An investigation report should let another person distinguish what was observed from what is inferred. Begin with a scope: one service and a half-open time interval [start,end). State which metric population is counted, which log events were retained and where coverage is incomplete. A confident sentence without those boundaries can hide a denominator mistake or turn missing evidence into a false health claim.
This capstone consumes deterministic dictionaries; it has no live services, credentials, network calls or extra packages. You combine the course's transformations into a reproducible evidence artifact. The graded result is a structured Python report. After solving, use that report to write a short narrative and propose a next observation; the narrative is an extension, while the evidence computation is executed and graded.
The fixtures deliberately keep metrics separate from logs. Suppose metrics record five failures among one hundred requests, while the retained logs include only one failure example. The metric fraction is 5/100. Dividing by one retained log would turn sampling into a fictitious 500% failure fraction. Do not silently replace the metric denominator with log count, even when the log sample looks convincing.
metric_requests, metric_errors = 100, 5
retained_failure_logs = 1
print(metric_errors / metric_requests)
print("retained examples:", retained_failure_logs)Coverage is part of the result. Metric intervals must be contained in scope, nonoverlapping and available, and together must cover the entire report interval. Reject partially overlapping buckets instead of assuming uniformly distributed traffic. Retain known counts when there is a gap, but assess whole-window health as insufficient. A complete interval with zero requests also lacks support for a failure fraction. Neither case should become an invented zero-error observation.
Logs at the start belong to the report; logs exactly at its end belong to the next interval. Match service names, validate even excluded rows, and reject duplicate event IDs rather than counting a retried export twice. Sort retained evidence by event time then event ID. Source IDs and independent redacted context let another person inspect the basis of the summary without mutating original fixtures.
The sample p95 belongs to selected log durations only. Keep its sample count and unknown coverage explicit. A complete metric population does not make retained latency logs representative. A dependency label in an error record also does not prove that dependency caused the incident. The report therefore keeps cause unproven and includes its fixture, sampling, correlation and redaction limits.
Use the build result to draft three sentences: the supported symptom with counts and scope; the strongest retained example with its event ID; and a plausible explanation paired with evidence that would distinguish it from an alternative. For example, compare failed request traces with successful requests and deployment timing before assigning responsibility. Avoid claiming a mechanism from coincidence alone.
The bug hunts expose the log-denominator error and an inclusive final boundary. Hidden cases exercise gaps, unavailable windows, zero support, overlapping buckets, threshold ties and deep-copy independence. Passing demonstrates a local fixture investigation with traceable evidence, not production instrumentation, incident command or safe automatic remediation.