<a id="week-05-day-03"></a>

#### Day 23 — Keep mechanism, permission and display hypotheses distinct

**Theory and mechanism.** A hypothesis is a claim about how observations could arise, with assumptions and a possible contradictory result. It is neither a confirmed event nor an exhaustive list of causes. Separate mechanism, authorization, current business state and actor: these are different questions. Scheduled automation can perform unauthorized work; authorized work can produce an incorrect state; a stale display can coexist with a genuine edit. Do not force the three teaching hypotheses into mutually exclusive choices before testing their premises.

At 09:26, H1 proposes an automated wrong-slot write. Its leads include C07's scheduled use, C09's client and C12's tag; none supplies a validated scheduler run. H2 proposes shared-account use outside approved scope. C05 and C06 motivate that concern, but an omission from a visible calendar is not a complete authorization search. C11's statement gives a lead to examine, not a reason to mark H2 false. H3 asks whether the displayed symptom diverges from authoritative state. It does not erase C05's recorded edit or its unknown effect.

**Worked contrast.** “The manifest has no q-144, therefore a human did it” makes two unsupported jumps. First establish whether the manifest is authentic, complete for the relevant interval and route, and uses comparable request identifiers. Only then could exclusion weaken the specific scheduled-run explanation. Even that result would not choose a human actor over another unexamined technical path. A partial manifest with no matching row instead leaves the requested relationship unresolved.

An addendum illustrates a different axis. A valid versioned S42 authorization covering the exact operation and effective time would weaken the **outside-approval** claim. It would not prove that a scheduler emitted `q-144`, that the operation executed correctly or that current S42 state is correct. If the only source is C11's recollection, mark the document not supplied and request it from the change authority. Approval, mechanism and outcome cannot substitute for one another.

| Conditional result, not yet collected | Hypothesis component it would change | What would remain open |
|---|---|---|
| Complete, validated run manifest excludes `q-144` | Weakens the specified H1 route | Other automated paths, actor and actual authorization |
| Applicable S42 approval is substantiated | Weakens H2's outside-approval premise | Actual origin, execution correctness and present state |
| Permitted read finds incorrect authoritative S42 state | Refutes a solely display-only account of that state at that read time | Historical state, cause and whether caching also contributed |

**Decision.** Write strengthening and weakening results before requesting evidence. If the query is blocked, delayed, incomplete or lacks the necessary field, state which comparison remains unavailable. A denied collection is an authority/access limitation, not evidence that a hypothesis is true. Likewise no matching record is useful negative evidence only within a justified source, scope and visibility contract. The [NIST incident-response recommendations](https://csrc.nist.gov/pubs/sp/800/61/r3/final) provide response context; this hypothesis matrix and CTN priority remain local teaching constructions.

**Practice and limit.** Complete [EX023](#exercise-ex023) with H1/H2/H3, one supported lead, one tension and a source-bounded support/falsification pair per row. Explain one overlap between the hypotheses. Compare the [worked answer](#answer-ex023). All requested outcomes remain hypothetical; the current record does not identify a human, a malicious intent or a verified causal path.

**Continue studying — course Day 23:** [Previous: Day 22](#week-05-day-02) · [Week 5 index](#ch-05) · [Course index](../SUBJECTS.md) · [Next: Day 24](#week-05-day-04).

### Exercise for this lesson

<a id="exercise-ex023"></a>
**EX023 — Hypothesis matrix.** Objective: test mechanism, authorization and display explanations without forcing a single story. Input: C05–C12 at 09:26 and Day 23. Write H1/H2/H3 with a source-backed lead, tension, minimal requested source, a supporting result and a result that would weaken the claim. State the completeness/identifier assumption for negative evidence, one overlap between hypotheses, and the meaning of an unavailable result. Keep C11's addendum and C12's origin tag unverified. Rubric: 0 = invented discriminator result, human actor or definitive closure; 1 = plausible rows but reversed support/falsification or missing coverage assumptions; 2 = conditional source-specific tests, correctly directed results and explicit non-exclusivity. [Worked answer](#answer-ex023).

## Worked answers

<a id="answer-ex023"></a>
**EX023 — Model hypotheses.** H1, scheduled-job wrong-slot change: C09 runner client and C12 batch tag support a lead; C06 excludes visible S42 approval and run/request join is absent; request a preserved run record keyed to `q-144` plus approved slot list. H2, unauthorized emergency use: C07 establishes a shared-account possibility and C05 reports an S42 edit; C11 raises an unverified addendum and no human/session join exists; request scoped access trail and signed approval scope. H3, display-only symptom: C10 lacks cache context; C05's reported edit is contrary unless it was authorized, harmless or later reverted; request authoritative S42 state and uncached view comparison. These are competing mechanisms, not mutually exclusive certainties.

**Additional worked reasoning (EX023 — Competing explanations with falsifiers.):** H1 scheduled-job S42 mistake: tag and client are leads, but request/run validation and approved scope are missing; a trustworthy complete job manifest excluding `q-144` would weaken H1. H2 outside-scope account use: visible approval omits S42, but the possible addendum and shared account complicate intent; a valid S42 scope plus correlated authorized run could weaken H2. H3 display/state divergence: screenshot source/cache unknown and C05 reports an edit; a proven incorrect backend state would defeat an exclusively display-only answer. Each row needs a **different authorized check** that could fail; speculative certainty scores zero for source quality.

**Week 5 Day 23 — worked hypothesis directions.** H1's tag/client leads motivate a preserved scheduler-run request; a validated comparable run/request match supports origin, while a complete authenticated relevant manifest excluding `q-144` weakens that specified route. An incomplete manifest is inconclusive. H2's outside-approval premise is motivated by C05/C06 but qualified by C11; an applicable S42 authorization weakens that premise, while a trustworthy complete approval comparison excluding the operation supports concern. Neither result attributes a human or proves correct execution. H3 requires a contemporaneous authoritative-state/view comparison; a verified wrong backend value defeats a solely display-only explanation for that read-time state, while correct backend with an inconsistent view supports display divergence at that time. C05's edit can coexist with caching, and an automated path can also be outside approval. A blocked query changes access status, not hypothesis truth. No discriminator result has been supplied at 09:26.