Chapter 4
The mansion security audit embarrassed Luca more than the police interviews.
He expected to find:
one stolen key.
one rogue consultant.
one exploited camera cabinet.
Instead he found a house designed around familiarity.
Familiar staff.
familiar vendors.
familiar family.
familiar shortcuts.
A system that worked until someone decided familiarity was permission.
The audit was led by Priya Shah, an independent physical-security consultant with no prior Moretti relationship.
Her first finding:
Too many mechanical keys.
Thirty-seven active service keys.
twelve duplicates.
five unlogged copies.
three locks using same keyway across unrelated rooms.
Emma’s spare ring alone opened seven doors.
“Why?” Priya asked.
House manager Paul Givens said:
“Convenience.”
There.
Convenience.
Then:
No sign-out log.
Keys lived in:
drawer.
hook cabinet.
desk.
one trusted employee’s apron.
Not criminal.
Normal old-house behavior.
Then cameras.
Rear terrace camera had battery backup.
Good.
Network hub did not.
Bad.
Hub cabinet lock:
same key as maintenance closet.
Worse.
No tamper alarm.
Then guest Wi-Fi.
Separated from security network.
Good.
But local admin console in library allowed policy changes if physically accessed.
No multifactor requirement for local changes.
Gavin had changed screen-lock setting during wedding walk-through.
How?
Nina Brooks, executive assistant, had given him temporary access to “test presentation connectivity” because Sofia introduced him as event risk consultant.
Nina felt sick.
“I let him touch the computer.”
Priya asked:
“Did you know what he was doing?”
“No.”
“Were you told he was authorized by Luca?”
“Sofia said he was wedding security.”
That was plausible.
No discipline yet.
The system failed to verify vendor scope.
Then household staffing sheet.
Why did Sofia have it?
Wedding planning.
It included:
staff names.
roles.
availability.
uniform notes.
meal timing.
Too much.
House manager sent it without redaction because Sofia was future spouse.
Again:
status becomes access.
Then Luca.
Priya asked:
“Did you ever tell staff Sofia could authorize vendors?”
He thought.
“Probably.”
“Probably is not policy.”
He hated that.
Then:
“Did she have general household authority?”
“In practice.”
“Documented?”
“No.”
There.
He had allowed ambiguous power.
Sofia abused it, but ambiguity came from him too.
Then weapons.
Private security response was mostly disciplined.
But two guards had no direct radio channel with arriving police.
Risk.
One almost moved into line of responding officers.
Changed:
shared incident protocol.
visible identification.
preplanned police handoff.
No fortress.
Just clearer.
Then locked doors.
Priya recommended electronic access logs for service corridors.
Luca resisted.
“I don’t want staff tracked every second.”
Good concern.
Solution:
log door access, not employee movement beyond need.
role-based badges.
mechanical override sealed.
privacy policy.
retention limits.
Emma appreciated being asked.
Then staff-office keys.
No more personal ring with seven critical doors.
Emma received badge for areas she needed.
mechanical housekeeping key for low-security rooms.
no maintenance hub.
She said:
“I feel demoted.”
Priya smiled.
“You’re less burdened.”
True.
Then Sofia’s actions.
Could better security have prevented?
Maybe.
If:
vendor authorization required Luca or Marco.
key duplication controlled.
maintenance cabinet unique lock.
tamper alert.
screen admin required separate credentials.
Yes.
But that did not erase Sofia’s decision.
Security is not excuse for betrayal.
It is what you fix after discovering betrayal should not have been enough.
Then North Harbor investigation.
Dennis Croft was arrested on charges related to attempted burglary conspiracy and obstruction, not customs fraud initially.
Gavin Reed remained missing.
Victor Kane cooperated partly.
Mason Pike, terrace shooter, was arrested later in Wisconsin.
Fourth attacker, Luis Mercer, surrendered.
None were mafia soldiers.
Contract criminals.
That disappointed headlines.
Media called it:
MORETTI MANSION SHOOTOUT.
Luca hated.
Sofia’s name leaked.
Articles:
FIANCÉE INSIDE JOB?
Too strong.
Her lawyer issued:
Ms. Bellandi acknowledges unauthorized security-testing decisions that compromised household access. She denies knowing about or agreeing to any armed intrusion, theft, or attack. Evidence released to date supports that distinction.
Accurate.
Then Luca’s company statement:
No comment on personal relationship. Moretti Holdings is cooperating with law enforcement and has paused North Harbor transaction.
No:
we were betrayed by love.
No theatrics.
Then Emma.
Her bruises faded.
Sleep did not improve.
She woke at sounds.
Dropped a plate when delivery truck backfired.
House manager suggested counseling through employee assistance.
She said maybe.
No forced arc.
She eventually went once.
Not because “therapy fixes trauma.”
Because she wanted to sleep.
She learned grounding exercises.
still hated fireworks.
still worked.
Practical.
Then Victor’s grabbing her.
Prosecutors asked if she wanted to submit victim-impact statement later.
She said:
“Maybe when there’s a sentence.”
Good.
No demand now.
Then Sofia sent Emma a letter.
Through counsel.
