{
  "schemaVersion": "1.0.0",
  "analysis": {
    "recordId": "RCA-EXAMPLE-001",
    "templateVersion": "1.0.0",
    "revision": 4,
    "status": "follow_up_pending",
    "createdAt": "2026-07-21T10:00:00Z",
    "updatedAt": "2026-08-01T14:30:00Z",
    "ownerRoleId": "ROLE-EXPORT-SERVICE-OWNER",
    "fictionalExample": true
  },
  "problem": {
    "statement": "A fictional invoice export job produced two output files for one accepted export request after a worker restart.",
    "expectedCondition": "One accepted request creates one durable output file and one completed export record.",
    "observedCondition": "One request ID was associated with two output objects while the database contained one completed export record.",
    "observedImpact": "One synthetic customer fixture contained a duplicate export file; no payment, customer, or production record was used.",
    "affectedScope": "The controlled restart fixture for exporter version 3.2.0 only.",
    "detectionMethod": "A reconciliation test compared request IDs, database records, and object keys.",
    "firstObservedAt": "2026-07-21T09:14:22Z",
    "evidenceIds": ["EVIDENCE-001", "EVIDENCE-002"]
  },
  "evidence": [
    {
      "id": "EVIDENCE-001",
      "type": "test",
      "observedAt": "2026-07-21T09:14:22Z",
      "reference": "https://evidence.example.test/exporter/reconciliation-run-17",
      "sha256": "1f62e5294c65c0d89948464e6b87a31f94c9a37f797ea3aa1f0f133992fe2db1",
      "note": "Synthetic reconciliation fixture showing one request ID, one database record, and two output object keys.",
      "sensitiveDataRemoved": true
    },
    {
      "id": "EVIDENCE-002",
      "type": "log",
      "observedAt": "2026-07-21T09:14:23Z",
      "reference": "https://evidence.example.test/exporter/restart-trace-17",
      "sha256": "6bd0b2e9a51d4e3a6e4cf4b950dbdf95c8075d50123c4be15fe2ce5e5f9e4f7c",
      "note": "Sanitized fictional trace places the worker stop after object creation and before the completion record commit.",
      "sensitiveDataRemoved": true
    },
    {
      "id": "EVIDENCE-003",
      "type": "test",
      "observedAt": "2026-07-24T12:40:00Z",
      "reference": "https://evidence.example.test/exporter/failure-injection-22",
      "sha256": "f3cbbfe7927af806ad89bca1c93b6ab2878cbd8ca5af2946a0f70be4b12bfc56",
      "note": "Dependency-free failure injection reproduced a duplicate only when recovery generated a new timestamped object key.",
      "sensitiveDataRemoved": true
    },
    {
      "id": "EVIDENCE-004",
      "type": "test",
      "observedAt": "2026-07-31T16:20:00Z",
      "reference": "https://evidence.example.test/exporter/stable-key-verification-31",
      "sha256": "c3173e221a12b6ebf2d4234dbd071e832a1b5050581d99b55c27e1562f6bd8ab",
      "note": "The fictional verification ran two forced restarts and observed one stable output object and one completed record.",
      "sensitiveDataRemoved": true
    }
  ],
  "timeline": [
    {
      "id": "TIME-001",
      "occurredAt": "2026-07-21T09:14:20Z",
      "kind": "observation",
      "fact": "The fictional worker accepted request REQ-EXAMPLE-017 and started one export attempt.",
      "evidenceIds": ["EVIDENCE-001"]
    },
    {
      "id": "TIME-002",
      "occurredAt": "2026-07-21T09:14:22Z",
      "kind": "observation",
      "fact": "The worker wrote the first timestamped output object.",
      "evidenceIds": ["EVIDENCE-001", "EVIDENCE-002"]
    },
    {
      "id": "TIME-003",
      "occurredAt": "2026-07-21T09:14:23Z",
      "kind": "change",
      "fact": "The controlled fixture stopped the worker before the completion record commit.",
      "evidenceIds": ["EVIDENCE-002"]
    },
    {
      "id": "TIME-004",
      "occurredAt": "2026-07-21T09:15:04Z",
      "kind": "observation",
      "fact": "Recovery found no completed database record and created a second timestamped output object.",
      "evidenceIds": ["EVIDENCE-001", "EVIDENCE-002"]
    },
    {
      "id": "TIME-005",
      "occurredAt": "2026-07-21T09:16:00Z",
      "kind": "detection",
      "fact": "Reconciliation detected two object keys for the same request ID.",
