role code ARC-4." ], "id" : "lk3-key-issue", "question" : "Which role code signed out key B-18?", "sources" : [ { "app" : "contacts", "body" : "Duplicate key B-18 was issued to role code ARC-4 at 18:12. The recipient's personal name field is blank.", "id" : "lk3.key.issue", "title" : "Key register · issue" }, { "app" : "browser", "body" : "ARC-4 is assigned to the evening archive supervisor. The roster does not list who held that shift on the incident date.", "id" : "lk3.key.roster", "title" : "Role roster" }, { "app" : "notes", "body" : "Role assignment can narrow who had permission to check out a key. It cannot establish who physically carried it.", "id" : "lk3.key.policy", "title" : "Key policy" } ], "title" : "Who signed out the duplicate?" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "12", "12 minutes", "twelve" ], "app" : "calendarApp", "discovery" : "The digital entry was saved twelve minutes after the paper time; the physical return time remains 21:19 on the signed slip.", "hints" : [ "Compare 21:19 with 21:31.", "The digital entry was saved twelve minutes later.", "The entry was saved 12 minutes after the paper return time." ], "id" : "lk3-key-return", "question" : "How many minutes after the recorded return time was the entry saved?", "sources" : [ { "app" : "calendarApp", "body" : "B-18 returned at 21:19. The signature box contains the initials J.C.", "id" : "lk3.return.paper", "title" : "Paper return slip" }, { "app" : "phone", "body" : "The digital return entry was saved at 21:31, twelve minutes after the paper time. The phone's edit log shows the archive terminal as the device.", "id" : "lk3.return.digital", "title" : "Local register edit" }, { "app" : "notes", "body" : "A late save can reflect delayed entry. It does not prove the key remained outside the cabinet for the additional twelve minutes.", "id" : "lk3.return.limit", "title" : "Register note" } ], "title" : "A return entered late" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "3", "three", "3 minutes" ], "app" : "vitals", "discovery" : "The west-door reader ran three minutes fast, so its 21:07 event corrects to 21:04.", "hints" : [ "Compare the reader with the master clock.", "21:07 minus 21:04 is three minutes.", "The west-door reader ran three minutes fast." ], "id" : "lk3-reader-offset", "question" : "How many minutes fast was the west-door reader?", "sources" : [ { "app" : "vitals", "body" : "West-door reader: 21:07. Master clock comparison: 21:04. Offset marked stable during the week.", "id" : "lk3.reader.audit", "title" : "Door reader audit" }, { "app" : "mail", "body" : "No device reset or battery fault is recorded on the incident date.", "id" : "lk3.reader.service", "title" : "Reader maintenance" }, { "app" : "notes", "body" : "Subtract the reader's known offset before comparing its event to Nadia's phone timeline.", "id" : "lk3.reader.rule", "title" : "Correction rule" } ], "title" : "The reader's clock" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "b-18 was accepted at the reader", "the credential was accepted", "a credential event", "key b-18 was accepted" ], "app" : "phone", "discovery" : "Credential B-18 was accepted at the west door at corrected time 21:04; the holder is unknown.", "hints" : [ "State what the reader itself records.", "The log identifies a credential, not a human.", "It proves that credential B-18 was accepted at the reader." ], "id" : "lk3-card-use", "question" : "What does the 21:07 reader event prove?", "sources" : [ { "app" : "phone", "body" : "B-18 accepted at the west door at 21:07 reader time. No corresponding camera frame was retained.", "id" : "lk3.card.event", "title" : "Credential event" }, { "app" : "vitals", "body" : "Corrected time is 21:04. Reader logs record credential acceptance, not the holder's identity.", "id" : "lk3.card.clock", "title" : "Clock correction" }, { "app" : "notes", "body" : "A credential can be borrowed, copied, or presented by someone else. The record does not prove the assigned role-holder was present.", "id" : "lk3.card.limit", "title" : "Access review standard" } ], "title" : "A card event, not an