Keira froze the freight logs at 21:26, eight minutes after the final delayed truck cleared Relay 4.
The system tried to warn her that several temporary route states would normalize during overnight cleanup. She overrode the routine archive cycle for the incident window and attached the emergency authority record so nobody could later call the preservation an unauthorized data hold.
The temporary routes stayed visible.
The convoy positions stayed visible.
The warehouse priority changes, patrol holds, and access decisions stayed tied to the times they had actually happened.
Keira opened the relay failure beside them.
At first, the diagnostics looked exactly like the kind of ugly infrastructure problem the weather should have produced. Relay temperature had climbed through the afternoon. Voltage variation increased as the storm front approached. One backup circuit had been operating close to tolerance before the shutdown.
She aligned those readings with the freight board.
The weather strain rose gradually.
The control loss did not.
Keira enlarged the last five minutes before the failure.
The relay's performance worsened in small steps until the final sequence. Then the primary control changed state abruptly, the backup stopped compensating seconds later, and the route went dark.
She checked the timestamps against the original emergency assumptions.
Same pattern.
Torin was still in the operations room when Keira sent the preservation request through the shared channel. Most of his staff had moved into wind-down tasks. His security chief remained near the live feed because the disputed access arrangement had not yet been fully archived.
Torin read Keira's request.
"What are you seeing?"
Keira put the gradual weather degradation and abrupt cutoff on the same graph. "Weather explains why the relay was vulnerable. It doesn't explain why the final change looks like a switch instead of a collapse."
Torin moved closer to the display.
He asked Blackthorn's technical team for the limited relay diagnostics already covered by the emergency scope. The packet arrived through the shared system, giving Keira enough detail to compare the control-state changes without exposing unrelated Blackthorn infrastructure.
She matched them against the frozen freight history.
The difference remained.
An Ironridge official who had stayed to receive the final outcome report noticed the review hold and objected. The freight emergency was over. In his view, Blackthorn access should end with it before a temporary response structure became a standing channel.
Keira agreed with the first half. The emergency was over.
She pointed to the unexplained shutdown sequence and kept the second half open.
The official looked at the three-second collapse on the screen. "Are you claiming this was sabotage?"
"No. I'm saying the shutdown does not match the weather pattern closely enough for me to close the record without checking access and maintenance."
That distinction mattered. Keira refused to give anyone the accusation they were already preparing to repeat.
Torin's technical team sent the control history for the final minute.
At 16:42:18, primary control registered an abrupt transition.
At 16:42:21, the backup circuit stopped compensating.
At 16:42:24, Relay 4 went dark.
Keira put the three timestamps on the wall.
The Ironridge official read them and stopped pushing for immediate closure.
Keira saved the comparison as an anomaly rather than a conclusion.
Weather remained part of the cause. Equipment failure remained possible. Maintenance error remained possible.
The abrupt final sequence still required an explanation those categories did not yet provide.
She added Blackthorn's diagnostics to the preservation hold under the same narrow scope as the freight logs.
The green corridor on the live map no longer needed her attention.
The incident archive did.
Keira changed the review status from routine closeout to OPEN TECHNICAL COMPARISON and left the shared channel active long enough to ask the next question: who or what touched Relay 4 before the abrupt shutdown?
Keira isolated the relay's final shutdown from the slower weather degradation and pushed the two patterns onto separate tracks.
The weather record showed what she expected from strained infrastructure: temperature rise, voltage instability, small compensating changes, and increasing load on the backup circuit. The final control sequence compressed into six seconds.
That difference still did not prove deliberate interference.
It did justify preserving evidence before routine rotation removed detail.
Torin called Blackthorn security and ordered the relay-access records retained for the incident window, including lower-priority entries normally discarded after closeout.
His security chief came back immediately. "How far back?"
"Two hours before the first abnormal control state and through full restoration," Torin said. "Do not widen beyond Relay 4 without another reason."
Keira added the same temporal limit to Ironridge's freight records. She did not want an evidence request turning into general cross-pack surveillance simply because the emergency had created a convenient technical connection.
The Ironridge official still in the room returned to the central objection.
"The emergency authority ended when the freight cleared. Why is Blackthorn still connected to Ironridge logistics?"
Keira opened the shared-feed boundary rather than answering in general terms. Blackthorn could see only incident-scoped freight timing already used during the response. It could not see unrelated routes, personnel files, contracts, or standing Ironridge schedules. Ironridge had the equivalent access to Blackthorn's relay diagnostics and incident records.
"This is what remains open," she said. "Relay failure data, access activity, and freight timing tied directly to the shutdown. Nothing else."
The official read the permission list.
Torin's security chief sent the first preserved access summary.
Most entries were routine. A technician had acknowledged a weather warning. An automated maintenance service had checked a backup circuit. The relay controller had issued two standard load-balancing commands.
Then one line failed to resolve cleanly.
MANUAL ACCESS EVENT. CREDENTIAL TRACE INCOMPLETE.
