"Doreen violently grabs Abram’s arm and yanks him backward from the padlocked backyard shed. He stumbles across the wet grass, then freezes when weak scratching sounds come from behind the door.

Patricia Weller was seventy-four and furious that anyone had called her a victim.

“I loaned Doreen money.”

“How much?”

“Thirty thousand.”

The state investigator asked when.

Patricia knew exactly.

Three years earlier.

“Did you sign a note?”

“No.”

“Did she repay?”

“Some.”

“How much?”

Patricia did not know.

Her bank records showed $30,000 transferred to Norwood Home Companion through DN Property Services. Later payments totaling $12,000 returned to Patricia.

Doreen’s private ledger showed:

W — 30 used / 12 returned / 18 balance.

That looked like a loan.

No written note.

But Patricia said it was voluntary.

Not theft.

Important.

Then Bernard Shaw’s family said the opposite.

Bernard had advanced dementia during the period Doreen moved $22,000 from his convenience account. His daughter held financial power of attorney and had not authorized it.

Records showed $15,000 later returned.

$7,000 still missing.

Doreen’s lawyer argued prior oral permission when Bernard had capacity.

Could be.

Witnesses.

Dates.

No simple ledger answer.

The central question was narrowing:

How much was truly stolen?

How much borrowed informally?

How much spent legitimately but documented badly?

And which records had Doreen changed to hide all categories together?

Then Detective Shaw finally obtained complete forensic analysis of Celia’s credentials.

Eight changes during confinement.

But the device fingerprint belonged to Doreen’s office laptop.

Four times, the computer connected to Doreen’s personal phone hotspot.

One change occurred at 11:32 p.m. on day four.

House exterior camera showed Doreen arriving home at 11:58.

Celia remained in shed.

Impossible for Celia.

Strong.

Then the most important changed entry:

A transaction labeled:

“Temporary client loan — Doreen authorization pending.”

Original.

Edited during confinement to:

“Reconciliation adjustment entered by C. Norwood.”

That was not cleanup.

That was attribution.

Doreen had moved responsibility toward Celia.

Then another file:

Internal note created using Doreen’s own account two weeks before the confinement.

If outside review questions legacy reconciliation, route through Celia project.

There.

Preparation.

Still not full central secret.

But close.

Then Detective Shaw asked Celia whether Doreen knew about the state audit before locking her in.

“Yes.”

“How?”

“I heard her on the phone.”

“With whom?”

“Someone at the office.”

Paige Holloway confirmed Doreen received notice that a complaint had triggered enhanced review, though the exact audit date had not been announced.

Doreen apparently expected it within a week.

Then why six days specifically?

Celia remembered Doreen standing outside the shed on day five.

“She said, ‘Tomorrow it won’t matter what you think you saw.’”

The actual state audit arrived day six.

Doreen knew or guessed.

Either way, she was racing the clock.

Then the metal cabinet contained a laptop nobody at the company recognized.

Cheap.

No asset sticker.

Forensics found it had been used to scan:

Client powers of attorney.

Signatures.

Old invoices.

Cash-account statements.

Then generate PDF packets.

No direct evidence of forged client signatures yet.

But multiple documents existed in altered versions.

One version in client file.

One on hidden laptop.

One in official system.

The largest discrepancy involved Evelyn Hargrove’s authorization.

Official system showed a broad power of attorney active through last year.

Original signed document in Evelyn’s attorney’s files expired after her hip-surgery recovery.

The hidden laptop contained an edited PDF with the expiration paragraph removed.

The jeweler had received the edited version.

There.

Document manipulation.

Now the brooch sale no longer looked like a misunderstanding.

Doreen’s attorney argued:

Someone else could have created the PDF.

True.

Who used the laptop?

Forensics.

The login name was generic.

Wi-Fi history included:

Our house.

Doreen’s condo.

Norwood headquarters.

Not Celia’s devices.

Then investigators found a fingerprint on the laptop lid?

Physical prints may be weak and Doreen could legitimately touch. Not decisive.

Better: webcam test photo accidentally captured Doreen’s face. A system diagnostic image from setup showed her seated at kitchen table.

Direct.

Not proof of every file.

Proof the laptop was hers.

Then Rachel called me after a long meeting with prosecutors.

“They’re ready to explain what they think happened.”

“Full theory?”

“Yes.”

“When?”

“Tomorrow.”

I looked at Celia.

She was twenty-one weeks pregnant now, sitting beside the window with one hand on her stomach. She had spent almost two months living beside pieces of the answer without knowing what they assembled into.

Tomorrow, investigators would put the ledger, the lockboxes, the hidden laptop, the client accounts, and Doreen’s six days of record changes into one timeline.