entry" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "8", "8 minutes", "eight minutes" ], "app" : "messages", "discovery" : "The archive terminal was unlocked for eight minutes under a role credential; the user is not identified.", "hints" : [ "Subtract 20:58 from 21:06.", "The interval is eight minutes.", "The terminal remained unlocked for eight minutes." ], "id" : "lk3-office-unlock", "question" : "How long was the archive terminal unlocked?", "sources" : [ { "app" : "messages", "body" : "Archive terminal A-12 unlocked at 20:58 under supervisor role ARC-4.", "id" : "lk3.session.open", "title" : "Terminal audit · unlock" }, { "app" : "calendarApp", "body" : "A-12 relocked at 21:06. The session contains one calendar edit and a read-only key search.", "id" : "lk3.session.close", "title" : "Terminal audit · relock" }, { "app" : "notes", "body" : "The session is associated with a role credential. No face unlock or individual login is recorded.", "id" : "lk3.session.note", "title" : "Session limitation" } ], "title" : "A desk session left open" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "duplicate-key register", "key register", "the duplicate key register" ], "app" : "browser", "discovery" : "The terminal history shows a read-only search of the duplicate-key register.", "hints" : [ "Read the local terminal history.", "The session opened a specific register, not a live site.", "The duplicate-key register was opened." ], "id" : "lk3-terminal-search", "question" : "Which record category was opened during the terminal session?", "sources" : [ { "app" : "browser", "body" : "At 21:02, the user opened the duplicate-key register. No network request or external database access appears.", "id" : "lk3.search.history", "title" : "Local terminal history" }, { "app" : "calendarApp", "body" : "The same eight-minute session includes one calendar edit and a read-only key search.", "id" : "lk3.search.session", "title" : "Session summary" }, { "app" : "notes", "body" : "Local history names a record category. It does not show which page content was read or who was at the terminal.", "id" : "lk3.search.standard", "title" : "History limitation" } ], "title" : "What was searched" }, "type" : "investigation" } ], "id" : "case_05_ch8", "legacyBeatIDs" : [ "case_05_ch8.beat.0", "case_05_ch8.beat.1", "case_05_ch8.beat.2", "case_05_ch8.beat.3", "case_05_ch8.beat.4", "case_05_ch8.beat.5", "case_05_ch8.beat.6", "case_05_ch8.beat.7" ], "title" : "The Key Log" }, { "beatIDs" : [ "case_05_ch9.beat.0", "case_05_ch9.beat.1", "case_05_ch9.beat.2", "case_05_ch9.beat.3", "case_05_ch9.beat.4", "case_05_ch9.beat.5", "case_05_ch9.beat.6", "case_05_ch9.beat.7", "case_05_ch9.beat.8" ], "beats" : [ { "sender" : "HANDLER", "text" : "Julian's first statement and the later correction are both in the handset. Compare them with the meeting draft, but don't treat a changed sentence as proof of a killing.", "type" : "message" }, { "body" : "The device contains drafts and local message copies, not sworn testimony. The review can identify inconsistencies and timing; it cannot establish motive or cause of death.", "imageName" : null, "title" : "SUPPLEMENT 05-B · STATEMENT AUDIT", "type" : "dossier" }, { "investigation" : { "answers" : [ "before eight", "before 20:00", "before 8 pm", "before 8" ], "app" : "messages", "discovery" : "The first draft places Julian away before 20:00, but the phone has no independent travel record for that claim.", "hints" : [ "Read the exact time claim in the first statement.", "It uses a broad phrase, not an exact timestamp.", "Julian's first draft says he left before eight." ], "id" : "lk3-statement-window", "question" : "What time did Julian's first saved statement place him away from the archive?", "sources" : [ { "app" : "messages", "body" : "'I left the west district before eight and did not return that evening.' Saved at 22:11.", "id" : "lk3.statement.first", "title" : "Statement draft · first" }, { "app" : "calendarApp", "body" : "The draft appointment shows a 20:30 meeting at the archive. It was edited at 20:51 on Nadia's phone.", "id" : "lk3.statement.calendar", "title" : "Calendar copy" }, { "app" : "notes", "body" : "The