The fourth floor was no longer quiet.
Doors opened. Slippers scraped the carpet. A child cried. One business guest stepped into the corridor carrying his laptop instead of a jacket.
Juma climbed the stairs with Peter and the fire marshal.
“Do not run to 407,” he told Peter. “Sweep first.”
A guest refused to evacuate because he was in the middle of a video call. Juma stood at the door.
“Sir, this is a fire evacuation, not a hotel-service request. Take the phone. Leave the suitcase.”
The man complained, but he moved.
There was no smoke and no unusual heat. The manual call point nearest 407 had been broken with a narrow metal tool. That could include a contractor screwdriver, maintenance equipment or many ordinary hotel tools.
“Record the condition,” Juma said. “Not a suspect.”
Sales kept calling for an all-clear. Juma refused to pressure the fire marshal. The fourth floor reopened only after the sweep was complete and the all-clear time was documented.
Room 407 remained restricted.
The seal on its door had been cut.
Inside, the cracked phone, suitcase and charger remained.
The empty laptop bag was gone.
Peter said, “They came for the bag.”
“Maybe. Remember, it was empty when we first saw it.”
A guard reported a Red Crest contractor moving upward in the stairwell during evacuation. He had seen a black bag but not the man's face.
“How many black bags are at this conference?” Juma asked.
The guard looked embarrassed. “A lot.”
“Then record what you actually saw.”
The rooftop access log showed the next contradiction.
Credential: **Naomi Odede — Events Manager.**
Naomi had been downstairs helping count evacuated guests.
Juma called her.
“Where is your badge?”
“On my lanyard.”
“Check.”
Silence.
“It isn't there.”
The rooftop door had opened minutes earlier.
Peter reached for the handle.
Juma stopped him when a voice came from the other side.
“Don't open it fast.”
“Who is this?”
“Kelvin.”
Kelvin Oloo, the technician assigned red badge RC-114.
“Naomi,” Kelvin said. “Bring Naomi. Don't bring security.”
Officer Njeri was already coming up.
Juma suddenly understood why treating the fire alarm as a chase would have been dangerous. A person was now on a roof, frightened, with unknown intentions.
Evidence could wait several minutes.
After the fire marshal gave the all-clear, Juma did not simply reopen the entire floor. Guests returned in small groups. Rooms unrelated to the incident resumed normal access; 407 and the rooftop route remained restricted.
That precision mattered. A lockdown broad enough to punish everyone would create new pressure for staff to bypass it.
At the temporary guest desk, one man demanded to know whether the hotel was “under attack.” Juma refused the dramatic word.
“We had a manual alarm activation and an active police investigation. The floor has passed its fire sweep. We will tell you confirmed safety information, not speculation.”
A receptionist later reported seeing a contractor moving toward the staff stairs shortly before the alarm. Juma logged it as a witness observation, not as proof that the person caused the alarm.
The evacuation had generated a clue because people moved through the building differently.
But public safety could not be turned into an investigative trap after the fact.
That boundary was what allowed Juma to approach the rooftop without converting every unusual movement into permission for force.
A human being could not always do the same.
The fire panel showed the rooftop door had been opened with Naomi's events credential.