Evidence: record any suspicious emails, calls, or IP traces.

Witnesses: anyone who saw him acting strangely, moving documents, or speaking to “Morgan.”

Safe place: arrange overnight location for Friday.

The list grew longer the more I thought. Each item was a thread, and I had to pull them all together before Friday, before he completed the transfer.