statement says 'before eight' but supplies no independent travel record for the time.", "id" : "lk3.statement.note", "title" : "Review note" } ], "title" : "The meeting window" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the denial of key use", "that he never used the key", "never used b-18", "the key-use denial" ], "app" : "mail", "discovery" : "The later draft withdraws the categorical denial of key use, but the handset cannot identify its author.", "hints" : [ "Compare the specific sentence in both copies.", "The later version no longer denies all use after 19:00.", "The revision withdraws the denial of key use." ], "id" : "lk3-statement-correction", "question" : "Which part did the later statement withdraw?", "sources" : [ { "app" : "mail", "body" : "'I never used the west-door key after 19:00.' Signed in the local draft at 22:11.", "id" : "lk3.correction.first", "title" : "Statement · first copy" }, { "app" : "mail", "body" : "'I did not personally carry B-18. I cannot speak to who presented it.' The denial of key use is removed.", "id" : "lk3.correction.second", "title" : "Statement · revision" }, { "app" : "browser", "body" : "The change was saved at 23:06. The device does not record who typed the revision.", "id" : "lk3.correction.audit", "title" : "Revision audit" } ], "title" : "The sentence that changed" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the recipient device accepted the message", "delivered to the device", "device delivery", "the message was delivered" ], "app" : "phone", "discovery" : "Nadia's message was delivered to a device, with no read receipt or response.", "hints" : [ "Look at the receipt status, not the message's meaning.", "There is no read receipt or reply.", "The recipient device accepted the message; the archive does not prove a person read it." ], "id" : "lk3-message-delivery", "question" : "What does the message receipt confirm?", "sources" : [ { "app" : "messages", "body" : "'I found the second key. Meet me in the records room at half past eight. Please come alone.' Status: delivered.", "id" : "lk3.delivery.message", "title" : "Nadia · 20:42" }, { "app" : "phone", "body" : "Delivery accepted by the recipient device at 20:42. Read receipt is disabled; no response appears in this archive.", "id" : "lk3.delivery.receipt", "title" : "Carrier mirror" }, { "app" : "notes", "body" : "Delivery confirms a receiving device accepted the message. It does not prove a person read it or agreed to meet.", "id" : "lk3.delivery.note", "title" : "Message standard" } ], "title" : "Sent is not read" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "20:47", "2047" ], "app" : "browser", "discovery" : "Nadia's unsent confrontation draft was last saved at 20:47.", "hints" : [ "Use the local last-saved time.", "The draft was saved before the calendar edit.", "Nadia last saved the draft at 20:47." ], "id" : "lk3-draft-save-time", "question" : "At what time was Nadia's confrontation draft last saved?", "sources" : [ { "app" : "browser", "body" : "Draft title: 'Second key · Julian'. Last saved 20:47. The draft has no recipient address.", "id" : "lk3.draft.browser", "title" : "Local search cache" }, { "app" : "notes", "body" : "'Ask about the duplicate key before I show him the register.' No claim that the draft was sent is present.", "id" : "lk3.draft.notes", "title" : "Nadia's margin" }, { "app" : "vitals", "body" : "No outgoing message matches the draft text. The local save event is intact.", "id" : "lk3.draft.audit", "title" : "Draft audit" } ], "title" : "The unsent draft's save time" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "nb-17", "nadia's handset", "the recovered handset", "her phone" ], "app" : "calendarApp", "discovery" : "Handset NB-17 made the calendar edit during its three-minute unlocked window; the user is not identified.", "hints" : [ "Read the editor-device field.", "The handset unlocked in the same interval.", "Device NB-17 made the edit; the person at the screen is unknown." ], "id" : "lk3-calendar-edit-device", "question" : "Which device identifier made the 20:51 calendar edit?", "sources" : [ { "app" : "calendarApp", "body" : "Event