Iterative Trace Partitioning in Practice: a Worked Example on the Road Traffic Fines Log

A step-by-step case study of one analysis session in TracePrism, kept as a supplementary reference alongside the TVCG submission and as teaching material for students learning the tool and the underlying method.

Dataset: Road Traffic Fine Management (BPI Challenge 2013 collection) · 150,370 traces · Session date: 2026-08-10 · Duration: ~1h23m (14:45–16:08) · Source material: session log, exported knowledge base, and screen captures taken during the session. Click any figure to view it full-size.
Headline result. Across five iterative rounds — three obvious/outlier groups, three topic-modeling rounds at increasing K, and one UMAP + k-means clustering round on the final residue — the session accumulated 22 committed groups (plus one reopened/superseded group) covering 146,264 of 150,370 traces (97.3%). The remaining 4,106 traces (2.7%) resisted separation and were left unexplained, disproportionately drawn from the dismissed and unresolved outcomes (see Table 2).
Contents
  1. Getting oriented: dataset overview and the process graph
  2. Step 1 — Obvious groups and outliers
  3. Step 2 — First topic round: a self-similar obvious-group subset
  4. Step 3 — Second round: topic-modeling the whole remainder (K=15)
  5. Step 4 — Narrowing further: two more topic rounds (K=9, K=20)
  6. Step 5 — UMAP embedding and cluster sweep on the final residue
  7. Final knowledge base and what was left unexplained
  8. Takeaways for students

Getting oriented: dataset overview and the process graph

STEP 0Every TracePrism session starts on Stage 1 (Overview), which summarizes whatever is currently in the "remaining" working set — at the very start of a session, that is the whole log. For Road Traffic Fines this is 150,370 traces, 2–20 events long, with four possible outcomes (paid_full 40.1%, credit_collection 39.2%, unresolved 19.3%, dismissed 1.4%). The analyst's first observation, noted directly in the session log, was a striking artifact in the date-distribution heatmap: end dates cluster into a handful of sharp monthly spikes rather than a smooth spread — consistent with periodic mass case-closure or amnesty-style batch processing rather than case-by-case resolution.

Stage 1 overview of the full 150,370-trace dataset: headline counts, the per-field data dictionary, and start/end-date calendar heatmaps. The end-date heatmap (right) shows sharp monthly spikes rather than a smooth distribution — the “once-a-year mass release” pattern the analyst flagged first.
Figure 1. Stage 1 overview of the full 150,370-trace dataset: headline counts, the per-field data dictionary, and start/end-date calendar heatmaps. The end-date heatmap (right) shows sharp monthly spikes rather than a smooth distribution — the “once-a-year mass release” pattern the analyst flagged first.

Stage 1 also renders a plain, counts-based directly-follows graph (DFG) of the whole remaining population, letting the analyst sanity-check the vocabulary and control-flow shape before doing any modeling.

Stage 1 process graph (Disco-style DFG) of the whole dataset. Two clear “exit ramps” are visible near the top: Create Fine → Payment, and Create Fine → Send Fine — the two obvious groups committed next.
Figure 2. Stage 1 process graph (Disco-style DFG) of the whole dataset. Two clear “exit ramps” are visible near the top: Create Fine → Payment, and Create Fine → Send Fine — the two obvious groups committed next.

Step 1 — Obvious groups and outliers

1-1 / 1-2 / 1-3 / 1-4Stage 2 (Outliers & Obvious Groups) offers two complementary shortcuts before any modeling: length/attribute-based outlier flagging (for traces that are structurally strange rather than behaviorally similar to anything else), and a ranked list of the most common short trace variants — the "obvious groups" whose control flow is so short and so outcome-pure that no topic model is needed to justify grouping them.

Stage 2: outlier-flagging controls (by trace length, by attribute, by date) alongside the ranked list of common short trace variants. The top two — Create Fine → Payment (46,371 traces, 100% paid_full) and Create Fine → Send Fine (20,385 traces, 100% unresolved) — are exactly the two exit ramps visible in Figure 2.
Figure 3. Stage 2: outlier-flagging controls (by trace length, by attribute, by date) alongside the ranked list of common short trace variants. The top two — Create Fine → Payment (46,371 traces, 100% paid_full) and Create Fine → Send Fine (20,385 traces, 100% unresolved) — are exactly the two exit ramps visible in Figure 2.

