<a id="week-04-day-05"></a>

#### Day 20 — Hand investigation a claim-to-source package and bounded queue

**Theory and mechanism.** A preservation handoff defines which claims an investigator can test next without improving the source by narration. Link each claim to its source/copy reference, receipt time, integrity/provenance status, inference limit and next accepting role. Keep the evidence ledger separate from a hypothesis table: observations remain traceable even when a preferred explanation changes. Preservation establishes usable inputs for investigation; it does not establish an actor or root cause.

At **09:22**, C09 offers supplied identity detail associating `s-77` with client `runner-03`, within the reported two rows. C03/C09 may motivate an identity correlation question, while C05 still has a blank session field and `q-144`. No direct session-to-application-request join has been supplied. C10 offers a pictured UI symptom with conditional time and unknown cache/context. C11/C12 have not arrived and must not appear as evidence in this handoff. A new analytical identifier can organize notes but cannot replace a missing producer identifier.

**Worked contrast.** “Evidence verified; runner-03 edited S42” promotes an incomplete receipt into a causal conclusion. A bounded alternative says: “C09 copy received according to the case at 09:18; original object/query/digest absent. Its supplied rows associate s-77 with runner-03, but C05 supplies no matching session field. C10 received at 09:22 depicts an unavailable UI; backend and capture context unverified. Preserve these limits while requesting source-specific discriminators.” The latter is actionable because it names the next missing evidence, not merely “investigate further.”

Build a two-request queue using **loss risk and decision value**, not the number of blank cells. First, ask the identity custodian under the actual approval to supply C09's source object/version, exact selectors and method, collection/transfer history and byte count/digest if measured. If a fresh collection or wider scope is needed, seek its own approval rather than presuming the old approval covers it. C08 reports 10:00 expiry; at 09:22 the nominal interval is 38 minutes, but no guaranteed execution budget or source hold follows from that arithmetic. A custody gap remains a gap after expiry unless supported later evidence resolves it.

Second, seek a permitted, minimized authoritative S42 state/version and relevant last-change reference from the application/service owner. State which source is authoritative and when the read is performed; a future current-state observation is not a measured historical value. These requests can be handled in parallel if custodians and permissions allow. Rank identity preservation first under the supplied loss warning, but permit a justified alternative scheduling if an owner identifies a more urgent service consequence. Do not drop the first request's deadline merely because the state check is easier.

**Review trigger and stopping rule.** Propose a supervisor review at 09:30, earlier if a usable receipt or verified major service harm arrives. This is a new **proposed checkpoint**, not a CTN card or observed action. If the accepting custodian, permission or method is missing, escalate the blocked request and document the residual loss risk. If a digest mismatch appears in a future check, retain the discrepant versions and seek an authorized comparison; do not overwrite a copy or declare intentional tampering. Keep the distinction between source hold, case copy, derivative and checked result visible.

**Practice and limit.** Complete [EX020](#exercise-ex020): two bounded requests, review/stop conditions and a short source-linked handoff at 09:22. Use the [worked answer](#answer-ex020) to test whether another analyst can identify the unknowns without inventing a completed operation. This package prepares Chapter 5's hypotheses and timeline; it does not close the case or release later cards.

**Continue studying — course Day 20:** [Previous: Day 19](#week-04-day-04) · [Week 4 index](#ch-04) · [Course index](../SUBJECTS.md) · [Next: Week 5, Day 21](#week-05-day-01).

### Exercise for this lesson

<a id="exercise-ex020"></a>
**EX020 — Preservation queue.** Objective: hand investigation a source-linked, executable-under-approval plan. Input: C08–C10, relevant earlier cards and the S42 question at 09:22; no C11 or later card. Rank two bounded follow-up requests by reported loss risk and decision value. For each name the accepting custodian, supplied versus pending approval, scope, discriminator, next receipt and review/stop condition. Add a 90–150-word handoff identifying C09/C10 limits and the missing session-to-request join. A proposed review time is not a new case observation; a future current-state read does not establish historical state. Rubric: 0 = invented result/permission or causal attribution; 1 = plausible two-request queue with incomplete source, authority or reassessment fields; 2 = actionable bounded queue and honest handoff with distinct preservation and state questions. Justified scheduling alternatives may pass if they retain the loss warning and permission boundaries. [Worked answer](#answer-ex020).