changed from 20:30 to 21:15 at 20:51. Editor device: Nadia's handset NB-17.", "id" : "lk3.edit.audit", "title" : "Calendar revision log" }, { "app" : "phone", "body" : "The screen unlocked at 20:50 and locked at 20:53. The log identifies the device state, not the person holding it.", "id" : "lk3.edit.lock", "title" : "Unlock record" }, { "app" : "notes", "body" : "A local edit proves that the handset made a change during the interval. It does not prove Nadia or another person typed it.", "id" : "lk3.edit.limit", "title" : "Device evidence standard" } ], "title" : "The device that made the edit" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "1", "one minute", "one" ], "app" : "calculator", "discovery" : "The calendar edit occurred one minute after unlock, during a three-minute handset session.", "hints" : [ "Compare 20:50 with 20:51.", "The edit occurred one minute after unlock.", "One minute elapsed before the edit." ], "id" : "lk3-time-gap", "question" : "How many minutes elapsed between unlock and the calendar edit?", "sources" : [ { "app" : "phone", "body" : "The screen unlocked at 20:50.", "id" : "lk3.gap.unlock", "title" : "Unlock event" }, { "app" : "calendarApp", "body" : "The appointment changed at 20:51.", "id" : "lk3.gap.edit", "title" : "Calendar edit" }, { "app" : "notes", "body" : "The screen locked at 20:53. The local audit has minute-level precision.", "id" : "lk3.gap.lock", "title" : "Lock event" } ], "title" : "The unlocked window" }, "type" : "investigation" }, { "answer" : "0830", "prompt" : "The saved report key uses the month and day of the original appointment. Enter the four digits for 30 August.", "type" : "cipher" } ], "id" : "case_05_ch9", "legacyBeatIDs" : [ "case_05_ch9.beat.0", "case_05_ch9.beat.1", "case_05_ch9.beat.2", "case_05_ch9.beat.3", "case_05_ch9.beat.4", "case_05_ch9.beat.5", "case_05_ch9.beat.6", "case_05_ch9.beat.7", "case_05_ch9.beat.8" ], "title" : "The Revised Statement" }, { "beatIDs" : [ "case_05_ch10.beat.0", "case_05_ch10.beat.1", "case_05_ch10.beat.2", "case_05_ch10.beat.3", "case_05_ch10.beat.4", "case_05_ch10.beat.5", "case_05_ch10.beat.6", "case_05_ch10.beat.7", "case_05_ch10.beat.8", "case_05_ch10.beat.9" ], "beats" : [ { "sender" : "M.", "text" : "The family asked for a final supplement. The records strengthen a lead, but they still don't name the person at the door. Separate the chronology, the credential, and the inference before you return Nadia's phone.", "type" : "message" }, { "body" : "The final report is limited to records recovered from handset NB-17 and its authenticated local backup. No live services, external identities, or physical evidence are available to this reviewer.", "imageName" : null, "title" : "SUPPLEMENT 05-C · FINAL REPORT", "type" : "dossier" }, { "investigation" : { "answers" : [ "snapshot a", "a", "the 20:44 backup" ], "app" : "browser", "discovery" : "Snapshot A preserves the pre-edit calendar state; Snapshot B contains the later change.", "hints" : [ "Compare each snapshot time to 20:51.", "20:44 is before the edit; 21:04 is after it.", "Snapshot A was created before the calendar edit." ], "id" : "lk3-backup-sequence", "question" : "Which backup was created before the 20:51 calendar edit?", "sources" : [ { "app" : "browser", "body" : "Snapshot A created at 20:44. Snapshot B created at 21:04. Both are local device backups under the recovery warrant.", "id" : "lk3.backup.index", "title" : "Backup index" }, { "app" : "calendarApp", "body" : "The appointment edit occurred at 20:51 on NB-17.", "id" : "lk3.backup.edit", "title" : "Calendar revision" }, { "app" : "notes", "body" : "Snapshot A predates the edit. Snapshot B includes the changed appointment. Their hashes match the recovery inventory.", "id" : "lk3.backup.hash", "title" : "Integrity note" } ], "title" : "The backup sequence" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the ledger scan", "duplicate-key ledger scan", "the attached image", "the key ledger" ], "app" : "mail", "discovery" : "Nadia's ledger scan remained in a local draft and backup; no outgoing copy appears in the handset record.", "hints" : [ "Compare the draft attachment