Chapter 10: 2:17 A.M.
At 2:04 in the morning, the external systems auditor joined by video.
At 2:17, he found the change.
His name was David Ren, and he worked for the firm that maintained Sterling's compliance mirror—an independent, read-only record of when controlled files were created, opened, and revised. He could not see patient details. He could see the trail.
The audit chair asked one question.
"When was Dr. Evelyn Sterling's access revoked?"
David shared a timeline.
6:41 p.m.: research permissions suspended.
7:03 p.m.: building badge disabled.
7:11 p.m.: remote sessions terminated.
The entries came from three systems with separate administrators. I remembered that evening without needing the screen. My badge had flashed red while former colleagues watched from inside the glass laboratory. Nathan had met me in the lobby with my coat and no explanation he was willing to put in writing.
"Now display the disputed record metadata," Rhea said.
Nathan objected. "We have not established that the record relates to Leah Morgan."
"We don't need the participant identity," the audit chair said. "Use the record number from the company's own incident report."
David entered it.
The screen showed a sequence of versions.
The final entry was time-stamped 2:17 a.m.—more than seven hours after every one of my permissions had been disabled.
Change type: approval field revised.
Account: Safety Administration Service.
Nathan leaned toward the monitor. "Service accounts process automated updates."
"Some do," David said.
"Was this automated?"
"The mirror marks automated processes. This entry is marked user initiated."
Celeste pushed away from the table. "Someone could have used Evelyn's credentials."
"Her credentials were terminated," David replied.
"Then the timestamp could be wrong."
He displayed the synchronized clock records for the badge system, research platform, and compliance mirror. Their largest difference was four seconds.
Not seven hours.
My father finally spoke.
"What exactly changed?"
David looked to the audit chair for permission.
"Metadata only," she said.
He opened the comparison.
Before 2:17, the approval field was blank.
After 2:17, it contained two initials:
E.S.
The initials I used on internal study reviews.
The initials that had appeared throughout Sterling's investigation.
The initials that convinced people I approved a record created after they removed me.
David enlarged the comparison without exposing the underlying medical content. The earlier version had no approval attachment. The later version referenced a review note bearing my initials, but the note itself was not stored with the record.
"Can an approval reference exist without its source file?" the audit chair asked.
"It can be typed into a field," David said. "That does not make the source file exist."
Ms. Vale searched the controlled index. No matching review note appeared.
For five years, I had argued from memory, printed warnings, and the sequence of meetings. The company always answered with the approval field.
Now the field had a creation time.
Nathan asked David whether an archive migration could have inserted historical initials.
"There was no migration scheduled that night."
"Could an administrator backfill an approval during incident reconciliation?"
"Technically, an authorized user could revise the field."
"So this proves nothing about intent."
His words were precise.
Not that the change had not happened.
Not that he had never known.
Only that we had not yet proved intent.
The audit chair ordered the service-account credentials, administrator assignments, and original version history preserved by an outside custodian. My father objected to allowing another firm into Sterling's systems.
This time, no director supported him.
Rhea added one limit: the custodian would isolate participant content and report only access, versions, and authorized approvals unless a later order expanded the review. Leah's life would not become an open folder because my name had finally begun to clear.
Celeste stared at my initials on the screen.
"You could have arranged this before your access ended."
"Then there would be an instruction," I said. "Preserve those too."
David locked the export and issued a verification number.
At 2:17 a.m., I had no badge, no session, and no authority inside Sterling Biotech.
But someone had put my initials back in.