After All Three Entry Conditions Pass
At 13:00 Tuesday, Ye Cheng reads V3’s entry: h=4.4, within 4.2–4.5; C1 reference r=0.2, with absolute value no greater than 0.3; and d=1.9 under S-3, no greater than 2.0.
The 14:00–16:00 window, scope, and version are unchanged, and the seven existing commitments have not increased. X17-1’s cash, capacity, version, and entry constraints all pass.
At 13:10, Gu Ning releases one Tuesday slot and one unit of original unallocated capacity. Path A becomes executable; B and C remain unauthorized, and D is not triggered.
The entry decision is correct: records match the rule. It does not promise error-free execution or make final delivery automatic.
What “Correct Judgment” Means Here
Correctness has a bounded meaning: using material available at the time, the team adjudicated consistently with the frozen object, threshold, resources, and authority. It does not mean A was absolutely optimal among every imaginable plan.
No probability of success next week was estimated, so the later result cannot score a percentage that never existed. V3 asks whether the current action qualifies for its next stage.
Those eligibility conditions were met, and later review finds no transcription error in the entry. The entry judgment can therefore remain correct even if the final result fails.
If “correct” means “must finally succeed,” every failure proves error by definition and layered analysis becomes impossible.
Establish a Four-Layer Result Page Before the Incident
Gu Ning divides V3 into four layers. Object judgment asks whether scope, window, resources, and entry pass. Plan asks whether steps, roles, sequence, checks, and exits can turn eligibility into delivery.
Execution asks whether actual people followed the version through steps, handoff, and records. Observation asks whether readings, differences, the window result, and errors were found truthfully.
The layers interact but cannot substitute for one another at the final state. A sound plan with execution drift, correct execution with missed observation, and accurate observation with an unfavorable result are different structures.
The page has these fields before work starts, so no explanatory frame is custom-built after the incident.
Accounting for Tuesday’s Slot
Upon release, one unit enters actual V3 expenditure. Cash falls from twelve to eleven: eight safeguarded and three units of original unallocated capacity.
Next week’s ten slots now consist of seven existing commitments, Monday’s review, Tuesday’s execution, and one uncommitted recovery slot. There is no capacity for a second full half-day process that day.
The three-unit final payment remains conditional on receipt and cannot offset this expenditure when production begins. The eight-unit safeguard remains untouched.
The resource judgment holds as planned. Later failure cannot turn a used slot back into an unused one or make expenditure a prediction error.
The Execution Card Did Contain a Handoff Step
V3’s execution card lists entry review, remaining work, item-by-item technical checks, generation of a V3 handoff index, two-person verification, packaging, and transmission within the window. Tang Ke generates the index, Ye Cheng owns technical pages, and both verify the final package.
The index must cite the V3 object, Monday’s reuse conclusion, Tuesday’s entry, and the final item list. The old V2 template remains in the archive directory with V2 in its filename.
The plan leaves forty minutes for handoff. If technical work finishes at 14:50, normal steps leave enough time to generate, check, and send before 16:00.
The evidence therefore does not support “handoff was never planned.” The inquiry must examine how the planned interface and actual execution separated.
Technical Work Finishes at 14:48
Ye Cheng completes the remaining work at 14:48. Item-level technical readings fall on V3’s acceptance side, object identifiers match V1’s scope, and no quality stop triggers.
These readings establish only that technical pages satisfy the list. The handoff index, version identity, and window remain part of the result.
At 14:50, Tang Ke begins generating the package. She opens a template in the same object directory and prepares to add V3’s entry and reuse pages.
At this point, object judgment has passed, the plan remains executable, execution is incomplete, and observation continues.
A Task Switch Changes the Actual Sequence
At 14:53, Tang Ke receives a status request for existing task E7. E7 is one of the seven committed items and the reply is expected to take three minutes. She saves the current file and switches windows.
The reply takes twelve minutes. On returning at 15:05, she opens the visually similar V2 handoff template from the recent-files list instead of the V3 file she saved.
She fills in the item list but omits Monday’s reuse page and Tuesday’s entry index. The header still says V2, and the internal object identifier points to Wednesday’s old window.
The task switch explains the changed sequence but does not remove the execution deviation. The plan required a V3 index; the actual package did not satisfy it.
Clear Responsibility Does Not Eliminate Mistakes
Tang Ke is the handoff-index owner; the card did not ambiguously assign the step to both people. The error did not arise because nobody knew who was responsible.
People can still choose the wrong file, omit a field, or misread a state. Clear roles reduce interface gaps but do not remove operational error.
