{"cases":[{"alternative_route_blocks":[],"case_id":"E15A008__DIRECT","case_type":"DIRECT_POSITIVE","domain":"labor-history museum interpretation","intended_route_id":"B2","omitted_condition_id":null,"remedy_leakage_audit":"The statement identifies explanatory distortions without proposing any corrective method, intervention, or preferred framework.","route_evidence":[{"condition_id":"b015_a11_c4","intended_status":"SATISFIED","scenario_evidence":"Knowing that the strike collapsed, the exhibition draft presents earlier developments as unmistakable warnings even though contemporary participants recorded uncertainty."},{"condition_id":"b015_a11_c7","intended_status":"SATISFIED","scenario_evidence":"The umbrella category and citywide participation figure conceal differences among worker groups that shaped their information and available choices."}],"scenario_text":"A museum is preparing an exhibition about a 1912 textile strike that collapsed after six weeks. Its draft storyline begins with the eventual defeat already known and presents each earlier development—a delayed relief shipment, a hostile newspaper editorial, and one union officer’s resignation—as another unmistakable warning that participants should have recognized. Yet letters written during the strike show organizers expecting several different endings and repeatedly revising their expectations. The exhibition also calls everyone involved “mill hands” and relies on one citywide weekly participation figure. That presentation obscures sharp differences among immigrant weaving crews, locally born mechanics, teenage spoolers, and families employed by subcontractors. These groups received news through different channels, faced different risks from leaving work, and did not have the same opportunities to vote on strike decisions. Visitors therefore encounter a smooth account in which the ending appears clear from the outset, while distinctions that shaped what participants knew and could do at particular moments disappear.","scenario_title":"The Strike That Looks Predestined","vocabulary_separation_audit":"The scenario uses museum, labor, and exhibition language rather than supplied archetype terminology or predicate wording."},{"alternative_route_blocks":[],"case_id":"E15A008__TRANSFER","case_type":"TRANSFER_POSITIVE","domain":"cybersecurity incident reporting","intended_route_id":"B2","omitted_condition_id":null,"remedy_leakage_audit":"The statement describes defects in an incident report but offers no remediation, process change, or technical control.","route_evidence":[{"condition_id":"b015_a11_c4","intended_status":"SATISFIED","scenario_evidence":"After the compromise is known, the report turns ambiguous alerts into a straight-line story in which their meaning supposedly should have been apparent."},{"condition_id":"b015_a11_c7","intended_status":"SATISFIED","scenario_evidence":"A monthly mean and a single analyst category erase shift-, role-, and permission-level differences that affected real-time interpretation."}],"scenario_text":"After a credential-theft incident at a regional payment processor, the internal report reconstructs the preceding nine days as a clean progression toward compromise. Because investigators now know which account was abused, routine login failures, a vendor ticket, and an unusual overnight query are described as signals whose significance was already plain. The original records show otherwise: each event initially resembled a different common nuisance, and the connection became visible only after the fraudulent transfer. The report further summarizes operations through a monthly mean for “security analysts,” treating the monitoring desk as a uniform unit. That number blends overnight contractors who could view alerts but not customer records, daytime employees with broader access, and a fraud team working from a separate queue. It also combines holiday coverage with normally staffed shifts. Those distinctions governed which facts any person could see, whom they could contact, and how urgent an event appeared at the time. The resulting account makes a once-ambiguous sequence read like a path everyone should have recognized while it was occurring.","scenario_title":"Nine Days Rewritten After the Breach","vocabulary_separation_audit":"The transfer case uses operational cybersecurity vocabulary distinct from the labor-history case and avoids the supplied diagnostic labels."},{"alternative_route_blocks":[{"blocked_by_condition_id":"b015_a11_c3","condition_set_id":"B1","how_blocked":"The scenario states that all relevant longer-run traffic and staffing patterns are already included, contradicting the route's required omission of such constraints."},{"blocked_by_condition_id":"b015_a11_c6","condition_set_id":"B3","how_blocked":"The review makes no assertions about what would have occurred under a different course of action."},{"blocked_by_condition_id":"b015_a11_c8","condition_set_id":"B4","how_blocked":"The account is explicitly not used to excuse personnel or elevate an individual rescuer."}],"case_id":"E15A008__NEAR_MISS","case_type":"ONE_LITERAL_NEAR_MISS","domain":"cybersecurity incident reporting","intended_route_id":"B2","omitted_condition_id":"b015_a11_c7","remedy_leakage_audit":"The statement supplies diagnostic facts and natural negative evidence only; it recommends no intervention or corrective practice.","route_evidence":[{"condition_id":"b015_a11_c4","intended_status":"SATISFIED","scenario_evidence":"Outcome knowledge causes the final report to portray formerly ambiguous events as a plainly connected sequence."},{"condition_id":"b015_a11_c7","intended_status":"CONTRADICTED","scenario_evidence":"The account remains fully disaggregated by alert, person, shift, permissions, and contemporaneous information, and no pooled label or summary conceals relevant differences."}],"scenario_text":"Following an intrusion at a university computing center, investigators produce a report that makes the attacker’s eventual entry seem apparent from the first failed login. Earlier help-desk notes, however, treated the failures as a mistyped service password, and a later network spike was initially linked to a scheduled research transfer. Only after the compromised server was found did those events become connected. The final prose nonetheless presents them as a steadily unfolding chain that staff should have understood immediately. Unlike many incident summaries, this report contains no pooled rates, broad staff categories, or period-wide averages. Every alert remains tied to its timestamp, named recipient, shift assignment, access permissions, and the information available at that moment; reviewers confirm that no relevant differences among personnel or episodes are concealed by aggregation. All pertinent longer-run traffic and staffing patterns are also included. The review makes no claims about what would have happened under another course of action, and nobody uses its account to excuse staff conduct or portray one employee as the savior of the center.","scenario_title":"A Detailed Timeline With a Foregone Ending","vocabulary_separation_audit":"The near miss retains the transfer domain's technical vocabulary while explicitly preserving granular distinctions; it does not use archetype names or copied predicates."}],"experiment_id":"eoa_inverse_innovation_exp15_route_aware_retrieval40_20260814","sample_id":"E15A008","schema_version":1}