      "evidenceIds": ["EVIDENCE-001"]
    },
    {
      "id": "TIME-006",
      "occurredAt": "2026-07-24T12:40:00Z",
      "kind": "test",
      "fact": "Failure injection isolated timestamped recovery keys as the duplicate-producing condition.",
      "evidenceIds": ["EVIDENCE-003"]
    }
  ],
  "hypotheses": [
    {
      "id": "HYP-001",
      "question": "Did the fictional client submit the export request twice?",
      "method": "Compare accepted request IDs and request fingerprints in the synthetic reconciliation fixture.",
      "expectedIfTrue": "Two distinct accepted request identities or fingerprints would precede the two output objects.",
      "observed": "One request identity and one fingerprint preceded both object writes.",
      "status": "rejected",
      "testedAt": "2026-07-22T11:00:00Z",
      "evidenceIds": ["EVIDENCE-001"],
      "supportsRootCauseIds": []
    },
    {
      "id": "HYP-002",
      "question": "Did an object-store retry duplicate one write?",
      "method": "Compare object keys and the worker trace around both writes.",
      "expectedIfTrue": "The same object key and one worker operation would appear twice in the provider trace.",
      "observed": "Two different timestamped keys were created by the original and recovered worker attempts.",
      "status": "rejected",
      "testedAt": "2026-07-22T13:10:00Z",
      "evidenceIds": ["EVIDENCE-001", "EVIDENCE-002"],
      "supportsRootCauseIds": []
    },
    {
      "id": "HYP-003",
      "question": "Could recovery repeat the external write because output identity was not stable across the completion boundary?",
      "method": "Stop the worker after object creation, then compare timestamped and request-stable key strategies in the same fixture.",
      "expectedIfTrue": "The timestamped strategy would create two objects while the request-stable conditional write would return one existing object.",
      "observed": "The timestamped strategy duplicated the output; the request-stable conditional write produced one object across two restarts.",
      "status": "supported",
      "testedAt": "2026-07-24T12:40:00Z",
      "evidenceIds": ["EVIDENCE-003", "EVIDENCE-004"],
      "supportsRootCauseIds": ["ROOT-001", "ROOT-002"]
    }
  ],
  "factors": {
    "causal": [
      {
        "id": "CAUSAL-001",
        "statement": "The worker stopped after the external object write and before the local completion record commit.",
        "evidenceIds": ["EVIDENCE-002", "EVIDENCE-003"]
      },
      {
        "id": "CAUSAL-002",
        "statement": "Recovery created a new timestamped object key when it found no completed database record.",
        "evidenceIds": ["EVIDENCE-001", "EVIDENCE-003"]
      }
    ],
    "contributing": [
      {
        "id": "CONTRIB-001",
        "statement": "The test suite did not inject a worker stop between the external write and the local completion commit.",
        "evidenceIds": ["EVIDENCE-003"]
      },
      {
        "id": "CONTRIB-002",
        "statement": "The existing completion metric counted database rows but did not reconcile output objects by request ID.",
        "evidenceIds": ["EVIDENCE-001"]
      }
    ],
    "rootCauses": [
      {
        "id": "ROOT-001",
        "statement": "The export protocol lacked a durable operation identity shared by the external object write and local completion record.",
        "causalFactorIds": ["CAUSAL-001", "CAUSAL-002"],
        "evidenceIds": ["EVIDENCE-002", "EVIDENCE-003", "EVIDENCE-004"],
        "recurrenceTest": "Force two restarts after the external write and require one stable object plus one completion record for the request ID."
      },
      {
        "id": "ROOT-002",
        "statement": "Recovery treated absence of a completed database record as permission to create a new external object without first checking the request-stable output identity.",
        "causalFactorIds": ["CAUSAL-002"],
        "evidenceIds": ["EVIDENCE-001", "EVIDENCE-003", "EVIDENCE-004"],
        "recurrenceTest": "Repeat recovery with an existing request-stable object and require the prior result to be returned without another write."
