The Moonglass
Affair.

EVIDENCE ENVELOPE A

A1 — The service order

Four courses were served exactly once: tomato tart, leek soup, river trout, and poached pear.
The kitchen notebook gives three facts:
- The tart was served before the trout.
- The pear was served immediately after the trout.
- The soup was neither first nor last.
Arrange the four courses from first to last. Then use card A2.

EVIDENCE ENVELOPE A

A2 — The clock's paper memory

The display-room clock went dark at the exact moment the Moonglass was removed. Its backup stored the removal time as four digits, in 24-hour HH:MM format. Unfortunately, the steward had labeled its four memory slips with that evening's courses instead of slot numbers.
Tomato tart: 2
Leek soup: 0
River trout: 4
Poached pear: 0
The steward's instruction: 'Put the slips in service order. Read the digits from first course to last. Insert the colon after the second digit.'
Record the removal time, and continue to envelope B.

EVIDENCE ENVELOPE B

B1 — The door ledger

A guard saw the sole entrant at the removal time leave the display room carrying the Moonglass. The guard could identify the entrant's badge symbol, but the ledger contains several entries. Match the exact time you found in envelope A to this ledger:
20:10 — OWL
20:25 — FOX
20:40 — MOTH
20:55 — HARE
Each guest was assigned exactly one different badge. The guard confirms every guest wore their own badge throughout the evening; none was lent or swapped. No other person entered at the removal time. Find the badge's owner with card B2.

EVIDENCE ENVELOPE B

B2 — Four guests, four badges

The guests are Ada Vale (archivist), Felix Reed (botanist), Nora Pike (restorer), and Ellis Gray (patron).
The four badges are OWL, FOX, MOTH, HARE, each assigned once.
- Ellis wore HARE.
- Felix wore FOX.
- Nora wore neither OWL nor HARE.
- Ada did not wear MOTH.
Find the owner of the badge from B1. Keep that badge symbol: it selects a cipher key in envelope C.

EVIDENCE ENVELOPE C

C1 — The intercepted note

A folded note was recovered from the departing guest's tray. It reads:
VWDUW DW WKH RUDQJH WUHH
A maintenance annotation says: 'Every plaintext letter was moved FORWARD through the alphabet by the number engraved on the writer's badge. Spaces were left unchanged. To read the note, move each letter BACKWARD by that number. Wrap A back to Z.'
Use the badge established in B to choose the number from C2. Example only: with key 1, encrypted B becomes A and encrypted A becomes Z. Decode every word, then open D.

EVIDENCE ENVELOPE C

C2 — The engraving register

OWL: 1
FOX: 5
MOTH: 3
HARE: 7
These are cipher shifts, not course numbers or case numbers.
Alphabet: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Write the decoded instruction before opening D.

EVIDENCE ENVELOPE D

D1 — The conservatory plan

This is a paper map; do not search the real room. Columns run A to F from left to right. Rows run 1 to 5 from bottom to top. North is UP, east is RIGHT. Each square contains one numbered transit case. Trees stand beside the case in their marked square. Begin at the tree named by the decoded note.

FIG tree: A3. ORANGE tree: B2. LEMON tree: B1.
Use the route on D2. The destination square's case contains the Moonglass.

EVIDENCE ENVELOPE D

D2 — The discreet delivery route

This route was clipped to the intercepted note. From the starting tree, move in this exact order, one square per step:
1. Two squares NORTH.
2. One square EAST.
3. One square SOUTH.
4. Two squares EAST.
Do not count the starting square as a step. Do not wrap around the edge of the map. Trees and cases do not block movement. Read the case number at the destination; there is no further code.
Make your final report: the removal time, the guest's full name, and the numbered case. Explain which evidence links each answer to the next. Then check the separate host solution.