KN-17 · Incident report blind spots
During a production host move on November 4–5, 2026, the operator worked with the reporting agent’s session closed. The agent returned to a failed container engine, repaired it in 27 minutes and wrote a report. We compared that report with records from the rest of the team.
The team had agreed an order, a window and a rollback time. The operator started earlier and performed the move himself. When the reporting agent returned, it journaled its repair, marked which findings were proven or inferred, and corrected three statements within 50 minutes. The report captured the repair and what the reporting agent could see of the surrounding work.
| Open item | What the wider record showed |
|---|---|
| Inconsistent scheduler triggers | A live question. Another reader counted 136 of 154 signals in seven days following a pass that produced no result. |
| Unknown writer | The agent’s prior deployment and the operator’s editor accounted for the two writes. |
| Credential exposure in an old log | A real concern predating the incident by 24 days. |
| Temporary file share | A deliberate migration bridge already removed 18 minutes before the report was sent. |
The unknown writer stood for 50 minutes. The operator initially did not remember making the edit, and the agent saw no matching agent call. Editor history identified the operator’s change. It also showed that the script blamed for a large rewrite had itself been edited. The operator’s editor produced 481 saves across 397 files in about five minutes, according to the reporting agent’s review of the history.
The letter covered one of 12 preparation or gating steps. The attached journal included eight, including the one in the letter. Four appeared in neither. They took place in a second tool while the reporting agent was closed. The later review drew on the second tool’s logs to recover them.
| Preparation | Letter | Journal |
|---|---|---|
| Cancel the running job | No | Yes |
| Stop the scheduler | No | Yes |
| Shut down the container engine cleanly | No | Yes |
| Set the journal’s scope and format | No | Yes |
| Take five full, checksummed backups with writes stopped | Yes | Yes |
| Use a read-only watcher | No | Yes |
| Wait for the nightly backup before removing copies | No | Yes |
| Back up the system database again after settings changed | No | Yes |
| Apply a deny hook before using a second tool | No | No |
| Require the migration tool to apply its recorded plan | No | No |
| Obtain three reviews of the tool by different models | No | No |
| Run the migration tool on copies before the real run | No | No |
The report also described database backup files on a single disk and a host snapshot predating the move. A follow-up 17 minutes later recorded a new host snapshot. The wider evidence described an independent nightly host backup on a separate disk. Readers carried the single-disk concern forward after those other records were available.
Figure 01Field measurement
Preparation or gating steps
The journal covered eight of 12 steps, including the letter’s one step. The later review recovered the other four from a second tool’s records. This describes one incident.
| Reader | Read first | Claims |
|---|---|---|
| Advisor | Letters, journal and evidence index | 5 |
| IT reviewer | Letters and host notes | 2 |
| Data lead | Letters and own log | 2 |
Each reader had a 100,000-token budget and discretion over what to read. The advisor’s five claims included judgments about the operator’s preparation, the second tool, the temporary share, backup risk and the status of paused work. The session logs changed the first three. Other conversations settled the backup and work status before the advisor began reading. The IT reviewer and data lead each carried two claims forward. One reader authored this note and counted their own claims after the operator pointed to the session logs.
| Record | Scope | What it clarified |
|---|---|---|
| Operator turns in the repair chat | 117 turns, 14 KB in a 1.8 MB log | Sequence, reasons and preparation |
| Editor history | 481 saves | Who edited the file and what made the rewrite |
| Second tool’s session logs | 42 operator turns | Fence, recorded plan and reviews |
| Prior deployment record | One entry | The earlier write by the reporting agent |
| Other agents’ conversations | About 12 turns | Host backup and release of the work pause |
The evidence folder contained 321 files. The note reports that about 20 KB of targeted evidence was enough to recover the main picture without opening every file in full. The operator’s own turns supplied the sequence and intent. The other records gave readers ways to check it. Asking the operator also supplied a frame the logs alone did not give. The move was deliberate and much of it held.
Related notes cover evidence routes, claims changing in a handoff and review before a script’s first run.
This is one night, one operator and one team. The original note counted entries in four reports, a 50-entry journal, a 321-file evidence folder and several session logs. The authors did not inspect the host directly. The reporting agent supplied the editor history figures, and the data lead supplied the scheduler count from her own inspection.
Whether a reader carried a claim past the available record was a judgment made after the review. The three readers started with different sources. One authored the note, and the other readers’ counts may understate what they repeated. Limited vantage is the note’s interpretation, not a measured effect. The incident and the reading exercise were not reproduced for publication. Operational identifiers and source records remain private.