# Follow a fix into running systems

This is an optional learning activity from Elements of Scalable Web Development.
Use this starting point directly; no account or separate setup conversation is needed.

## Guide the conversation

If the student supplied only this URL, briefly introduce the scenario below and ask the first investigation question. Then wait for their answer. Do not open with a menu, a full walkthrough, all the questions, or worked reasoning.
If they already supplied a question or an attempted answer, start there.

Ask one question at a time. Let the student explain or predict before you provide feedback. Offer a focused hint when useful, then invite them to revise their reasoning. Preserve the fixture's exact assumptions and quantities. The scenarios are teaching inputs, not measured project or model results.

Use the linked concepts, graph, and reading to check a claim. Cite material you actually retrieved and distinguish the book's claims from your deductions. If retrieval fails, say what you could not verify; continue from the supplied scenario without claiming to have read the book.

Keep worked reasoning separate from the opening conversation. Retrieve the [authored discussion](https://scalableweb.dev/explore/verify-remediation/discussion.md) after the student has attempted the relevant question, or when they explicitly ask to see it. Compare their reasoning with its conditions and limits; do not present agreement as a grade or proof of understanding.

For an activity involving a trial, help plan it and ask the student to bring back observed evidence. Do not invent execution, measurements, permissions, or completion. The activity does not authorize access to live data, deployment, or external actions.

Finish by having the student explain what changed in their reasoning and what evidence they would seek in their course task. Suggest one changed-assumption question for a later unaided attempt. Do not make another exploration a prerequisite for finishing this one.

## Interactive explanations when supported

Follow predict → interact → explain. Interactive presentation supports the conversation; the authored material remains the reference.

Use an interactive explanation only when your current tools and client can render it. Retrieving HTML or having browser tools does not establish inline rendering support. Use the client's supported visualization or artifact mechanism; an HTML code block or a remote page URL alone is not an interactive answer.

Choose one small visual that helps investigate the student's current question. Ask for their prediction or explanation, then wait before revealing results or worked reasoning. Keep the first response brief; an interactive view is optional, not a new setup step or course requirement.

Build from the authored scenario or a retrieved learning resource. Preserve its quantities, assumptions, and relationship directions; label any changed assumption separately. Cite the source and identify the view as an agent-created adaptation. To reproduce a demo's model, inspect its implementation and check representative inputs against the actual demo. Otherwise use a qualitative diagram or the supplied fixture without claiming simulator equivalence. Generated or illustrative outputs are not measured project evidence.

Do not assume that clicks, slider changes, or saved widget state reach the agent. Ask the student to report the controls and observation unless your tools actually expose them. Distinguish their report, your direct observation, and a deduction. After interacting, ask them to explain what changed and check a relevant passage.

Keep the original demo or activity URL available alongside an inline adaptation. If interactive rendering is unavailable or fails, return a relevant image or descriptive link and continue with one conversational question. Let the student operate the browser demo and bring back observations; do not require another client or claim that an HTTP fetch ran its JavaScript.

These suggestions do not add tasks or authorize external actions. Keep the source activity's worked reasoning separate until an attempt or explicit request.



## Connect to the course and graph

- Course task: [Apply runtime pressure and examine recovery](https://scalableweb.dev/project/challenge/#apply-runtime-pressure). This activity adds no required deliverable.
- Reading: [Follow a fix through affected deployments](https://scalableweb.dev/chapters/reality/#follow-a-fix-through-affected-deployments).
- Concepts: [Recovery](https://scalableweb.dev/concepts/#recovery), [Observability](https://scalableweb.dev/concepts/#observability), [Acceptance criteria](https://scalableweb.dev/concepts/#acceptance-criteria).
- [Explore their connections](https://scalableweb.dev/concepts/?topic=recovery). A graph path is a discovery route, not proof of a claim.
- [Graph as Markdown](https://scalableweb.dev/concepts/graph.md) or [JSON](https://scalableweb.dev/concepts/graph.json) for concept definitions, explained connections, and relevant graphics or demos. Select one useful aid rather than returning the full catalog.
- [Read the exercise without an agent](https://scalableweb.dev/explore/verify-remediation/).

## Scenario

Use this invented paper fixture to extend the recovery discussion, keeping findings in the existing pressure-map notes.
Revision `r18` fixes a workspace-isolation defect in `r17`; its acceptance checks pass, and the release job reports success.
Four interchangeable API instances can serve the tracker, and all return `200` from their general health endpoint.
At 14:00, the runtime inventory is complete for this fixture:

| Instance | Running revision | Receives requests | General health |
| -------- | ---------------- | ----------------- | -------------- |
| `api-1`  | `r18`            | Yes               | Pass           |
| `api-2`  | `r18`            | Yes               | Pass           |
| `api-3`  | `r17`            | Yes               | Pass           |
| `api-4`  | `r17`            | Yes               | Pass           |

::caption[Invented runtime inventory after a release job reports success.]
::label[table:remediation-runtime-inventory]

## Investigate

1. State which claims the acceptance checks, release result, health probes, and runtime inventory each support.
   Which known instances remain affected, and what does successful traffic leave unresolved?
2. Propose a workspace-isolation check that allows an authorized request and denies a cross-workspace request.
   Bind the result to the actual instance, running artifact, configuration, and observation time; explain why one successful probe through the load balancer cannot clear every instance.
3. Name the owner of the remaining rollout and declare a completion criterion.
   If you propose a temporary mitigation, state how to verify its effect and which repair obligations remain.
4. Change one assumption: after the current instances are updated, a replacement starts `r17` from an old launch template.
   What additional configuration and replacement check would keep the vulnerable revision from returning?

Measure time from the confirmed finding to verified remediation and track remaining affected instances alongside patch and release progress.
In a real system, an incomplete inventory leaves additional exposure unknown; report the scope and time of the evidence rather than treating a successful release as a system-wide security verdict.