Follow the evidence: three possible incidents

Course · Part 6 · Part 6 exercises · Notebook · Example bank

Self-study after Part 6 · slide 45 (notebook lesson 6). Core investigation: Case A, then compare one contrasting case; all three cases are further practice. A request log, a missing response and a resolved badge do not tell you which actor changed a ticket. Compare three authored cases with the same initial timeline.

Teaching steps: predict, do, observe, explain

1. Choose Case A and Evidence is insufficient. Check the conclusion. The status badge alone does not establish who changed the ticket.

2. Request Ticket history and Operation result. Match actor and operation ID, then select the explanation supported by those records.

3. Request Approval record before judging authority. Keep the difference between execution evidence and approval evidence visible.

4. Try Case B or C. The starting screen is identical. Name the decisive record and explain why blind retry can repeat an existing effect.

The in-demo step controls move between instructions. They never perform the next experiment for you. Record one observation before moving on.

Predict, try, explain

1. Start with Case A. Predict whether the current screen establishes closure by the assistant. Keep the explanation at Evidence is insufficient and check it.

2. Request Ticket history and Operation result. Compare the acting principal and operation identifier. Request the approval record, choose a supported explanation and check it.

3. Try Case B or Case C. The initial timeline is unchanged. Use a different explanation only when the correlated records support it. State a containment step and why a blind retry would be unsafe.

Record: I changed ___. I predicted ___. I observed ___. This does not establish ___.

More experiments

Solve all three cases. Distinguish missing acknowledgement after a commit, a separate human operation and a stale interface. Write a test card for an unavailable dependency and an owner’s restoration decision.

What this example establishes

These are deterministic authored incident records. The activity practises choosing evidence and stating bounded conclusions. It does not run a language model, alter real tickets or inject a real backend outage.

Explain it to your partner

Question: The interface says resolved and the tool response is missing. What would you inspect before retrying?

Take 30 seconds each: point to the input, name the one change, then cite an observation from your run. A useful explanation: Use the authoritative ticket history and correlated operation result to identify the cause; inspect approval separately.

Read next: Concept and research connection. The reading is optional; you do not need its mathematics for this exercise.