"Do you think she knew?" Sarah asked.
"I think she received a warning," he said. "There's a difference between what I suspect and what we can prove."
She nodded slowly. "That's what you keep telling me about my login."
The connection surprised him. Sarah had listened for months while people described her account as though it were her hands, her choices, and her intention. Now she was applying the same care to a woman who had treated her cruelly. Elijah realized that his mother's sense of fairness had survived an ordeal that might have destroyed his own.
"I don't want her to hurt anyone else," Sarah said. "But I don't want us to become the kind of people who decide guilt before the evidence comes in."
Bennett arrived and told them the court had ordered the city to preserve all devices, logs, email archives, and internal communications related to the neighborhood fund. An independent technology examiner would make a verified copy of the records, and the judge had instructed the prosecution not to contact Vance about the substance of his testimony before the hearing. Pierce had objected, calling the order excessive. Harrison had refused to narrow it.
"We're finally asking the right people the right questions," Bennett said. "That's progress. It isn't a verdict."
At one thirty, the bailiff called everyone back. Richard Vance entered carrying a canvas satchel and wearing a blue shirt that looked as though it had been pulled from a laundry basket in a hurry. He glanced briefly at Pierce, whose expression revealed nothing, then took the witness chair. The clerk administered the oath, and Bennett began with unremarkable questions about his responsibilities and the systems he had examined.
Vance answered slowly, pausing whenever a question risked combining several technical issues. The fourth-floor finance terminal had shown signs of unauthorized remote control during the period associated with the fraudulent transfers. Investigators found a malicious program that allowed an outside operator to interact with the machine under a compromised account. The evidence included external command sessions, authentication anomalies, and activity at times when the credited employee's physical access records did not match the transaction trail.
"Were you able to conclude that Sarah Cross personally initiated these transfers?" Bennett asked.
"No. Our findings did not support that attribution."
A faint sound passed through the gallery. Sarah's fingers closed around Elijah's sleeve, and he felt her hold on as though the fabric might keep her anchored. Vance continued before Bennett asked another question, explaining that a compromised account did not establish which person controlled the connection and that investigators needed further tracing to identify the outside operator.
"Did you communicate that limitation to the prosecution?" Bennett asked.
"Yes. I sent an email and a diagnostic report to Ms. Pierce."
"When?"
"October twelfth. I also raised the issue in a follow-up call."
Pierce stood. "Objection. This witness is speculating about the prosecutor's understanding of technical information."
"Overruled as to the fact of communication," Harrison said. "The witness may tell us what he said and to whom. He may not tell us what another person believed."