The data downloaded from the keypad by the security company seems to show tampering, in my admittedly unlearned opinion.
#14 on the activity log is Opening by User Code 03 at 6:09a on 6/28/15.
Immediately after that is:
Secure System Before Arming
I looked up a user manual and learned this will display when a window or door is open or when there is motion in an area covered by motion detectors.
In Stay mode the door and window sensors are active but the motion detectors are not. The Sievers used Stay mode even when they were away because the dogs and cat would set off the motion detectors.
The next item on the activity log is BS arming the system at 8:01a on Sunday morning. This should have been #13 (they are in reverse order, more recent having a lower number than earlier). However, it was logged as #14 again, just like the 6:09a Opening.
CWW used to work for a security company. IMO, the reason he disarmed the system at 6:09a was so that he could tamper with it so that it would not work correctly from that point on.
When BS Closed at 8:01a, it armed in Away mode. She would not have done that as she knew the dogs would trigger the motion detectors in Away mode. She specified this in her interview.
Additionally, even though the system was armed in Away mode from 8:01a until BS returned at about 4pm, the dogs did not trigger the motion detectors. She was very surprised and puzzled by this when the detective showed her it had been armed in Away mode.
I'm thinking CWW tampered with the keypad, the sensor on the door between the garage and laundry room, and the motion sensors. He wanted to ensure they could enter later without setting off the alarm and without needing to disarm the system with the keypad.
I think BS leaving the system disarmed that afternoon was just a coincidence. IMO, it wouldn't have worked properly that evening even if she had armed it.