Three obvious groups were committed directly to the knowledge base at this step: Create Fine → Payment (46,371 traces, 100% paid_full), Create Fine → Send Fine (20,385 traces, 100% unresolved), and Create Fine → Payment → Send Fine (362 traces, 95% unresolved). A fourth candidate — Create Fine → Send Fine → Payment, 3,131 traces, 92% paid_full — was judged not pure enough to commit as-is and was instead selected for further analysis in Stage 2's "step 2" hand-off, becoming the subject of the first topic round below.

The knowledge base's 2D arrangement view after committing the three obvious groups: each group is reduced to an activity-mix feature vector and projected via PCA, so similar groups land near each other. Pie size is proportional to √(trace count); pie slices show the outcome mix. Two large, outcome-pure pies (paid_full in green, unresolved in gray) dominate at this early stage.
Figure 4. The knowledge base's 2D arrangement view after committing the three obvious groups: each group is reduced to an activity-mix feature vector and projected via PCA, so similar groups land near each other. Pie size is proportional to √(trace count); pie slices show the outcome mix. Two large, outcome-pure pies (paid_full in green, unresolved in gray) dominate at this early stage.

Step 2 — First topic round: a self-similar obvious-group subset

2-1 / 2-2 / 2-3 / 2-4Returning to Stage 2 and selecting the 3,131-trace Create Fine → Send Fine → Payment subset for analysis routes the session into Stage 3 (Encoding). Because every trace in this subset already shares the same three-activity DFG, the encoding-recommendation panel correctly downgrades bare activities/bigrams (which carry no discriminating signal here) and instead surfaces the gap-timing features — max-gap tier and gap-augmented 2-grams — as the highest-scoring encoding.

Stage 3 encoding recommendation for the 3,131-trace subset. Because all traces share the same activity sequence, plain activity/bigram features are uninformative (NMI ≈ 0); the recommender instead ranks activities + 2-grams + max-gap tier highest (sharp 0.862, NMI 0.012, score 0.437).
Figure 5. Stage 3 encoding recommendation for the 3,131-trace subset. Because all traces share the same activity sequence, plain activity/bigram features are uninformative (NMI ≈ 0); the recommender instead ranks activities + 2-grams + max-gap tier highest (sharp 0.862, NMI 0.012, score 0.437).

With that encoding, a K-sweep from 3 to 12 topics was run on Stage 4. The Sankey view tracks how traces redistribute across topic membership as K increases, letting the analyst watch a candidate cluster's stability before committing to a specific K; the paired elbow curves (reconstruction error / silhouette / query-filter coverage) give a second, numeric view of the same trade-off.

K-sweep Sankey, K=3–12, unfiltered.
Figure 6. K-sweep Sankey, K=3–12, unfiltered.
The same sweep with the three query-filter sliders set to dominant-outcome ≥ 0.86 and structure S ≥ 1.6×; K=6 is highlighted (silhouette 0.69, 39% of the subset covered by qualifying topics).
Figure 7. The same sweep with the three query-filter sliders set to dominant-outcome ≥ 0.86 and structure S ≥ 1.6×; K=6 is highlighted (silhouette 0.69, 39% of the subset covered by qualifying topics).

