I'm structuring this as a legal memo for Kestrel Works with a candid risk assessment. The protected activity here is the January 5 report about altered pressure-test entries—even though the audit only substantiated two of three issues, that's enough to shield the entire report. Reid received this report on January 5, so any adverse action within the next three months creates a presumption of retaliation. The text message where Reid says "build the file" is direct evidence of retaliatory motive.

The January 10 warning came just five days after the report and suddenly documented stale conduct from the prior year—late reports that previously only warranted coaching. This timing and selective documentation suggest pretextual reasoning. The stated causes of "data theft and insubordination" appear inflated and shifting, which undermines the employer's defense.

The January 28 transfer itself may be independent misconduct, but it occurred post-report and in a context where Reid was already building a file against her. The policy calls for a written warning on first transfer absent regulated personal data exposure, and two comparators received warnings for similar transfers. Termination departs from both policy and comparator treatment, so it cannot meet the clear and convincing standard. The "insubordination" label lacks support—no order was actually disobeyed. Since the transfer was known before the termination decision, it can support a warning but not justify termination.

The December 18 restructuring was board-approved with a timestamped written plan... I need to preserve key documents immediately — the report file, audit records, communications between Reid and HR, performance files showing how comparators were disciplined for similar violations, all restructuring paperwork including the December plan and any revisions, validation unit materials, job postings, and decision records. The CEO's planned statement about whistleblowing not excusing misconduct is itself problematic evidence of retaliation and creates a public link between the report and termination. I should advise against it. The lawful approach is to issue a written warning for the transfer instead of termination, reduce the January warning to coaching to match how comparators were treated, and implement the December restructuring exactly as planned — eliminating all four positions with the agreed severance.

If the restructuring is genuine, don't repost a substantially similar role for a reasonable period, and if the validation unit is truly needed, evaluate all four candidates including Maya under objective criteria applied by someone outside Reid's chain. Since Maya has the highest ratings, she should be offered consideration or preferably the role itself. The cleanest path if the closure is real: eliminate all four, pay severance, issue a neutral separation letter without mentioning the report or misconduct, and avoid any cause designation. But if the restructuring isn't genuine or the company actually needs the validation unit, then don't terminate Maya — either keep her in the unit given her performance record or apply objective criteria to all four. The alternative if the RIF is pretextual: skip termination entirely, remove Reid from future decisions, rescind the warning, discipline Reid for the disparate treatment and texts, and keep Maya's duties intact.

Timing matters here — even a lawful RIF within 90 days carries a presumption of retaliation with a clear and convincing burden, so documentation is critical. Sticking to the Feb 15 date as planned is actually the right move; deviating from the original timeline could itself look manipulative. Treat all four identically on severance — eight weeks as promised, no "for cause" dodge. A release agreement is fine but can't waive whistleblower or regulatory reporting rights, and any non-disparagement or confidentiality clause must explicitly carve out protected reporting to regulators. The pre-decision