## Worked answers

<a id="answer-ex020"></a>
**EX020 — Model queue.** First ask the identity custodian, under the case approval, for the C09 source object ID, exact bounded query, byte count/digest and collection method before the stated 10:00 source expiry; this can determine whether an analysable copy exists. In parallel ask the service/application owner for an approved read-only S42 authoritative-state and last-change check with minimal fields; it can distinguish current state from a displayed symptom. Neither follow-up result has arrived in the case at 09:22. Reasonable ordering can differ if the learner preserves the deadline, authority and discriminator.

**Additional worked reasoning (EX020 — Decision-oriented two-source queue.):** Request the C09 producer/export metadata and actual bounded query/collection receipt from the identity custodian under the existing approval, before the reported 10:00 expiry when possible. Separately request an authorized read-only S42 current version/value and last-change reference from the application/service owner, with minimal fields. The first improves evidence availability/provenance; the second informs business impact. They can proceed in parallel if custodians and permissions permit, but neither result was supplied at 09:22. Preserve those distinct questions instead of broadening the export.

**C4 byte-integrity extension — worked laboratory result.**

~~~text
C4|length 34 SHA256 1407e98f466990ff5aa4eee42cd30291826490e2c910ee57887824e6946136cc
C4|mutated_length 34 SHA256 c4ad3cfb2707356a80767e6555ce8c7ff92f7ef549d8f128468de23a1ce13e61
C4|equal_digests False
~~~

The 34-byte V4 fixture and one-byte variant have identical lengths but different SHA-256 values. This establishes a difference between those classroom byte strings only. C09's original object, method, byte count and digest remain unavailable; the V4 digest must never populate its evidence receipt. A correct EX018 explanation keeps source authenticity, completeness and decision relevance distinct from byte integrity.

**Week 4 Day 20 — worked queue and handoff.**

| Proposed request | Role and authority | Next evidence / discriminator | Review and stop condition |
|---|---|---|---|
| C09 bounded acquisition clarification | Identity custodian under the supplied case approval; confirm whether any fresh/wider operation needs another decision | Source object/version, exact query/method, acquisition/transfer record and actual byte count/digest if measured; distinguish received copy from complete producer scope | Before reported 10:00 loss when possible; propose 09:30 supervisor review and escalate earlier if acceptance/method is blocked; never silently widen scope |
| S42 authoritative-state and last-change comparison | Application/service owner; an approved read-only method is still to be established in this case | Minimal status/value, version/request reference, source and read time; distinguish current state from screenshot interpretation | Review on actual result or 09:30 proposal; stop if permission/source meaning is unclear; do not backdate a future read |

These are requests, not new case receipts. Identity work is ranked first under the source-loss warning; concurrent scheduling is acceptable with distinct custodians and permissions. At 09:22, 38 nominal minutes remain to C08's reported expiry, but neither a guaranteed execution window nor a working source hold is supplied.

**Model handoff:** “At 09:22, C09 supplies a received IdP copy with reported 09:16 approval, but source object, query and byte checks remain missing. Its two supplied rows associate s-77 with runner-03; they do not join that session to q-144. C10 depicts S42 unavailable with conditional 09:21 UTC display time; capture clock, cache and authoritative state are unverified. Ask the identity custodian for bounded acquisition metadata before the reported 10:00 expiry, confirming any new operation's permission. Separately seek an approved application-owner S42 value/version and last-change comparison. Propose review at 09:30 or earlier on a usable receipt or verified major harm. No new collection, state result or account action is claimed.”

This message carries claim-to-source limits into investigation. C11/C12 are unavailable, and neither request's expected result can be written as received. Current-state evidence may inform impact while historical cause still needs its own validated identifiers and time basis.