Emma did not open for a week.
Then did.
Sofia wrote:
I took your spare keys without your permission. I told myself it was temporary and for Luca’s safety. That was a lie I used to make the decision feel cleaner. I did not know Gavin would use the access for an armed theft. I understand that does not change what my choice exposed you to. I am sorry.
Emma read.
No:
please forgive.
Then:
You do not owe me a response.
Good.
Emma put letter in drawer.
Did not reply.
Then Luca asked Emma whether she wanted Sofia banned permanently from property.
That was not Emma’s decision.
She said:
“It’s your house.”
Then:
“But if she comes while I work, I want to know first.”
Reasonable.
Luca agreed.
Sofia did not come.
Then Priya found one more issue.
The black red-file case was not in a safe.
It was in a library cabinet with a high-quality mechanical lock.
Why?
Luca liked paper.
She stared.
“Then use a safe.”
He bought one.
Not huge.
Fire-rated.
access logged.
whistleblower identities separated from business analysis.
Jeremy Lin’s name removed from routine due diligence copy.
Code name used.
Identity stored with counsel.
That reform mattered beyond one house.
Then Luca’s corporate security team reviewed whistleblower handling company-wide.
They found three other reports where names appeared unnecessarily in executive summaries.
Not leaks.
Bad practice.
Corrected.
The attack uncovered flaws that had nothing to do with Sofia.
Then police asked Luca whether he wanted recovered bullet damage preserved until trial.
Photographs and trajectory scans complete.
No.
He repaired dining room.
Emma watched workers replace glass.
The marble column retained a small patched area.
No plaque.
No reminder.
At first Luca considered leaving the bullet chip visible.
Then decided against.
A house does not owe violence permanent architectural authority.
The audit also forced Luca to review how household staff had been treated before the attack.
Not badly.
That was almost the problem.
The house ran on unwritten assumptions because everyone believed goodwill was enough.
One assistant could approve flowers.
another could admit caterers.
Sofia could wave in wedding vendors.
Marco could override names at gate.
Luca could text:
Let them through.
Every exception made sense alone.
Together they created a culture in which asking for formal authorization felt rude.
Priya asked the staff:
“Who is allowed to tell you to ignore procedure?”
No one answered.
Then one cook said:
“Mr. Moretti.”
Priya looked at Luca.
He smiled without humor.
“Fair.”
New rule:
Emergency override existed, but even Luca’s override generated a record and second confirmation for high-security spaces.
He agreed.
Then staff asked:
“What if he gets mad?”
Luca said:
“Then write that too.”
They laughed.
He meant it.
A system that depends on the owner always being reasonable is not a system.
Then the audit reviewed wedding planning itself.
Sofia had been coordinating:
florists.
lighting.
catering.
musicians.
security.
transport.
That gave her access to schedules and floor plans far beyond what a normal guest would have.
Could the wedding have happened safely?
Yes.
But vendor data should have been split.
Florist did not need staff roster.
band did not need service-camera locations.
planner did not need maintenance keys.
The new event protocol separated information by need.
Emma helped write it.
One checklist item:
No household spare key may leave custody for “testing,” photography, fitting, copying, or convenience without documented authorization.
She looked at the line.
“Very specific.”
Priya said:
“Good policies often come from very specific stupidity.”
Emma laughed.
Then the house manager asked whether Sofia’s future visits, if any, should require escort.
Luca answered:
“She is not banned.”
Priya asked:
“Then what status?”
“Guest.”
There.
Not former fiancée.
Not suspect.
Not family.
Guest.
If invited, she would use guest access like anyone else.
That clarity felt cruel for a second.
Then clean.
Then Luca’s company adopted a parallel rule for sensitive data.
Family members had no implied access to corporate systems.
One executive complained:
“My spouse helps me all the time.”
“Then give them a role if appropriate,” compliance said.
Not intimacy as credential.
The attack had happened in a home.
Its lesson belonged anywhere power blurred with relationship.
Then Emma’s counseling became more practical.
Her clinician asked what scared her most.
“Being grabbed.”
Then:
“And not knowing who knew what.”
Those were different.
The first was physical memory.
The second was uncertainty.
For the first:
breathing.
orientation.
sleep work.
For the second:
she had to accept she would never know every thought before the attack.
That irritated her.
“I want the complete timeline.”
“You have most of it.”
“I want all.”
“Why?”
“So it makes sense.”
The clinician said:
“It may never make enough sense to feel deserved.”
Emma hated that sentence.
Then eventually liked it.
Understanding is not the same as making violence reasonable.
Then one day Victor Kane’s plea documents answered a small question.
Why did he grab Emma’s left arm instead of reaching for apron keys?
Because Gavin’s briefing said:
spare keys worn at left waist.
Emma had changed apron style that day.
The keys were not there.
Victor improvised.
That detail made her sick.
Then oddly relieved.
He had not chosen her personally.
She had been a line in a briefing.
That was dehumanizing.
Also clarifying.
She no longer searched her memory for some expression that “made him” pick her.
Nothing she did caused it.
She was near the route.
May you like
He expected keys.
That was all.