Similar templates in one directory, truncated paths in the recent-files view, and interruption by another task all increased the opportunity for deviation. These are execution-environment conditions, not proof of deliberate violation.
Calling it only personal carelessness omits alterable interface and check structures. Blaming the system entirely denies who performed the step.
Two-Person Verification Finds the Error
At 15:19, Ye Cheng performs the card’s check. She first sees V2 in the header, then finds that Monday’s reuse conclusion and Tuesday’s entry are missing.
They stop packaging immediately. Tang Ke preserves the erroneous file as a deviation record, without overwriting the V3 draft or merely changing the header and sending it.
Observation works here: the error is found within the window, and its type and time are traceable. Had the check been skipped, a wrong object might have been transmitted.
Detection does not turn execution into success. Strong observation and failed execution can coexist.
Why the Header Alone Cannot Be Fixed
The handoff index is not only a name. It connects the object, entry, reuse conclusion, technical pages, and receipt items. V2’s template lacks V3’s conditional fields, while its old-window identifier prevents verification under the current version.
Changing V2 to V3 in the header would leave content and version inconsistent. Appearance would be repaired while the evidence chain remained broken.
V3 requires regeneration of the index after a version error, mapping from original technical pages, two-person review, and repackaging. Steps cannot be deleted after an incident for speed.
Version control here is part of result identity, not administrative decoration.
Remaining Time Cannot Complete the Repair
At 15:24, Tang Ke estimates the full sequence: twenty-five minutes for regeneration and mapping, fifteen for joint review, and fifteen for packaging and sending, totaling fifty-five.
Only thirty-six minutes remain. Some steps might be performed faster, but no material shows they can fit without breaking sequential dependencies or skipping checks.
The production slot is already used, no second authorized slot can extend the process into a new window, and the other party has not promised receipt after 16:00.
Gu Ning applies X17-1’s version and window exit: do not send; notify the other party that a handoff-version inconsistency was found and that the present package will not be submitted.
Not Sending Is Not a Second Failure
The execution deviation was choosing the V2 template and omitting V3’s index. Once the check found it, withholding transmission prevented an erroneous package from becoming an external delivery.
Looking only at “nothing was sent” may classify the stop itself as failure. Under the exit card, it is correct execution when repair cannot finish in the window.
One event can contain local failure and local success: index generation failed, verification succeeded, the stop exit succeeded, and final delivery failed.
The four-layer page preserves these states without imposing one good-or-bad label on the afternoon.
Adjudicating V3 at 16:00
At 15:31, the other party acknowledges the explanation, refuses a package without the index, and does not extend the window. At 16:00, V3 has not achieved item-by-item receipt.
V3 is recorded incomplete, and the three-unit final payment is not triggered. Like V2, it is a nondelivery, but its immediate path differs: V2 paused at entry; V3 stopped after technical work because of a handoff-version error.
The two zero results cannot be merged into “the technology never passed.” V3’s technical items were on the acceptance side; failure occurred in versioned handoff.
V3 moves from active to closed pending review. Any future negotiation requires V4.
Final Outcome Cannot Prove Every Layer Wrong
Nondelivery establishes that the result objective was missed. It does not show Tuesday’s h=4.4, r=0.2, and d=1.9 were false, or that the eight-unit safeguard and one-slot recovery rule were mistaken.
A was eligible within the hard constraints, and B and C truly were unavailable. An execution deviation inside A does not make a nonexistent alternative available in the past.
The plan was not flawless. It included handoff and double checking but left the old template in the same recent-files entrance and did not require full-path verification before editing. This is a design gap identifiable after the incident.
The precise conclusion is: object judgment conformed to the rule; the plan covered key steps but lacked error prevention; execution selected the wrong template; observation found it in time; the final objective failed.
Evaluating Judgment Quality Independently
The first layer is evaluated using material available then, not by replacing it with the outcome. V3 had a clear identity, resources stayed within floors, entry passed, and the current path was more complete than unvalidated alternatives. All are traceable judgments.
Uncertainty remains: there was no success probability, no proof that A was globally optimal, and no prediction of the task interruption. “Correct” means conformity to rules and an appropriate evidentiary scope.
Had the team ignored a 4.6 failure, consumed the recovery slot, or used V2’s expired window, judgment quality would be defective even if the final payment arrived by luck.
Outcome and judgment are related, but neither proves the other one for one.
Evaluating Plan Quality
The plan separated entry, technical work, handoff, checking, and sending; provided forty minutes of buffer; and prohibited sending after a version error. These features exposed and contained the error.
Its gap was file selection. V2 and V3 appeared together in recent files, while the card said only “generate V3 index,” without requiring access through a unique register link or object-card verification before editing.
