NSTD-INCIDENT - Repair a fluent account that implies an unsettled cause

• Situation: An incident account turns an observed sequence into an established causal explanation.
• Question: How can it explain the known events and decisions while preserving what remains unresolved?
• First useful result or blocker: An account suited to the audience’s question, or the causal result still needed for its decision.
• Start with: NSTD.3 for support of the event connections, using the supplied log and intended use.
• Stop or return: Finish with an accurate account of known events when that answers the question; obtain the causal investigation result when the decision requires it.

A team has a polished account of a service incident. Its constructed source log records a configuration change at 14:00, failed requests at 14:02, a rollback at 14:05 and restored service at 14:07. The causal investigation is still open. The draft says the change caused the failure and the rollback fixed it.

The existing source and intended use let the team enter NSTD.3 directly. It separates the observed sequence from the two causal claims. NSTD.2 then preserves chronology while making the unresolved explanation visible: the setting changed before the failures, and service returned after rollback; the log alone does not establish why. If the audience needs a causal conclusion to choose a remedy, the question returns to the investigation. If it needs an accurate account of known events, the corrected account can already serve that use.

NSTD.4 examines the account’s operator viewpoint. A source-backed description of what the operator saw can explain the rollback decision; selecting that viewpoint does not establish the operator’s responsibility for the original failure. The account should expose any other recorded condition that changes that interpretation. NSTD.5 may preserve the urgency and unresolved question without presenting the confident ending that the investigation has not supplied.

NSTD.6 tests the repaired version for that audience and use. Ask what happened, which explanation remains a hypothesis, and what information would be needed for the proposed remedy. Keep the response obtained before extra help. An expert walkthrough, an actual reader’s response and a formal estimate support different conclusions. If the reader still reconstructs a settled cause, repair the sentence or ordering that produces that reading and check the affected part again. If a later investigation establishes a mechanism, return its result to the explanation and reconsider the dependent conclusion.