He was not cruel about it. He had worked in retail long enough to know that mistakes often began with someone trying to protect a store without understanding how easily suspicion could attach itself to the wrong person. But he had also seen customers quietly humiliated by unnecessary scrutiny, and he knew that calling it caution did not erase its effect.
That afternoon, Jennifer drafted a statement for the internal review. She described the purchase, the card approval, and the call without suggesting that Vanessa had done anything wrong. She admitted that she had assumed the customer's casual clothing was inconsistent with the price of the watch. Then she added a sentence Arthur had not asked her to write: I should have treated the approved transaction as the evidence it was, instead of treating my personal impression as something the customer needed to disprove.
On Monday, Torres met with internal affairs investigators and turned over the evidence she had collected. She had preserved Harlan's complete body-camera file, his preliminary report, dispatch records, the incident notes, witness names, and photographs of Vanessa's wrists. The investigators also obtained the mall's original security logs and the independent event recording through the proper evidence procedures. Their task was to determine not what the public had concluded, but what could be established from reliable material.
The initial review identified several discrepancies. Harlan's report claimed Vanessa had refused to provide identification, though his camera showed her handing over her license. It stated that she had become physically resistant before the cuffs were applied, although the available footage showed compliance. It described Marcus and the others as surrounding him, even though the wide-angle camera showed them standing at a distance and leaving the corridor open. The report did not mention that the store had verified the transaction before the cuffs went on.
Torres sat with an investigator named Paul Reeves as he compared the two recordings. He had a habit of speaking very little and circling points in pencil. After the first viewing, he looked at the receipt and the incident time. "He had the easiest possible way out," he said.
"That's what struck me," Torres replied. "He was offered a document, a store employee, and a phone number. He used none of them."
Paul tapped the dispatch entry. "Then he was told the payment was valid. This isn't about whether he made an understandable mistake in the first thirty seconds. It's about why he continued after the uncertainty was gone."
The security footage investigation took longer. At first glance, the main archive showed only a missing interval. The retained access log identified Sloan's account, but the IT contractor explained that an account entry did not by itself prove what the user had done. The investigators made a forensic copy of the storage system and compared it with the controller's audit records. They found a manual deletion command associated with Sloan's credentials, followed by a change to the retention settings for the atrium camera group. The ordinary thirty-day recording cycle had not caused the missing footage.