#### Day 25 — Give containment planners conditional gates, not a completed story **Theory and mechanism.** An investigation handoff should let the next decision owner distinguish observations, inference and proposed action without reopening every raw record. Include checkpoint/version, source-linked facts, quality gaps, competing mechanisms, pending requests, forbidden overclaim and the next authorized decision gate. Preserve the timeline/graph as evidence references; do not flatten their uncertainty into a single case-confidence score. P2 is a provisional allocation of response effort under this book's rubric, not a conclusion about compromise. **Worked contrast.** “The attacker used batch-17, so disable svc-enroll” crosses four unproved boundaries: tag to actual job, job to validated session/request path, path to human actor, and hypothesis to authorized disruption. A defensible alternative reports the self-declared tag, missing joins, visible approval tension and unmeasured current state, then names the source-specific questions needed before a containment proposal. It may recommend preparation of bounded options; it cannot claim those options are approved or executed. At 09:26, C11 and C12 are available but later containment cards are not. A useful handoff states that C12 supplements `q-144` with a tag, not that it shows a second edit or validates a scheduler. It retains C09's acquisition gaps and C10's time/cache limits. It also notes C02's approximate symptom versus C05's 09:01 event as an unresolved timing tension. Do not solve that tension by inventing a clock correction or a hidden earlier edit. | Future condition, not a current result | Next permitted planning question | Gate still required | |---|---|---| | Authoritative state is wrong and a continuing harmful write path is supported | Which narrow reversible control could reduce that path's effect? | Service/identity/change owners decide scope, duration, operator, rollback and verification | | Validated origin and applicable S42 approval explain the operation, with checked service outcome | Is a documented downgrade or non-security defect disposition justified? | Actual acceptance rule and owner review; remaining evidence gaps retained | | Key source, owner or discriminator remains unavailable | What uncertainty and loss risk must be escalated now? | Authorized alternative or explicit blocked status; no automatic broad action | These branches are conditional. The first does not authorize a hold, revocation or account disablement; the second does not prove that all signals were false; the third does not establish safety. If a new source changes a claim, issue a new version with its actual receipt/release time and preserve the earlier rationale. A later observation can improve the next decision without retroactively validating an earlier unsupported assertion. **Decision and limits.** The most useful conclusion may be that technical mechanism is still unresolved while an application record supports a reported edit and current impact remains unmeasured. Naming those separate confidence targets gives the next owner a tractable question. A shared account may prevent individual attribution even after mechanism is clarified. This limits blame, not the team's ability to investigate impact and prepare proportionate protection. **Practice.** Complete [EX025](#exercise-ex025) as a 140–200-word 09:26 handoff plus a separate three-branch gate table. Include at least two unresolved explanations and a proposed checkpoint. Compare the [worked answer](#answer-ex025), ensuring that no later card, completed follow-up, fictitious approval or human actor has entered the record. The end of Week 5 is an investigation handoff; the course and incident remain incomplete. **Continue studying — course Day 25:** [Previous: Day 24](#week-05-day-04) · [Week 5 index](#ch-05) · [Course index](../SUBJECTS.md) · [Next: Week 6, Day 26](#week-06-day-01). ### Exercise for this lesson **EX025 — Professional handoff.** Objective: transfer a source-limited investigation into gated response planning. Input: EX021–EX024 and the 09:26 record through C12. Write a 140–200-word handoff with priority/rationale, source-linked timeline, at least two unresolved explanations, acquisition/identifier gap, proposed requests, forbidden overclaim and a proposed review checkpoint. Outside the message add three conditional planning gates for harmful state, supported authorized explanation and unavailable evidence. No later card, collection receipt, approval or control execution may be invented. Rubric: 0 = unsupported actor/cause or action; 1 = accurate summary but missing alternatives, source limits or actionable gate; 2 = usable bounded message plus conditional gates preserving permission and checkpoint boundaries. [Worked answer](#answer-ex025). ## Worked answers **EX025 — Model handoff.** “CTN-IR-014 is P2 provisional at 09:26 because a reported enrollment symptom and C05 S42 edit merit urgent review, while the affected state and actor remain unknown. C03 reports `s-77` at 08:58; C04's corrected runner event is approximately coincident; C09 supplies client `runner-03` but lacks complete collection metadata. C05 reports `q-144` at 09:01. C12's `batch-17` is a self-reported tag, not a validated job run. C06's visible approval covers S40–S41; C11 suggests an addendum without providing one. C10 depicts an unavailable page, not authoritative S42 state. Scheduled-job error and unauthorized shared-account use remain plausible; display/cache behavior may affect the symptom. Ask the service owner for a bounded S42 state check and the job/application custodians for a `q-144` run record and join semantics. Do not attribute a human or disable the shared account on this record. Reassess after authorized results or before further evidence loss.” **Additional worked reasoning (EX025 — Handoff model.):** “At 09:26, CTN-IR-014 remains P2 provisional: C02 reports an S42 enrollment symptom and C05 records an S42 edit via q-144, but the current authoritative slot state and number affected remain unmeasured. C03 and C09 report session s-77, with C09 naming client runner-03; C04's corrected browser time is near the same minute, without a process-to-session key. C12 attaches an unverified batch-17 tag to q-144, not a proven job run. C06's visible task list covers S40/S41; C11 mentions a possible S42 addendum without producing it. C09 lacks complete source-copy provenance and C10 is a displayed symptom with unverified clock/cache. Ask the service owner for a bounded S42 state check and application/job custodians for a preserved q-144 run and validated join semantics. No human actor, approved control or collected follow-up is established. Review before further source loss or on verified harmful change.” A 140–200-word answer should preserve two live explanations, one explicit forbidden overclaim, scope/authority and next gate. **C5 join-audit extension — worked laboratory result.** ~~~text C5|C03<->C09|session_id|s-77|match=True C5|C05<->C12|request_id|q-144|match=True C5|s-77_to_q-144|DIRECT_JOIN=NO ~~~ Two specified fields match within the supplied fictional rows; the direct session-to-request edge is absent. The printed `DIRECT_JOIN=NO` is an analyst annotation, not an independently calculated causal finding. EX022 earns full credit only if the student requests identifier-namespace validation, declines human attribution and treats a missing key as unknown rather than proof of unrelated events. **Week 5 Day 25 — worked planning handoff.** “At 09:26, CTN-IR-014 remains P2 provisional because a reported S42 symptom and edit warrant bounded review while current harm and cause remain unmeasured. C05 reports q-144 at 09:01; C12 adds a self-reported batch-17 tag, not a validated run. C03/C09 report s-77; C09 associates runner-03, but C04 supplies no process/session join and C05 has no session key. C02's approximate symptom time remains in tension with the edit time. C06 lists S40/S41; C11's possible S42 addendum is unprovided. C09's acquisition metadata and C10's clock/cache context remain incomplete. Scheduled error and outside-scope use remain unresolved; display divergence can coexist. Request approved S42 state/version and bounded job/request evidence, with a separate change-authority referral. Do not attribute a human or disable the account on these records. Propose review at 09:35 or earlier on verified harm, usable receipts or threatened source loss. No follow-up collection or control is claimed.” Outside the message, record three gates: (1) verified wrong state plus continuing harmful path → seek bounded control options and actual owner approval, operator/rollback/verification; (2) validated origin plus applicable scope and checked service outcome → seek an owner-led disposition review, retaining residual gaps; (3) unavailable source/owner → escalate the blocked decision and preservation risk, with no inferred safety or authority. These are future branches, not later case facts. The message's word limit excludes this gate table/annotation.