Someone had accessed the system using Grant's own credentials at 2:13 in the morning, 3 days before the scheduled handover, and had entered a notation approving the component substitution as a compliant equivalent under a technical standard that did not apply to the actuator in question. The camera footage from the hangar that night showed a figure in a Hollis Aeroworks jacket moving through the aircraft bay with the face consistently angled away from the ceiling-mounted unit, as if the camera angle had been studied and accounted for in advance, and the figure wore safety boots with a side panel reinforcement pattern that Grant recognized from the procurement department's standard issue workwear specification, a detail too small to be conclusive on its own, but precise enough to be a thread that deserved following. The case against Grant was clean in the way fabricated cases always are, too clean, with every piece in the correct position and no ragged edges where actual events leave their marks. Preston briefed the board that morning, presenting the digital access log, the camera footage, and the substitute component as a coherent narrative. Grant had swapped a certified part for a cheaper uncertified one, kept the cost difference, and then staged a refusal to sign in order to reframe his substitution as a discovered safety hazard, and leverage an additional payment.
Vivian's attorneys were already drafting a fraud claim when Mara Winslow, the company's chief legal counsel, arrived from a flight back from New York and asked to see the original camera footage before anyone filed anything. A request so routine that no one objected. What Mara found was that the footage had been exported in a compressed format that did not match the camera system's native output. Someone had rendered it down from a higher resolution original and the compression had introduced a four-frame discontinuity at the moment the figure in the Hollis jacket entered the cockpit. The kind of artifact that compression produces when two source clips are joined at a cut point rather than recorded continuously.
She placed a legal hold on every piece of electronic evidence before anyone could delete additional files and she told Vivian that what they had was not an open and shut fraud case but a situation that needed to be fully understood before it was litigated in any direction. Grant had gone back to the shop that evening not because he expected to find something useful but because working with his hands was the way he organized his thinking when his mind was running faster than his conclusions could form. The shop's internal diagnostic terminal had been accessed remotely at 4:41 in the morning two days before the handover and 14 project files had been overwritten with edited versions that altered the component specifications. But the torque verification machine, a standalone mechanical unit that printed paper records independent of the shop's digital network, had produced a log on the same day Grant installed the genuine actuator showing the correct component seated at the manufacturer's specified torque with a batch identifier that matched the certified part he had ordered. The machine did not communicate with any network.
It printed. And the paper sat in the output tray until someone collected it. And no one had collected it because no one had anticipated it would become the most important document in the building. That single paper record placed the certified actuator inside the aircraft six days before the handover, which meant that whatever was in the avionics bay when Grant opened the panel on the morning of the inspection had been put there deliberately after he was finished, not before and not by him. Brooke called that evening and asked Grant directly whether he was considering signing a provisional release in exchange for the payment and a settlement clause.