Beneath them, I recorded the words Richard had used about the packet being complete.

I left space beside that entry for a name and an approval number.

Then I wrote one question across the next line.

Who caused the promotion file to appear fully authorized before verification was complete?

I copied the pale rectangular impression from the folder onto a scrap of paper, noting its position without guessing what had been removed.

The scrap went inside the notebook beside the timestamp.

I closed the notebook over it.