with the complete outbox.", "It appears in local backups, but not in sent items.", "The duplicate-key ledger scan remained local and was never sent." ], "id" : "lk3-attachment-chain", "question" : "Which item was never sent from Nadia's phone?", "sources" : [ { "app" : "messages", "body" : "The confrontation draft has one attached image: a scan of the duplicate-key ledger. Status: local draft.", "id" : "lk3.attach.draft", "title" : "Draft attachment list" }, { "app" : "mail", "body" : "No outgoing message or mail contains the ledger scan. The outbox is complete for the relevant period.", "id" : "lk3.attach.outbox", "title" : "Outbox audit" }, { "app" : "browser", "body" : "The image exists in both local snapshots and in the recovered handset copy.", "id" : "lk3.attach.copy", "title" : "Backup manifest" } ], "title" : "The attachment that stayed local" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "b-18 was accepted; the holder is unknown", "the credential was accepted", "a credential event occurred", "the key was accepted" ], "app" : "phone", "discovery" : "Credential B-18 was accepted at 21:04; the handset cannot identify who presented it.", "hints" : [ "Keep the credential event separate from the role assignment.", "There is no camera image identifying a holder.", "B-18 was accepted at 21:04; the holder is unknown." ], "id" : "lk3-final-access", "question" : "What is the strongest supported statement about the 21:04 access event?", "sources" : [ { "app" : "phone", "body" : "B-18 accepted at the west door at 21:04 corrected time.", "id" : "lk3.access.corrected", "title" : "Corrected reader event" }, { "app" : "photos", "body" : "No frame covers the reader at 21:04. The retained exterior stills show no identifiable person.", "id" : "lk3.access.camera", "title" : "Camera retention result" }, { "app" : "contacts", "body" : "B-18 was assigned to role ARC-4. A role assignment is not proof of the credential holder's identity.", "id" : "lk3.access.key", "title" : "Key roster" } ], "title" : "Credential or person" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "medical and physical evidence", "medical examiner finding", "independent cause-of-death evidence", "forensic record" ], "app" : "vitals", "discovery" : "The handset has no medical or scene-forensic record; cause of death remains outside its evidence.", "hints" : [ "Look for evidence outside the phone's inventory.", "The handset has no medical or room-level forensic finding.", "Independent medical and physical evidence is required to prove cause of death." ], "id" : "lk3-cause-of-death", "question" : "Which missing record prevents this handset from proving cause of death?", "sources" : [ { "app" : "vitals", "body" : "The phone contains messages, calendar edits, credential logs, and two backups. It contains no medical examiner finding or room-level forensic record.", "id" : "lk3.cause.phone", "title" : "Handset evidence inventory" }, { "app" : "notes", "body" : "The draft says the access event caused Nadia's death. No record on the handset establishes the timing or medical cause of death.", "id" : "lk3.cause.report", "title" : "Draft conclusion" }, { "app" : "mail", "body" : "This examination can reconstruct device events. Cause of death must be established from independent physical and medical evidence.", "id" : "lk3.cause.scope", "title" : "Review scope" } ], "title" : "Cause and sequence" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "verified chronology and integrity summary", "chronology and integrity summary", "device timeline and copy integrity", "timeline and hashes" ], "app" : "notes", "discovery" : "A verified chronology and integrity summary can be shared without naming an unproven suspect.", "hints" : [ "Choose the records the guide explicitly permits.", "The guide permits chronology and integrity, not an identity claim.", "Share the verified chronology and integrity summary." ], "id" : "lk3-family-copy", "question" : "Which two items can be shared without disclosing an unproven identity?", "sources" : [ { "app" : "notes", "body" : "Share Nadia's verified device chronology and the integrity summary. Hold unproven