It also omitted an interruption rule for E7 during handoff: who handles an existing-task request and what recovery-point check follows.
Plan quality is therefore not simply correct or wrong. Coverage was useful, error-prevention interfaces insufficient, and exit design effective.
Evaluating Execution Quality
Tang Ke began the index under her assigned role, then opened the wrong template after interruption and omitted new fields. This diverged from V3. Ye Cheng completed the technical pages on time and performed the joint check.
Execution records actions, times, and deviations before personality explanations. The twelve-minute interruption, recent-files entrance, and similar templates are conditions; the wrong selection is the action that occurred.
A later interview may explain why the header was missed, but “she should have known” cannot replace evidence. Detection also cannot erase the deviation.
Evaluation seeks an interface that can change, not one person to carry the whole story.
Evaluating Observation Quality
h, r, and d were saved on time; technical pages are traceable; verification caught the version error before sending; and both the other party’s reply and the 16:00 result are timestamped. Observation provides enough material to locate the failure.
One gap remains: the system did not automatically record the file path when Tang Ke moved from the V3 draft to V2. The team reconstructs it from recent files and save times, while message logs establish the interruption.
High observation quality does not mean no gap. It means evidence distinguishes the major layers and states what remains unknown.
Without the two-person check, the team might know only that the other party refused receipt, leaving a wider attribution space.
Why the Buffer Did Not Rescue the Result
The plan allowed forty minutes for handoff. The interruption consumed twelve, and rebuilding the wrong template required fifty-five. The buffer absorbed some disruption but not full version reconstruction.
A buffer is no guarantee. It carries delay within a designed range; beyond it, the exit rule still acts.
Claiming afterward that the buffer should have been sixty minutes must explain what such a choice would displace or why work could start earlier. This incident alone cannot backfill an optimum.
Reducing the chance of choosing the wrong template and the scope of repair may be more direct than adding unlimited time.
What the Correct Stop Protected
Withholding the wrong package avoided review under a V2 object, prevented an old window from being mixed with a new result, and preserved V3’s technical material intact.
The final recovery slot remains uncommitted, as does the eight-unit cash safeguard.
The cost remains: V3’s window was missed, the final payment did not trigger, and one slot and one unit were consumed. Protection and loss coexist.
An action loop does not eliminate every failure. It prevents a local error from propagating through more relations.
Incident Repair Cannot Reopen Production First
After 16:00, the team may repair the index for archival and future reuse, but cannot call it on-time V3 delivery. Repair and a new delivery object must be separate.
Gu Ning authorizes thirty minutes of management time to rebuild the correct index, using no production slot and sending nothing externally. Its purpose is to verify whether the technical material can form a complete V3 archive package.
Failure would reveal a deeper plan or material gap; success improves only reusability. The 16:00 result stays incomplete.
At 16:35, both people verify the correct index. It shows that the main technical material can be connected, but cannot change the window through time travel.
Correctability Continues Stability Through Change
In RC, stability is not an error-free condition. It is the system’s capacity to transmit pressure, identify deviation, and correct itself through local loss. V3’s handoff failure shows an execution relation breaking; joint verification and the stop exit prevent the deviation from spreading into erroneous transmission and safeguarded resources.
The four-layer page returns pressure signals to the relevant layer, allowing plan, execution, and observation to be revised separately. Stability continues through dynamic adjustment, not by renaming failure as success to preserve appearance.
Four-Layer Result Page F21-1
Object judgment: V3 identity, resources, window, and entry pass under frozen rules; no misreading is found. Plan: stages, double checking, and exit work; file entrance and interruption recovery are insufficient.
Execution: technical steps complete; the handoff index uses V2 and omits items; verification and stopping follow the rule. Observation: readings, files, times, and external adjudication are preserved, while the file-switch path is partly reconstructed from logs.
Final state: V3 lacks item-by-item receipt by 16:00 and the final payment does not trigger. Cash is eleven, divided into eight safeguarded and three originally unallocated. Ten slots consist of seven existing, two used by V3, and one recovery slot.
With these five states side by side, “failure” is no longer the only information.
A Correct Local Judgment May Still Miss the System Interface
Tuesday’s entry asks whether current conditions permit production. It does not ask whether the handoff file must be correct. The resource judgment protects safeguard and recovery capacity but does not predict task interruption.
Combining several local passes into proof that the whole system is reliable expands their scope. A stage gate is valuable precisely because each pass carries only its assigned responsibility.
Handoff and joint checking show that the team recognized the interface; lack of a unique file entrance shows a gap remained. Local correctness and system insufficiency coexist.