      }
    ]
  },
  "actions": {
    "corrective": [
      {
        "id": "CORR-001",
        "factorIds": ["ROOT-001", "ROOT-002"],
        "statement": "Use the request ID as the output operation identity and make object creation conditional on that stable key.",
        "ownerRoleId": "ROLE-EXPORT-SERVICE-OWNER",
        "dueDate": "2026-07-30",
        "status": "verified_effective",
        "implementedAt": "2026-07-29T15:10:00Z",
        "dependencyIds": [],
        "evidenceIds": ["EVIDENCE-004"],
        "verification": {
          "ownerRoleId": "ROLE-INDEPENDENT-REVIEWER",
          "check": "Run the same request through two forced worker restarts after object creation.",
          "successCriteria": "Exactly one output object and one completed database record share the request ID.",
          "dueDate": "2026-07-31",
          "status": "passed",
          "performedAt": "2026-07-31T16:20:00Z",
          "evidenceIds": ["EVIDENCE-004"]
        }
      },
      {
        "id": "CORR-002",
        "factorIds": ["CONTRIB-001"],
        "statement": "Keep the post-write worker-stop fixture in the export contract test suite.",
        "ownerRoleId": "ROLE-EXPORT-TEST-OWNER",
        "dueDate": "2026-08-02",
        "status": "implemented",
        "implementedAt": "2026-08-01T12:00:00Z",
        "dependencyIds": ["CORR-001"],
        "evidenceIds": ["EVIDENCE-003"],
        "verification": {
          "ownerRoleId": "ROLE-INDEPENDENT-REVIEWER",
          "check": "Run the failure-injection fixture from a clean environment and inspect its assertion count.",
          "successCriteria": "The clean run passes and fails when the stable output identity is removed.",
          "dueDate": "2026-08-05",
          "status": "not_run",
          "performedAt": null,
          "evidenceIds": []
        }
      }
    ],
    "preventive": [
      {
        "id": "PREV-001",
        "factorIds": ["ROOT-001", "CONTRIB-002"],
        "statement": "Add a review check for shared durable identity wherever one job spans an external side effect and local state.",
        "ownerRoleId": "ROLE-PLATFORM-QUALITY-OWNER",
        "dueDate": "2026-08-12",
        "status": "implemented",
        "implementedAt": "2026-08-01T14:00:00Z",
        "dependencyIds": ["CORR-001"],
        "evidenceIds": ["EVIDENCE-004"],
        "verification": {
          "ownerRoleId": "ROLE-ARCHITECTURE-REVIEWER",
          "check": "Review every allowlisted external-write workflow against the durable-identity check.",
          "successCriteria": "Every reviewed workflow records an existing stable identity or a named remediation owner and due date.",
          "dueDate": "2026-08-20",
          "status": "not_run",
          "performedAt": null,
          "evidenceIds": []
        }
      }
    ]
  },
  "followUp": [
    {
      "id": "FOLLOW-001",
      "actionIds": ["CORR-001"],
      "scheduledAt": "2026-07-31T16:00:00Z",
      "ownerRoleId": "ROLE-INDEPENDENT-REVIEWER",
      "check": "Review the forced-restart verification result and reconcile output objects with completion records.",
      "successCriteria": "The verification evidence shows one request, one output object, and one completed record.",
      "status": "complete",
      "performedAt": "2026-07-31T16:25:00Z",
      "evidenceIds": ["EVIDENCE-004"]
    },
    {
      "id": "FOLLOW-002",
      "actionIds": ["CORR-002", "PREV-001"],
      "scheduledAt": "2026-08-20T10:00:00Z",
      "ownerRoleId": "ROLE-PLATFORM-QUALITY-OWNER",
      "check": "Review the clean failure-injection run and the cross-workflow durable-identity register.",
      "successCriteria": "The mutation-sensitive test passes and every reviewed workflow has a verified identity rule or a tracked remediation.",
      "status": "planned",
      "performedAt": null,
      "evidenceIds": []
    }
  ],
  "conclusion": {
    "rootCauseIds": ["ROOT-001", "ROOT-002"],
    "contributingFactorIds": ["CONTRIB-001", "CONTRIB-002"],
    "confidence": "high",
    "evidenceLimitations": "The analysis uses a deterministic fictional fixture. It does not measure production frequency, external-provider behavior, customer impact, or action effectiveness outside the bounded restart tests.",
    "reviewerRoleId": "ROLE-INDEPENDENT-REVIEWER",
    "reviewedAt": "2026-08-01T14:30:00Z"
  },
  "boundaries": {
    "bugIntakeOwned": false,
    "incidentResponseOwned": false,
    "recoveryExecutionOwned": false,
    "blameAssigned": false,
    "complianceAssuranceOwned": false,
    "productionActionAuthorized": false
  }
}