> ## Documentation Index
> Fetch the complete documentation index at: https://docs.open-cluster.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Understand findings and citations

> Interpret finding types, confidence, citations, unresolved leads, and next steps.

A finding is a statement supported by one or more recorded reads. Use its type, confidence,
and citations together; none is sufficient alone.

## Finding types

| Type                  | Meaning                                                                                 |
| --------------------- | --------------------------------------------------------------------------------------- |
| Probable cause        | The condition most likely to have initiated the incident.                               |
| Triggering change     | A deployment or edit that set the incident in motion.                                   |
| Contributing factor   | A condition that increased impact or allowed propagation.                               |
| Symptom               | An observed effect, not an explanation.                                                 |
| Propagation effect    | Downstream impact caused by the original failure.                                       |
| Ruled-out explanation | A plausible cause that a relevant read excluded.                                        |
| Unresolved lead       | A plausible explanation that could not be verified, with the read needed to resolve it. |

## Confidence

* `confirmed` means the cited reads establish the finding.
* `likely` means the finding is supported, but a plausible alternative remains.
* `possible` means it is one open explanation among several.

Confidence is not impact or priority. A severe symptom can be confirmed while its cause
remains possible.

## Citations and reads

Each citation points to a read recorded during the investigation. The record includes
the source, query scope, time window, outcome, references, and whether the result was
truncated. Failed reads remain visible because unavailable data can explain why a lead
stayed unresolved.

OpenCluster stores a summary and provenance for each read, not a permanent bulk copy of
all returned content. A finding that cites a read that did not run is rejected rather
than stored.

## No established cause

A valid conclusion can contain only unresolved leads or no findings. Use the recorded
reads to see what was checked, then connect the missing source or run the recommended
operator check. Do not interpret an empty conclusion as proof that nothing happened.

## Next steps

Next steps are suggested actions, ordered toward reversible checks and mitigations.
They are not executed automatically and are not evidence for a finding.