Thank you both. It's 8am Monday now and I haven't heard anything from X about S2's return yet. I'm supposed to work today, damn it. I've contacted the daycare to inform them of the situation and they are going to call me immediately if he is dropped off there.
The police cannot get involved in child custody disputes unless there's an emergency recovery order from the court. Due to the lax nature of the current arrangement, X has not broken any laws by withholding S2, so I can't get a recovery order.
The swiftest and strongest message I can send will be to prevent future access until a court order is in place to ensure I have legal recourse if he withholds him again. I'm scared of his response, but this is a serious breach and he cannot be led to think this is acceptable in any way.