#### Day 40 — Accept a bounded service outcome and measure only defined intervals **Learning task.** Separate limited service acceptance from incident closure and measured elapsed time from a recovery objective. Release **C30** at 10:45: the 15-minute observation after C29 reports no further unexpected S42 edits or scheduled-job failures **in monitored sources**. The service owner accepts a limited return and assigns two more hours of monitoring plus unresolved actor/provenance work. Assigned monitoring is future work, not a completed clean interval. No observed recurrence is stronger when source coverage and health are known; it is still not proof that unobserved routes cannot recur. **Worked acceptance record.** Keep the data choice (whole restore rejected for S40/S41 regression), C27 audit NO-GO, C28 isolated correction, C29 production authority/action/checks and C30 owner decision as separate rows. The 10:30 first checks cannot be substituted for 10:45 acceptance. C25 supports a specific identity intervention and inactive `s-77`, while the broader identity inventory and human attribution remain limited. Useful new audit does not retroactively repair missing C09 copy provenance or make historical blank actor fields informative. A measurement needs an explicit start, end, clock basis and meaning. From C02 ticket receipt at 09:04 to limited acceptance at 10:45 the supplied interval is **101 minutes**. From ticket receipt to first production check it is 86 minutes; the C29-check-to-C30-acceptance observation is 15 minutes. These are different metrics. CTN supplies no approved RTO threshold or verified outage-onset definition, so neither RTO compliance nor violation can be derived from 101. Similarly, 08:30 snapshot age is not actual data loss: the chosen reconciliation preserves the later legitimate reservations. Do not invent an RPO target or equate backup age with lost work. **Offline W8-CLOCK — endpoints without an invented target.** Python 3 standard library, same-date UTC fixture inputs only. This arithmetic is not monitoring or an authenticated receipt. Predict and reproduce four lines: ~~~python from datetime import datetime def clock8(value): return datetime.strptime(value, "%H:%M") def minutes8(start, end): return int((clock8(end) - clock8(start)).total_seconds() / 60) print("W8 ticket-to-first-check", minutes8("09:04", "10:30")) print("W8 ticket-to-limited-acceptance", minutes8("09:04", "10:45")) print("W8 observed-window", minutes8("10:30", "10:45")) rto_target8 = None print("W8 RTO", "NOT_ASSESSABLE_NO_TARGET" if rto_target8 is None else "COMPARE_DEFINED_ENDPOINTS") ~~~ Exact transcript reproduced in publication validation: ~~~text W8 ticket-to-first-check 86 W8 ticket-to-limited-acceptance 101 W8 observed-window 15 W8 RTO NOT_ASSESSABLE_NO_TARGET ~~~ **Contrast.** “Recovered within RTO in 86 minutes and two hours clean” changes the acceptance endpoint, invents the objective and records future work as finished. A corrected message names 101 minutes between ticket receipt and **limited** acceptance, keeps the 15-minute observed scope, and lists continued monitoring as assigned. A hypothetical objective could be compared only after specifying approved metric endpoints and threshold; it cannot be added to CTN retrospectively. **Worked handoff.** “At 10:45, CTN has a limited owner-accepted return after C29's separately approved production correction and selected checks, followed by C30's 15-minute monitored interval. The S42 candidate preserved legitimate S40/S41 reservations; the intact C26 snapshot was not the whole-business target. C27's actor-field failure remained a no-go and C28 passed only after an isolated mapping correction. C25 addressed the specified identity method/credential/session scope, not every possible access path. Continue the assigned two-hour monitoring, preserve source/change references and reopen on unexpected S42 edits, job or audit failure. Human actor and historical provenance questions remain open; 101 minutes is measured ticket-to-acceptance time, not an RTO result.” This is an explanatory model, not a sent message or a completed future-monitoring report. **Practice and limits.