Rule out before you conclude.
Critical incidents
When a critical system fails and nobody can explain why
Under pressure, guessing feels faster than it is. Rebuild the sequence of events, rule out what changed, then compare healthy components with failing ones. The cause is usually small and specific, and evidence finds it sooner than debate. I guide teams through that discipline until it becomes their own.