Kassim assigned Pendo Mushi, a visitor-services officer from another shift, as co-reviewer.
“Rehema remains intake lead. Any conclusion affecting pricing or routes is jointly signed.”
Rehema felt both relieved and irritated by the loss of control.
Pendo smiled. “That is the point.”
They opened only the aggregate ferry-batch dashboard: arrival times, batch IDs, group counts, and coach categories. No names, passport numbers, phone numbers, or private bookings.
F-112 was the eleven o’clock ferry batch.
The **G-C1** category appeared inside one group subset.
They compared the voluntarily submitted receipts with arrival times.
Pendo deliberately tested alternative explanations.
“Maybe guide groups receive more service.”
“Possible.”
“Maybe they arrive during peak demand.”
“Possible.”
They added columns for itemized services, stated package, guide code, demand period, and wholesale surcharge.
Several higher-priced receipts had no itemization.
Peak demand alone did not explain all of the differences because guide groups and walk-ins overlapped in time. But the complaint sample was still small.
“No population claim,” Pendo said.
“Agreed.”
They included exceptions too. Two guide-coded receipts had the same prices as walk-ins. Those rows stayed in the analysis.
Another officer should be able to reproduce the comparison, so they saved formulas with the aggregate batch data rather than exporting traveler records. Kassim spot-checked the calculations against source counts.
Rehema never needed access to the passenger list.
That separation strengthened the case. It also reduced the risk that a pricing review would quietly become a database of tourists.
Before the shift ended, more complaints arrived.
One came from another seafood stall. Then another.
By evening, four different vendors appeared in the complaint queue.
One seller complained in the opposite direction: a customer had posted his receipt online and called the vendor a thief before the review was complete.
Rehema asked the visitor desk to publish a short notice: price complaints were welcome, but personal harassment and public accusations should not replace the process.
“Consumer protection is not mob protection,” Pendo said.
They planned an open market survey for the next day.
No hidden cameras.
No fake tourists.
No sting.
They created categories in advance: legitimate seasonal surcharge, transparent group package, volume discount, and guide-linked unexplained tier.
Kassim updated Rehema’s conflict note. Any recommendation specifically affecting Saada Seafood required an independent signature. General market recommendations also needed joint review.
Her mother learned of the arrangement.
*At least it is not you alone,* she texted.
*Exactly,* Rehema replied.
The four-stall complaints changed the case. Saada Seafood was no longer the whole story.
Pendo also forced Rehema to record the receipts that did not fit the emerging theory. Two guide-coded groups had paid the same price as walk-ins. Another high-priced transaction occurred during a genuine supply shortage. Those exceptions stayed in the working table. The point was not to manufacture a perfect pattern; it was to learn which mechanism explained which transaction. By the time they scheduled the market survey, the team had a clear question: do vendors use guide-linked tiers consistently, selectively, or not at all, and what does the customer actually see in each case?
Before leaving the operations room, Pendo printed a one-page explanation of what the batch analysis did **not** contain. There were no passenger names, no nationalities, no individual booking values, and no list of which traveler ate at which stall unless that traveler had independently submitted a receipt. Kassim attached that explanation to the complaint file. The measure protected the inquiry from expanding just because the ferry authority technically held more data. Rehema understood the larger principle: access to information was not the same as a reason to use it. The price question could be answered with group timing and consented receipts, so that was where the data boundary stayed.
Tomorrow they would find out whether it was an exception, part of a system, or both.