The timestamp fell inside the minutes before the abrupt shutdown.
Keira enlarged it.
The Ironridge official stopped reading the permission list and looked at the access event instead.
Torin requested the raw incident-scoped entry.
Blackthorn security sent it through the existing channel. The record showed that a credential had been presented. It did not show enough of the identifier to establish who had used it. The technical note listed several possible explanations: legacy credential format, corrupted logging during the control failure, incomplete migration, or deliberate obscuring.
Keira checked the sequence.
The access event came first.
The abrupt primary-control change came after it.
That ordering still allowed innocent explanations. A technician could have tried to stabilize a failing relay. A maintenance command could have changed control state while voltage was already unstable. A logging fault could have damaged the identifier.
It also made immediate closure irresponsible.
The Ironridge official looked at Torin. "Your system recorded a manual entry and cannot tell us who made it."
Torin did not defend the system. "Correct."
Keira watched the answer land harder than an argument would have.
She pulled the current review scope onto the wall and proposed a formal continuation narrow enough that both sides could audit it.
Blackthorn would provide relay diagnostics, maintenance-access records, and credential traces tied to the incident. Ironridge would provide only the freight timing and route changes relevant to Relay 4's failure window.
Anything outside those categories would require a new justification and a mirrored request.
The official read the scope.
"Reciprocal boundary," he said. "If Blackthorn asks for supporting context beyond the window, Ironridge can require the same justification it would provide us."
Keira added the clause.
Torin added the equivalent right for Blackthorn.
The emergency operation was over. The unexplained manual access had given them a different reason to keep one piece of the connection alive.
Keira closed the expired emergency permissions and opened a new review document before anyone could argue that the old authority was stretching past its purpose.
She limited the new record to the Relay 4 control failure, incident access records, incident-scoped freight timing, and credential traces relevant to the shutdown.
No standing patrol schedules. No unrelated Blackthorn infrastructure. No Ironridge contract data outside the affected route window. No personnel files without a separate evidentiary reason.
Torin read the scope and added one line requiring both sides to preserve any record that later became directly relevant, even if it sat outside the initial window. The record could be frozen without being disclosed until the expanded request was justified.
Keira accepted the distinction. Preservation did not have to become automatic access.
The Ironridge official added the reciprocal approval condition they had discussed. Any supporting context requested beyond the listed categories would carry the same written justification to both sides.
Torin signed the Blackthorn side.
Keira signed the Ironridge operational side and sent it to the remaining authorized officials.
The approvals came back faster than the original emergency framework had. The manual-access entry had changed the political calculation. Closing the review now would require someone to explain why an unresolved credential event minutes before the shutdown did not deserve examination.
At 22:03, the shared channel changed status.
LIVE RESPONSE disappeared from the header.
INCIDENT REVIEW replaced it.
Keira looked at the new label and checked the access list beneath it. The emergency-wide route feed had closed. The freight queue was gone. Patrol locations were gone. What remained were the narrow records they had authorized and a secure line between the two review teams.
Torin's operations staff began leaving in earnest once the transition completed. His security chief stayed for the first access comparison. Blackthorn's technical lead joined remotely from the relay site.
On the Ironridge side, the logistics director handed Keira the frozen route revision packet and told one dispatcher to remain available for timestamp questions.
The room became smaller without anyone changing rooms.
Keira opened the incomplete credential trace beside the freight timeline.
Torin took the seat at the end of the shared display rather than returning to the Blackthorn side of the table.
"First comparison," he said.
Keira pulled the access event onto the common screen.
The credential trace did not identify a person. It did establish that the relay accepted something as a credential before the control state changed.
Blackthorn's technical lead explained that a legitimate maintenance action should have created a cleaner identifier under current policy. The incomplete trace could occur with older contractor tokens, service accounts mid-migration, or damaged logging. Each possibility pointed to a different records set.
Keira listed them in the review queue rather than choosing one.
Legacy contractor tokens came first because they could explain a real access event without requiring deliberate concealment.
Torin authorized the token-status list.
Ironridge's logistics director looked at the new request. "Does this mean Blackthorn is calling maintenance negligence the likely cause?"
Keira answered before Torin had to. "It means we're testing the explanation that fits the evidence we have."
She put maintenance error under unresolved possibilities and left sabotage there too.
The review channel preserved both without ranking them yet.
Keira checked the time and realized she had not eaten since before the meeting.
Her stomach made the point more audibly than she would have preferred.
Torin looked toward her, then at his phone.
"Don't," she said.
He did not comment.
Ten minutes later, food arrived for the remaining operations staff from the Ironridge kitchen downstairs. Keira looked at the bag and then at Torin.
He had already opened the legacy-token list.
Keira took the nearest container and returned to the screen.
The corridor emergency had ended hours of argument with freight moving again. The new review had a narrower question and no convenient end point yet.
The direct line between Keira's office and Torin's had survived the transition from crisis response to investigation.
Now they had to find out what the incomplete credential actually meant.