** Complete [EX040](#exercise-ex040) with a 130–190-word handoff and an outside-the-message monitoring card. Finish EX039's C30 timeline portion using the newly released evidence. Compare the [worked answer](#answer-ex040). Name the service/application/identity monitoring responsibilities and next review trigger without inventing a person, telemetry receipt or completed two-hour result. Stop/escalate on wrong values, unexpected writes, scheduled failure or missing required new audit fields under the owner's approved procedure. [Previous: Day 39](#week-08-day-04) · [Week 8 index](#week-08-index) · [Course index](../SUBJECTS.md) · [Next: Week 9, Day 41](#week-09-day-01). ### Exercise for this lesson **EX040 — Recovery handoff.** Objective: transfer limited acceptance with explicit measurement and residual obligations. Inputs: C20–C30 through 10:45, Days 36–40 and W8-CLOCK. Write a 130–190-word handoff covering data choice, C25 scope, C27 failure/C28 isolated correction, C29 production sequence, C30 limited acceptance, unresolved actor/provenance, assigned monitoring and reopen trigger. Outside the message add a monitoring card with responsible roles, sources/coverage questions and unknown future results; reproduce the four clock lines. Distinguish 101 measured minutes from an absent RTO target and snapshot age from actual data loss. No later card or completed two-hour result may be imported. Rubric: 0 = invented objective, closure, source or operation; 1 = accurate summary but missing residual owner/metric boundaries; 2 = usable bounded message, monitoring card and exact arithmetic without RTO/RPO compliance claims. [Worked answer](#answer-ex040). ## Worked answers **EX040 — Model recovery handoff.** “The service owner rejected a whole C26 snapshot restore because it would revert approved S40/S41 reservations. C27's first isolated S42 correction passed visible data checks but failed the preannounced alternate-route audit-actor criterion; no production move followed. C28's revised isolated candidate passed the supplied data, route, audit and rollback checks. C29 then recorded a separate 10:24 production approval, 10:26 execution and 10:30 first checks. C30 reports 15 minutes of observed stability and limited owner acceptance at 10:45, with two more hours of monitoring. C25 confirms only a specific recovery-method/credential action and `s-77` inactive, not every possible access path. The identity of the person behind the unapproved task remains unknown; C09 provenance and broader exposure questions remain assigned. The 09:04-to-10:45 interval is 101 minutes, but CTN supplied no RTO target, so no RTO pass is claimed.” **Additional professional worked reasoning:** The measured 101 minutes run from C02 ticket receipt 09:04 to limited C30 acceptance 10:45; they are not proof of RTO compliance because an approved target and validated outage-start definition are absent. Cite C25's particular identity check, C26's full-restore regression, C27 no-go, C28 isolated pass, C29 production sequence and C30 limited acceptance. Leave other identity paths, later monitoring, privacy consequences and actor attribution open. **C8 recovery-gate extension — worked laboratory result.** ~~~text C8 snapshot mismatch: S40,S41 C8 current mismatch: S42 C8 C27 NO-GO C8 C28 GO ~~~ The whole snapshot would regress S40/S41, while the supplied current state misses the target for S42. `C27 NO-GO` follows the preannounced audit-field failure; its scheduled-route outcome is unknown in the modeled input. `C28 GO` is an isolated rehearsal result, not production authority. EX037 and EX038 require the separate C29 approval/action and a stop if the S42 source version differs from the preserved precondition. **Week 8 Day 40 — worked measurement and monitoring card.** The original model handoff above is within the requested 130–190 words. W8-CLOCK prints ticket-to-first-check 86, ticket-to-limited-acceptance 101, observed-window 15 and RTO NOT_ASSESSABLE_NO_TARGET under W8 prefixes. These same-day arithmetic endpoints are not verified outage onset or an approved RTO comparison; snapshot age is not measured lost work. Outside the message, assign service-owner review with application/job monitoring of S42 values/edits, batch function and required audit fields, plus identity-owner follow-up on remaining access scope. Record source/route/ingestion coverage and a reopen trigger on unexpected edits, regression or missing audit data. C30 assigns two more hours; no completion receipt is supplied. Retain actor/provenance work and distinguish a proposed next observation from a received result. Neither the monitoring plan nor new useful logging repairs historical source gaps or closes the incident.