K=6 was selected and inspected topic-by-topic: the small-multiples view lays out every topic's process graph side by side for a quick shape scan, and the term×topic heatmap shows which n-gram/gap features actually drive each topic's assignment. Both views use a small set of recurring visual badges, worth reading once before the figures below:

Reading the small-multiples badges. The topic/cluster cards used throughout Figures 8–27 carry three compact visual signals, worth knowing before the first one appears:
Outcome bar — the thin segmented bar under each card is that topic/cluster's outcome mix, in the same fixed colors used everywhere in the app for this dataset: paid_full, credit_collection, unresolved, dismissed.
Gold dots — one dot per case attribute (trace length, amount, notification type, creation year, duration, max gap, …) whose value for this topic/cluster diverges notably from the working set as a whole. Two dots means two such attributes stand out; hovering them in the live app lists exactly which ones, and by how much.
T0 ✓ Checkmark — a ✓ after the topic label means this topic has already been committed to the knowledge base.
Small multiples of all K=6 topics’ process graphs — T1, T3, and T4 (marked below) stood out as tight, high-purity chains.
Figure 8. Small multiples of all K=6 topics’ process graphs — T1, T3, and T4 (marked below) stood out as tight, high-purity chains.
Term×topic heatmap for the same K=6 fit, used to check which gap-timing features are actually distinguishing the topics before trusting their labels.
Figure 9. Term×topic heatmap for the same K=6 fit, used to check which gap-timing features are actually distinguishing the topics before trusting their labels.

Three of the six topics — T1 (635 traces, 97% paid_full, S 2.9×), T3 (589 traces, 95% paid_full), and T4 (594 traces, 94% paid_full) — were added to the knowledge base as committed groups.

Knowledge base after Step 2: six groups committed, the three new topic-derived ones (rows 3–5) visibly clustered together near the top of the 2D arrangement, distinct from the two large obvious groups.
Figure 10. Knowledge base after Step 2: six groups committed, the three new topic-derived ones (rows 3–5) visibly clustered together near the top of the 2D arrangement, distinct from the two large obvious groups.

Step 3 — Second round: topic-modeling the whole remainder (K=15)

3-1 / 3-2 / 3-3From Stage 2, "use whole remaining dataset" routes the entire unexplained residue — at this point 81,434 traces, 54.2% of the full log — into Stage 3 for a fresh encoding recommendation. With a much larger and more heterogeneous population, the recommender now favors activities + 2-grams outright (sharp 0.937, NMI 0.701) — the control-flow vocabulary itself is discriminating again, unlike the single-DFG subset in Step 2.

Stage 3 selection panel for the whole 81,434-trace remainder, compared against the whole dataset: this slice already skews toward credit_collection (72.5% vs. 39.2% dataset-wide) and away from paid_full (15.0% vs. 40.1%), since the two big obvious groups were carved out first.
Figure 11. Stage 3 selection panel for the whole 81,434-trace remainder, compared against the whole dataset: this slice already skews toward credit_collection (72.5% vs. 39.2% dataset-wide) and away from paid_full (15.0% vs. 40.1%), since the two big obvious groups were carved out first.

A wider K-sweep (5–21) was run and filtered to dominant-outcome share ≥ 90%. K=15 was chosen — at that point, topics satisfying the filter covered 62,110 of the 81,434 traces (76%) at silhouette 0.98.

K-sweep Sankey, K=5–21, filtered to dominant-outcome share ≥ 0.90 (colored bands = topics meeting the filter at that K). K=15 selected.
Figure 12. K-sweep Sankey, K=5–21, filtered to dominant-outcome share ≥ 0.90 (colored bands = topics meeting the filter at that K). K=15 selected.

The two small-multiples snapshots below are placed side by side deliberately, out of chronological order, so the "before" and "after" of committing four topics from this fit can be compared directly: watch how much T0's card shrinks once size is driven by NMF weight instead of raw count (Figure 14) — a first, visual hint that its dominant chain, however large, is common rather than distinctive.

