# Example 02: actual Analyser investigation capture

Captured 1 November 2026 using released Analyser 1.40.0. This is a controlled, deliberately seeded fault. Codex knew the reverse comparator before investigation; this is not blind bug discovery, a model benchmark, or human approval of a repair.

## What actually happened

Codex inspected the audit through the isolated localhost Analyser REST action socket (the same supported verbs used by its MCP bridge, but this capture did not use MCP transport). Inference was hosted by OpenAI; the Analyser and source files were local. No separate local model or undisclosed model version is claimed. The tool transcript contains actual requests/responses, not private reasoning. Local roots are replaced by `<checkout>` and `<isolated-capture>`; unrelated context fields are omitted. No access header or token is included.

1. Open the final faulty audit and supplied GraphML; wait for load. Analyser reads 12 records and finds all 3 logged node IDs declared by the graph.
2. Read record index 3: quantity 10, unit price 1200p, value 12000p, limit 10000p, withinLimit=true, ACCEPTED. This contradicts the requirement value <= limit.
3. Spotlight the recorded event and supplied LimitCheck.java line 15; flag the contradiction and suggested repair. The deliberately faulty class uses >. The corrected class uses <=; return true remains so both outcomes reach Decision.
4. Independently rerun the supplied native harness in a new output directory, on the same machine: 7 corrected results match the requirement; all 7 faulty results differ; 4 invalid inputs refuse per revision. Packaged form matches the corrected 7 decisions. Embedded host lifecycle assertions pass. This is the execution step; the Analyser does not run the application.
5. Open the final corrected audit: same record input, withinLimit=false, REJECTED. Capture the actual supplied repaired class and record. The repaired source existed before this investigation; Codex inspected it, not a human approval step.
6. Export the faulty investigation using report {bundle}; verify 4 members using the released CLI. Reopen it in the same isolated Analyser as a fresh disposable bundle workspace: 12 records, original record 3, saved two-step walk. Both step-2 targets resolve CURRENT. A separate tampered test copy is refused because its log member SHA differs; original untouched.

## Artifact identity

Analyser jar SHA-256: b886f2d4ab2475c68e588a06c8dd25ca9608428ae7356d232ce9b22a6a87c290

Bundle identity reported by Analyser (not the ZIP file hash): sha256:29bc384dfc0cd3d8cbb83db16c761549d12035d458b1bab541b6ace571eb31cc

## Reopen

Use Analyser 1.40.0 or later: Start page → Open evidence bundle → order-limit-investigation.fexp. Play “Order limit recorded contradiction”. Or run `java -jar fluxtion-auditlog-analyser-1.40.0.jar --verify order-limit-investigation.fexp` first.

Flags do not travel inside the bundle. The saved walk, report narrative and notes preserve the diagnosis; the separately exported PDF preserves the original flagged finding. Sources do not travel inside this bundle. Download the separate source package, configure the appropriate faulty/corrected source root, and use com.example.orderlimit.LimitCheck. Source navigation is supplied context: the Analyser explicitly labels the source/run relationship unverified. Hashes and reproduction commands in the source package are separate evidence; they are not signed deployed-binary identity.

## Limits and visible qualifications

- Ordinary unsigned audit; verification detects modified members, not sender authenticity or universal correctness. No replay payload is embedded; the native run.py/EvidenceRun runner reproduces the fixture.
- The harness deliberately changes its clock to 1000ms after init. Lifecycle records therefore precede lower timestamps; the Analyser truthfully warns about 10 out-of-order records. This investigation uses record indexes and values, not time-window claims. No stream-end declaration exists, so completeness remains unknown.
- First QA load found missing YAML separators (one malformed record). The source harness was fixed and all evidence regenerated before the final capture. That rejected preliminary load is not represented as valid evidence.
- The bundle was reopened on this same machine under an isolated profile, not independently on a second machine. The second reviewer independently reran native tests on this same machine; no broad portability claim follows.
- Screenshots are unedited application-painted PNGs. Paths shown belong only to the isolated synthetic example. Source panes can clip long logical lines; read the complete class in the downloadable source package.

## Genuine HTML reel

`order-limit-investigation-reel.html` was exported by released Analyser 1.40.0 using `walk {name: "Order limit recorded contradiction", reel: "order-limit-investigation-reel.html"}` after reopening the same verified bundle. It contains two real settled-step screenshots, a title page and a finish page linking the adjacent original `.fexp` and its identity/limits. It is self-contained and unedited; save the HTML and `.fexp` beside each other to keep that relative link working. The source pane was hidden for legibility; no source is included in the bundle. The title honestly says the event processor was not declared in that reopened bundle session. The clock discontinuity remains visible. This is a two-step explanation of the recorded fault, not a video or execution of the repaired application.

## Public reel presentation

The published HTML now explains mixed fixture/lifecycle clocks instead of presenting them as elapsed runtime, distinguishes stepping through an investigation from executing replay, and records the screenshot review. A pilot enquiry link follows the saved investigation. Captured audit data, bundle members, images and stylesheet bytes are unchanged. `reel-presentation-receipt.json` records the input/output hashes and transformations; the prior export is retained privately.