Three Signatures

I begin with calendars because calendars show intended movement before memory revises it.

My paper desk calendars are held in counsel's archive box 44. I created entries as meetings were scheduled. The pages have been photographed under two-person custody, and Rina compares them with Vale's server calendars and building-access records. Paper can be altered. Electronic calendars can be edited. Badge records show entry, not attendance. Agreement across all three sources narrows the uncertainty without erasing it.

The first certification was filed four years ago at 3:42 on a Thursday afternoon. Malcolm's calendar places him at Vale headquarters. His badge opened the board floor at 1:08 and exited at 5:17. My paper note says Bond certification: M review 3:00.

I also kept distribution sheets for every numbered board packet. Directors signed when they received paper and when they returned it for shredding. The first filing's sheet shows Malcolm received Copy 2 at 2:51 and returned it at 4:04. Outside counsel collected the sheets from my archive cabinet under seal last week. My signature authenticates the process I used, but it cannot prove Malcolm read the packet between those times. It proves he possessed the same pages now under review.

"Do you remember the review?" Hart asks.

"I remember assembling the packet and taking it into his office. I do not remember every page he read."

Malcolm says he signed after reviewing the summary and exceptions sheet. The consultant-conflict field was marked none. The delegated-authority appendix listed standing committees, not temporary digital codes.

"Did you ask whether expired codes remained usable?" Rina asks.

"No. I believed the access audit summary that said revocation controls were effective."

His belief was poorly supported. It was still his when he signed.

The second filing arrived the following year. Server logs show Malcolm's credential applied at 11:26 on a Monday. Hospital records produced by Malcolm's counsel show he was admitted Sunday night and sedated from 9:10 Monday morning until after two. His phone was secured with his personal effects. His hardware token, however, was not inventoried.

I remember the week. Owen's condition had worsened. Malcolm collapsed during a board call. Directors wanted the certification filed before market open in New York the next day.

My calendar says F. Lowe authority confirmed. Franklin Lowe chaired audit then. The note is my handwriting, but I cannot reconstruct who told me authority was confirmed.

The technician traces the signature event through an archived authentication log. A records vendor created the log during a migration eighteen months later and retained the source image. It shows Malcolm's credential entered from the board floor, followed by a recovery-token challenge. Diane Mercer, my account, approved the recovery.

Hart turns to me. "Did you approve it?"

"I approved many recovery prompts. I do not remember this one. The system shows my account approved it, not my hands."

The moral fatigue feels physical. Years of solving emergencies taught everyone that access was service. We recorded outcomes and forgot to record why urgency deserved authority.

An old receptionist log places me at the hospital from 10:48 until 1:03. The board-floor access report shows my badge never entered headquarters that day. Remote approval remained possible, but the hospital guest network records retained by its provider show no connection from my registered device. The evidence strongly contradicts my personal action. It cannot identify who used my active admin session or saved recovery access.

Rina asks who knew my recovery procedure. I name the audit chair, general counsel, two technology administrators, and Jonah, whom I trained to retrieve urgent procurement packets during Owen's illness. Naming him does not make him the operator. It expands the preservation list. Hart orders counsel to notify every named custodian before interviewing them, reducing the chance that one person's recollection shapes the next. The notices may also warn the real operator that investigators are close. Process creates costs even when it is correct.

"Then that signature was unauthorized," Malcolm says.

"It appears the credential was applied while you could not authorize it," I answer. "We still need to establish the operator."

Hart marks the second filing as contested and refers it for forensic review.

The third signature is harder because it is unquestionably ordinary.

It was filed two years ago at 4:05. Malcolm attended the audit-committee meeting. The minutes record his motion to approve the certification. My paper packet contains his handwritten initial beside the conflict representation. The electronic signature followed from his office network. Every available source supports his action.

"What materials did the committee receive?" Rina asks.

I reconstruct the route. Jonah's procurement office created the consultant schedule at 8:33 that morning. Finance incorporated it into the bond packet at 9:12. I printed the packet at 9:41 and distributed numbered copies before the 11:00 meeting. The committee secretary created draft minutes at 2:18 and I finalized them the next day.

The consultant schedule lists Hollis as inactive. It omits Ellison Ridge meetings, which the committee did not know about. The delegation appendix includes a line authorizing Jonah to approve vendor exceptions "within established board parameters." No transaction cap, expiration date, independent review, or code-level restriction appears.

I find my cover memo for the packet. It says the appendix is unchanged from the prior year. That statement was false. A document-comparison report shows Jonah's expanded clause replaced a narrower limit allowing only substitutions under two hundred thousand dollars. I created the cover memo at 9:29, before his 8:21 edit should have reached my print queue, which means the system served me an old comparison view or I reused last year's language without checking. The print-server log has not survived, so we cannot choose between those failures.

"Either way, I told the committee there was no change," I say. "That was my error."

Malcolm could turn it into my fault and stop. "Your cover memo did not relieve me from reading the appendix I signed," he says.

Hart records both responsibilities.

"Who drafted that line?" Hart asks.

The document properties identify a procurement policy analyst as creator, while revision history shows Jonah's account expanding the clause at 8:21. Author names remain in the system, but shared assistants could submit edits under delegated accounts. That evidence attributes the change to his account, not conclusively to him.

Malcolm reads the clause. "I approved this."

"Did you understand it to cover benefit consultants and supplier substitutions?" Rina asks.

"I understood it to cover ordinary vendor exceptions. That breadth was my mistake. I signed a certification saying delegated authorities were disclosed while accepting language that did not define their limits."

Hart asks whether he intends to challenge the filing because the packet omitted Sloane's warning.

"The omission matters. It does not erase my signature or my duty to ask what authority Jonah held."

I have spent days proving that one signature may have been stolen. Malcolm could use it to cast doubt across all three. He does not.

I refuse to reward him by softening the two legitimate acts.

"You received annual exception totals," I say. "They rose thirty-eight percent before the third certification. I placed the chart behind the appendix."

He closes his eyes briefly. "I remember the chart. I accepted procurement's explanation that supply volatility caused the increase."

"You did not request a sample of approvals."

"No."

The precise timeline is finished at 5:36. Rina validates every time against the custody index, and Hart approves a redacted chronology that protects hospital details beyond what Malcolm chose to disclose. Under confidentiality, the trustee receives the full version while the city retains a sealed copy. Reviewers keep the recovery-token event labeled unresolved.

The chronology creates different consequences. One filing is referred as a probable unauthorized signature. Two remain Malcolm's certified acts. My old admin account enters a separate impersonation review. Franklin Lowe's note receives a preservation request. Jonah's delegation is suspended pending a board vote, slowing every vendor exception during active closures.

Hart directs the city to place an observer at that suspension vote. Rina requires manual exception logs until the board adopts a replacement rule. Each urgent vendor request must identify amount, safety effect, worker effect, and two independent approvers. The new friction may delay needed parts. The old convenience let unchecked power enter certified reports. We choose visible delay.

As the technician locks the terminal, the trustee liaison calls Hart.

She reads the third filing's delegation clause aloud, then the exception totals Malcolm accepted.

"The false certification is no longer only about a stolen signature," she says. "One legitimate signature gave Jonah unchecked authority and certified that the authority was controlled."

Malcolm's genuine filing may cost the company more than the forged one.