Small multiples of all 15 topics at K=15, sized by raw trace count, captured before this round's commits — T0 (56,482 traces, a simple two-hop chain) dominates by size; several small, tangled “wastebasket” topics (T9–T14) sit at the other extreme.
Figure 13. Small multiples of all 15 topics at K=15, sized by raw trace count, captured before this round's commits — T0 (56,482 traces, a simple two-hop chain) dominates by size; several small, tangled “wastebasket” topics (T9–T14) sit at the other extreme.
The same 15 topics immediately after this round's four commits (✓ on T0, T4, T6, T14), now sized by NMF weight instead of raw count. Directly compare against the previous figure: T0's card shrinks sharply under weight-sizing even though it has by far the most traces, while the smaller, tighter topics barely change size — a preview of the count-vs-weight distinction spelled out fully at Figures 22–24.
Figure 14. The same 15 topics immediately after this round's four commits (✓ on T0, T4, T6, T14), now sized by NMF weight instead of raw count. Directly compare against the previous figure: T0's card shrinks sharply under weight-sizing even though it has by far the most traces, while the smaller, tighter topics barely change size — a preview of the count-vs-weight distinction spelled out fully at Figures 22–24.
Term×topic heatmap for K=15, used to read off which activities/bigrams are distinctive of each committed topic before labeling it.
Figure 15. Term×topic heatmap for K=15, used to read off which activities/bigrams are distinctive of each committed topic before labeling it.

Four topics were committed from this round: T0 (56,482 traces, 100% credit_collection), T4 (3,848, 93% paid_full), T6 (1,523, 100% credit_collection), and T14 (257, 100% credit_collection). The process-graph detail view — which pairs a raw-count layout against an NMF-weight layout of the same topic, so a node or edge that is frequent but not distinctive can be told apart from one that is both frequent and distinctive — was used to confirm each candidate's shape before committing it (the color coding is explained fully at Figures 22–24, once T0 is revisited in Step 4).

Topic T4 (K=15): a short Payment→Payment-heavy chain, 93% paid_full.
Figure 16. Topic T4 (K=15): a short Payment→Payment-heavy chain, 93% paid_full.
Topic T6 (K=15): dominated by the credit-collection notification path, 100% credit_collection.
Figure 17. Topic T6 (K=15): dominated by the credit-collection notification path, 100% credit_collection.
Topic T14 (K=15): a smaller, 100%-pure credit_collection topic routed through the judicial-appeal branch.
Figure 18. Topic T14 (K=15): a smaller, 100%-pure credit_collection topic routed through the judicial-appeal branch.
Knowledge base after Step 3: ten groups committed, 87.1% of the dataset explained so far (table on the right lists all ten with their S/O coherence scores).
Figure 19. Knowledge base after Step 3: ten groups committed, 87.1% of the dataset explained so far (table on the right lists all ten with their S/O coherence scores).

Step 4 — Narrowing further: two more topic rounds (K=9, K=20)

4-1Returning to Stage 2 again and taking the new remainder (19,324 traces) into a fresh K-sweep (5–21, same ≥90% filter), K=9 was the next pick — at that K, three of nine topics qualified, covering 9,090 of 19,324 traces (47%).

K-sweep Sankey for the 19,324-trace remainder entering Step 4, filtered ≥ 0.90 dominant-outcome; K=9 selected (silhouette 0.50, 3 of 9 topics qualifying).
Figure 20. K-sweep Sankey for the 19,324-trace remainder entering Step 4, filtered ≥ 0.90 dominant-outcome; K=9 selected (silhouette 0.50, 3 of 9 topics qualifying).
Term×topic heatmap for the K=9 fit.
Figure 21. Term×topic heatmap for the K=9 fit.

From this fit, T0 (4,779 traces, 98% paid_full) was committed; the process-graph detail view was used to hover individual edges and compare a frequent, near-universal pattern against a rare one — the count-vs-weight color coding introduced above, seen here in full effect.