identity claims and private contact data for investigators.", "id" : "lk3.family.policy", "title" : "Family disclosure guide" }, { "app" : "calendarApp", "body" : "20:42 message delivered · 20:47 draft saved · 20:50 unlock · 20:51 edit · 20:53 lock.", "id" : "lk3.family.timeline", "title" : "Verified chronology" }, { "app" : "browser", "body" : "The recovered copy matches Snapshot A and B by the signed recovery hashes. The hashes establish copy integrity, not authorship.", "id" : "lk3.family.backup", "title" : "Integrity summary" } ], "title" : "The family copy" }, "type" : "investigation" }, { "investigation" : { "answers" : [ "the person is not established", "identity is unproven", "the holder is unknown", "not established" ], "app" : "messages", "discovery" : "The family report can describe the access and edit events while stating that the person behind them is unknown.", "hints" : [ "Compare the factual draft with the rejected accusation.", "The device logs events, not the person who caused them.", "State that the person who held the phone and key is not established." ], "id" : "lk3-family-boundary", "question" : "Which wording separates a lead from a proven identity?", "sources" : [ { "app" : "messages", "body" : "'The handset logs a B-18 access event at 21:04 and a calendar edit at 20:51. The person who held the phone and key is not established.'", "id" : "lk3.family.draft", "title" : "Family draft" }, { "app" : "notes", "body" : "'Julian used the key and changed the appointment.' The device has no image or individual login tying Julian to either event.", "id" : "lk3.family.alternative", "title" : "Rejected wording" }, { "app" : "vitals", "body" : "A report may name an investigative lead only when it clearly labels identity as unproven and calls for independent corroboration.", "id" : "lk3.family.standard", "title" : "Disclosure standard" } ], "title" : "The sentence Nadia's family deserves" }, "type" : "investigation" }, { "choice" : { "id" : "lk3-final-report-choice", "options" : [ { "consequence" : "You named Julian as an investigative lead and required independent evidence before attribution.", "id" : "lk3-report-lead", "response" : "M.: The records justify the question. They do not get to answer it by themselves.", "text" : "Name him as a lead and require independent corroboration." }, { "consequence" : "You limited the report to verified handset events and left identity unresolved.", "id" : "lk3-report-device", "response" : "HANDLER: Precise and useful. The chronology can be tested against evidence beyond this phone.", "text" : "Report the device chronology only; leave names to investigators." } ], "prompt" : "What should the final handset report say about Julian?" }, "type" : "choice" }, { "body" : "The recovered phone establishes a delivery, an unsent draft, a three-minute unlocked session, a calendar edit, and acceptance of credential B-18 at the west door. It does not establish who held the device or key, who caused Nadia's death, or what happened in the room. The family receives a verified chronology and the explicit limits of the handset record. Identity and cause remain with investigators.", "imageName" : null, "title" : "CASE CLOSED — LAST KNOWN", "type" : "dossier" } ], "id" : "case_05_ch10", "legacyBeatIDs" : [ "case_05_ch10.beat.0", "case_05_ch10.beat.1", "case_05_ch10.beat.2", "case_05_ch10.beat.3", "case_05_ch10.beat.4", "case_05_ch10.beat.5", "case_05_ch10.beat.6", "case_05_ch10.beat.7", "case_05_ch10.beat.8", "case_05_ch10.beat.9" ], "title" : "What a Handset Can Say" } ], "continuationChapterID" : "case_05_ch8", "estimatedPlayTime" : "About 2–3 hours", "id" : "case_05", "investigationCount" : 33, "isFree" : false, "requiredCompletedCaseID" : "case_04", "synopsis" : "Nadia Bell was found dead after a late-night break-in at the city archive. Her phone was recovered intact. Rebuild her final evening, test the alibi, and decide what the evidence actually proves.", "tagline" : "A victim's phone is the only witness that kept its story straight.", "title" : "LAST KNOWN" } ], "freeCaseID" : "case_01", "paidCaseIDs" : [ "case_02", "case_03", "case_04", "case_05" ] }