He knows when the enemy will come. Does he know for whom?
A character takes a warning seriously but protects against the wrong danger. Make the mistaken assumption shape the precautions.
Use the end of a repeated routine to suggest that somebody's hidden preparations are complete.
Full solution and timing explanation of The Red-Headed League.
After weeks of copying work, Wilson finds the League dissolved. The disappearance of his paid routine is what brings him to Holmes.
Holmes interprets closure as a sign that keeping Wilson absent is no longer necessary and the tunnel is complete. He combines that with the danger of discovery or removal of the bullion, and the weekend escape window, to anticipate the attempt that night.
Closure alone does not logically prove the exact hour or motive. Present the detective's reasoning as an inference supported by context, not infallibility.
The Red-Headed League: Holmes's final explanation of why the attempt was expected that night. ↗
The Red-Headed League only
A routine may exist because it serves another plan. When it stops, the investigator can ask what has changed for the person maintaining it. That creates a hypothesis about the next step, not a precise deadline by itself. A separate clue must explain why the response cannot wait.
Choose a repeated action your antagonist needs only during preparation. Establish it before it stops. Write two explanations for the change, then add an independent fact that favors one and narrows the time available. Make the investigator act on an inference they can explain.
Use in my storyA character takes a warning seriously but protects against the wrong danger. Make the mistaken assumption shape the precautions.
Introduce a capable character with missing memories by showing what they can do before asking what they know about themselves.
Build a mystery around sincere witness statements whose ordinary wording leaves out something crucial.