Level 4 - Incident Investigation¶
Use this level when several TradePass views show signals that need one evidence-led Incident assessment. It is case training, not a root-cause engineering course.
Incident Method¶
Timeline is evidence. A snapshot does not explain earlier records, and evidence scope is not automatically the same as Client / UID scope. For every case, write: confirmed facts, unconfirmed questions, current confirmed scope, next check and first escalation update before viewing the answer.
Case 1 - XAUUSD Quote Freeze¶
Situation: Taker Symbol Dark identifies XAUUSD. Updated is stale, LPs have changed, Client Stream has relevant XAUUSD Symbol / Stream evidence and Decision Stream has relevant rejects.
Evidence: alert → Symbol Overview → Connection Status → relevant Client Stream → identified orders. Keep Client / UID and Account facts separate from Client Stream quote evidence.
Learner questions: What is confirmed? What is not confirmed? What is the scope? What do you check next? Write the first escalation update.
Show Reference Answer
XAUUSD has the displayed alert condition, stale quote freshness, changed LP participation and identified related evidence. The cause, all-client scope and all-order scope remain unknown. Start with XAUUSD, the displayed connection facts, identified orders and reviewed streams; expand only with further evidence. Escalate the facts and unknowns, then monitor.Case 2 - Reject Spike, Quotes Healthy¶
Situation: relevant rejects increase. Symbol Overview remains fresh with Bid below Ask, reasonable Spread and no unexpected LP loss. A related Trade path needs review.
Evidence: Decision Stream view/subscription → Order ID / Server Time → account and symbol context → Connection Status Trade path → Symbol Overview.
Learner questions: What is confirmed? What must stay unknown? Which stream scope are you viewing? What do you check next? Write the first escalation update.
Conflicting evidence: Snapshot ≠ Timeline. Current Connection Status can show Connected while relevant rejects continue to appear in Decision Stream. Record the timestamp difference; do not force one conclusion.
Show Reference Answer
The identified result records and any relevant Trade-path condition are confirmed. A filtered stream is not complete order flow, and healthy quote rows do not prove every execution path is healthy. Use: “Current Connection Status shows Connected, while relevant rejects continue to appear in Decision Stream. The timing relationship and cause remain under review.”Case 3 - One UID, Multiple Accounts¶
Situation: Accounts A and B under one UID show matching abnormal order evidence. Account C has no matching order or signal.
Evidence: Client / UID → ACC → Account A and B evidence → Account C only to test relevance → positions, orders and history.
Learner questions: What is confirmed for A and B? What is not confirmed for C? When may scope expand? Write the first escalation update.
Show Reference Answer
The UID links the accounts; it does not transfer evidence. Compare each account's own time and order facts. A and B can support a shared current scope only when their evidence matches. C remains outside confirmed impact until its own relevant evidence exists.Case 4 - Market Event or System Incident?¶
Situation and timeline:
Evidence: approved event context from handover → Symbol Overview → Connection Status → Decision Stream with confirmed view scope → Client Stream and account evidence only when relevant.
Learner questions: What does the sequence support? What does it not prove? What is the current scope? Write the first escalation update.
Show Reference Answer
The timeline supports a time-linked market, quote and order review. Event correlation is context, not proof that the event caused a system Incident or every reject. State the specific confirmed product/order/client scope, evidence checked and remaining unknowns; continue monitoring.Reminder¶
Use only within assigned Dealer authority.
Completion Standard¶
- I can build one timeline from several relevant views.
- I can separate facts, scope and unknowns without assigning a cause.
- I can produce a concise escalation and a usable unresolved-item handover.
Previous: Level 3 - Alert Handling · Next: Level 5 - Order Execution Awareness →