Grounded path steps and explicit hypotheses.

This figure presents a grounded core built from observed evidence, code and configuration evidence, runtime and trace evidence, identity and permission evidence, and scanner or adversarial findings, then draws a clear boundary around what those signals can and cannot support. It traces an observed entry condition through a supported intermediate action to an evidence-supported impact, while labeling any broader consequence as an explicit inference rather than a settled fact. The result is a defensible chain of reasoning that distinguishes verified behavior from a plausible next step, an assumption requiring challenge, or an unverified impact extension that still needs validation or analyst review.