You pin the missing escalation email beside the silent-alert ticket and the vendor note. This is the first route that feels like hard evidence rather than interpretation. Here is what these three documents prove together: on at least one occasion, a PRAP risk alert was placed in observation hold, the automatic escalation email to senior management did not fire, and the alert was quietly suppressed (put into "silent" mode). The system logs have timestamps and user IDs. Unlike the intern's social media post or Marc's complaints, this evidence cannot be dismissed as gossip or attitude. It is a system record. The intern's language explains *why* Isabella delays (she believes in patience). Marc's complaints explain the *culture* that allows it (junior staff notice but cannot push back). But this audit trail explains the *mechanism*: how the delay is executed inside the PRAP system, and what digital footprint it leaves behind. By the time you add it to the board, the pieces no longer need to be believed one at a time. They reinforce each other. - **Return to the Paper Trail Board**: Review all the evidence. [[Cybercrime/The_Phisherman/Paper Trail Board|Return to the main board]] - **Check the Signature Route**: Cross-reference with Isabella's language patterns. [[Paper Trail Board - Signature Route|Check the signature route]]