Investigation scope and hypotheses

A vague question such as “Who is behind this token?” quietly bundles funding, technical control, identity and motive. A bounded question lets a second analyst disagree using the same records rather than a competing story.

Begin with a claim that can fail. Name the network, exact asset identifier, block interval and event predicate. Separate the observation you need from the hypothesis it may support. “Did output X fund input Y?” is a ledger question; “Does the same person control both?” needs a different evidential bridge.

Pre-register both supporting and disconfirming conditions. If a path is absent from an indexer, check coverage before treating absence as disconfirmation. A graph limited to one chain cannot exclude an exchange withdrawal, bridge or off-chain arrangement. Define a stop rule: when the necessary receipt or ownership evidence is unavailable, narrow the conclusion or mark INSUFFICIENT EVIDENCE. Do not widen the scope merely because a label seems interesting.

Maintain four fields for each claim: OBSERVED record, INFERRED interpretation with alternatives, UNKNOWN fact, and whether available evidence is sufficient for the proposed conclusion. UNKNOWN describes a missing fact; INSUFFICIENT EVIDENCE describes a decision about a claim. A report can observe a transfer while declining an ownership conclusion.

Scope: network, asset, interval and predicate.

Falsifier: a record that would contradict the stated test.

Attribution bridge: evidence connecting a technical relation to the proposed controller.

ILLUSTRATIVE: analyst R receives a screenshot claiming that fictional asset T on network N was funded by actor H. Stipulated rows show A → B at block 100 and C → B at block 102; no identity evidence exists. The proposed scope is N, blocks 99–103, exact asset T. These labels are not real addresses. The ledger predicate asks whether A funded B within that interval; a separate human-controller claim remains untested.

Two-column evidence panel: ledger predicate and identity predicate. Show A → B and C → B as stipulated edges; draw no common-owner circle. Add a coverage gate and stop box.

Caption: Fictional scoped inquiry; funding edges do not identify a human.

SPECIFICATION_ONLY — the rendered visual has not been produced or independently reviewed.

Within the stipulated fixture, two funding relationships are specified and the scoped question is answerable. The plan makes collection and rejection criteria reviewable.

It establishes no actual chain event, identity, ownership, intent or global funding history. A small scoped result cannot become an accusation.

Starting with the suspected person; treating shared destination B as shared control; silently expanding the time interval; interpreting missing provider rows as proof of no transaction.

Draft a one-sentence falsifiable ledger question and a separate ownership question. Specify the interval, a falsifier, a coverage prerequisite and a stop condition. Classify the two incoming edges and actor H claim.

• Name the exact network and asset.
• State the interval and predicate before collection.
• List a falsifier and provider coverage prerequisite.
• Separate ledger, control and identity claims.

A reproducible investigation begins with a claim that can fail and a scope that can be checked.

• Bound the question before graph interpretation.
• A funding relationship and ownership attribution require different evidence.
• Missing coverage can prevent a conclusion.

P10-L02

Use the named ZECOIN tool only as an evidence-reading context. This lesson creates no tool output, account session or entitlement. Offline exercise; do not sign, deploy, approve or fund anything.

• BTC: Bitcoin developer guide — transactions — Input references identify previous transaction outputs; scripts do not identify a human. Boundary: Mechanism documentation only; original illustrative values are stipulated, not observations. Historical records have separately frozen provenance and explicit collection gaps.
• API: Esplora public API specification — GET routes, integer satoshis and indexed confirmation/outspend fields. Boundary: Mechanism documentation only; original illustrative values are stipulated, not observations. Historical records have separately frozen provenance and explicit collection gaps.

ILLUSTRATIVE — entirely fictional offline inputs; no current observation.

null — no real observation

1

null

needs_review