This also explains why more entry readings might not improve the result. The error occurred in another relation, which greater measurement precision does not repair.
Ninety Percent Complete Is Not Final Success
Technical work is complete and the correct index is repaired at 16:35, tempting the team to call V3 “substantially complete.” Yet V3 includes item-by-item receipt before 16:00, and no conforming package existed in the window.
Completion percentage can describe internal progress but cannot replace the result event. Erasing a thirty-five-minute delay as minor would again move the threshold according to outcome preference.
Nondelivery likewise does not erase the technical material. It enters the archive and reuse review, but cannot receive V3’s success label or trigger the final payment.
Preserving progress, asset state, and result adjudication is more accurate than debating “basically successful.”
Counterfactuals Only Locate Alterable Relations
Without the E7 interruption, Tang Ke might not have opened the wrong template, but that is not observed; she might still have chosen it from recent files. A unique V3 entrance might reduce the opportunity for error but cannot guarantee delivery.
The narrower relation is certain: opening the correct template and completing required fields was necessary for timely handoff; it did not occur, so the result chain broke there.
The team can rehearse unique entrance, post-interruption recovery check, and advance sealing of old templates. Rehearsal does not masquerade as a replay of history.
Counterfactuals serve improvement choices rather than construct a past that certainly succeeds.
Separate Responsibility from Character Blame
Tang Ke owns the index and must explain the actual choice and participate in repair. Ye Cheng owns joint verification and found the error. Gu Ning approved a plan that did not control similar templates or interruption recovery.
Responsibility means someone at each layer can act, preserve material, and alter an interface. It does not compress a system result into one person’s character.
Removing Tang Ke’s authority without changing the file entrance leaves the next executor under the same conditions. Changing the system without training object verification also leaves room for deviation.
Improvement can include personal steps and environmental design without selecting one exclusive culprit.
Execution Reliability Requires Repeated Process Observation
One deviation disproves the absolute claim that execution cannot fail, but cannot estimate a stable failure rate for Tang Ke or the process. There is only one specific event.
After a unique entrance is introduced, later handoffs should record version success, interruption counts, and errors caught by review. No percentage is reported without a denominator.
V2 and V3’s two nondeliveries are not treated as comparable execution-failure samples. V2 never entered production; V3 deviated at handoff. Their generating processes differ.
Classification precedes counting. Frequency has meaning only for comparable objects and failure types.
Better Observation Can Make Results Look Worse
Joint checking found the error, which led to no transmission and recorded nondelivery. Without checking, the package might have appeared to be “sent on time.”
An erroneous version sent on time is not item-by-item receipt and may merely export the problem. Strict observation makes failure appear earlier and more clearly, even if a short-term metric looks worse.
The number of discovered problems alone cannot score an observation system. More problems may mean deterioration or better observation.
Inspection opportunities, error types, capture times, and propagated consequences must be read together. F21-1 separates producing from detecting an error.
Consolation After Failure Does Not Enter the Evidence Column
The team may value not sending a wrong package and feel discouraged by two missed windows. These experiences affect later action and should be acknowledged as team state.
They do not change the 16:00 result, cash of eleven, or the file-selection fact. Calling “learning a lot” the success result dissolves the objective; saying “failed again” makes every layer worthless and deletes effective controls.
The page gives emotion its own field without letting it replace numbers, versions, and times. Recovery judgment then rests on neither self-consolation nor frustration.
Every Improvement Should Match Its Layer
The judgment layer need not loosen entry or invent a probability because of this error. The plan layer needs a unique version entrance, interruption coverage during handoff, and a recovery-point check. The execution layer should verify object identity upon opening a template.
Observation can add automatic file-path tracing, while the exit rule retains its prohibition on sending after a version error. Each improvement answers an observed relation.
Strengthening d measurement would improve a layer that did not cause V3’s failure. Blaming only the executor would leave similar templates and interruption interfaces unchanged.
Layering directs improvement resources to the actual weak point.
A Bad Result Does Not Make Judgment Worthless
Tuesday produced no delivery, and D17’s principal pursuit failed again. The team need not rename this outcome successful learning to protect its self-image.
At the same time, entry, resource, and exit judgments limited exposure, while observation located the direct cause. Their local value remains without canceling the final loss.
A mature evaluation can say in one sentence: the result failed, judgment complied, the plan had a gap, execution deviated, and observation worked.
The next chapter reverses the question. A favorable future outcome alone cannot prove high-quality judgment or design; chance, rescue, and unobserved deviation can carry a poor process to a good endpoint.