Topic T0 (K=9): both the count-weighted (left) and NMF-weight-weighted (right) process graphs agree on a single dominant chain.
Figure 22. Topic T0 (K=9): both the count-weighted (left) and NMF-weight-weighted (right) process graphs agree on a single dominant chain.
Reading the process-graph edge colors (Figures 22–24): the same edge is drawn once sized by raw count (left panel) and once sized by NMF weight (right panel); its color compares the two, on a scale relative to this topic's own largest count/weight — not a fixed global threshold.
Gold — weight exceeds count: distinctive of this topic specifically, even if the raw count is small.
Blue — count exceeds weight: common, but not distinctive (most traces do this, so it isn't a strong signature).
Gray — aligned: count and weight roughly agree.
Hovering Send Fine → Insert Fine Notification → Add penalty: 4,778 of the topic's 4,779 traces follow it — a frequent, near-universal pattern. By the color coding above, an edge this close to “every trace does this” reads as common rather than distinctive: it's simply what T0 is, not a signature that sets any subset of it apart.
Figure 23. Hovering Send Fine → Insert Fine Notification → Add penalty: 4,778 of the topic's 4,779 traces follow it — a frequent, near-universal pattern. By the color coding above, an edge this close to “every trace does this” reads as common rather than distinctive: it's simply what T0 is, not a signature that sets any subset of it apart.
By contrast, hovering Insert Fine Notification → Add penalty → Appeal to Judge finds only 18 of the topic's 4,779 traces (NMF weight 0.003) — far rarer, but the color coding marks it distinctive precisely because its weight is high relative to how rarely it occurs: a genuine minority behavioral signature of T0, not just noise from a handful of stray traces.
Figure 24. By contrast, hovering Insert Fine Notification → Add penalty → Appeal to Judge finds only 18 of the topic's 4,779 traces (NMF weight 0.003) — far rarer, but the color coding marks it distinctive precisely because its weight is high relative to how rarely it occurs: a genuine minority behavioral signature of T0, not just noise from a handful of stray traces.

Three further topics from this K=9 fit were also committed (T1, 3,318 traces, 98% unresolved; T3, 1,471 traces, 86% paid_full; T6, 993 traces, 93% credit_collection), while T8 (860 traces) was added and later reopened/superseded as the analysis continued — visible in the knowledge-groups export as the one reopened/superseded row. A second sweep on the next remainder (K=5–21, same filter) settled on K=20 and contributed five more small, high-purity groups (sizes 1,547 / 1,018 / 549 / 399 / 229, all ≥69% dominant outcome); this round was not separately screen-captured but is fully recorded in the session's exported knowledge base.

Step 5 — UMAP embedding and cluster sweep on the final residue

5-1 / 5-2Topic modeling was pushed as far as it usefully could go; the final residue (5,021 traces) was instead routed to Stage 6 for a complementary approach — a 2D UMAP embedding of the trace encodings, used purely as a visual estimate of how many distinct groups might still exist, before committing to any specific cluster count.

Stage 6 UMAP embedding of the 5,021-trace residue, colored by outcome. The tool's automatic shape-detection reports “~0 stable clusters” at this configuration — a visual cue that this residue lacks sharp, separable clusters and will need a numeric k-means sweep rather than eyeballing.
Figure 25. Stage 6 UMAP embedding of the 5,021-trace residue, colored by outcome. The tool's automatic shape-detection reports “~0 stable clusters” at this configuration — a visual cue that this residue lacks sharp, separable clusters and will need a numeric k-means sweep rather than eyeballing.

A k-means N-sweep (N=3–20) on the topic-weight encoding was run next, mirroring the Stage 4 K-sweep's Sankey/elbow-curve treatment but for cluster count rather than topic count.

Cluster N-sweep Sankey, N=3–20, unfiltered — considerably less stable/pure-looking than the topic Sankeys in earlier steps, consistent with the UMAP view's “~0 clusters” read.
Figure 26. Cluster N-sweep Sankey, N=3–20, unfiltered — considerably less stable/pure-looking than the topic Sankeys in earlier steps, consistent with the UMAP view's “~0 clusters” read.
The same sweep filtered to dominant-outcome share ≥ 0.75; N=12 selected (silhouette 0.20, 3 of 12 clusters qualifying, covering 1,731 of 5,021 traces, 34%).
Figure 27. The same sweep filtered to dominant-outcome share ≥ 0.75; N=12 selected (silhouette 0.20, 3 of 12 clusters qualifying, covering 1,731 of 5,021 traces, 34%).

Three homogeneous clusters from the N=12 fit were added to the knowledge base: a 328-trace cluster (72% dismissed), a 292-trace cluster (84% unresolved), and a 295-trace cluster (75% unresolved) — the first and, as it turned out, only groups in the entire session with dismissed as their dominant outcome.

Final knowledge base and what was left unexplained

Final 2D arrangement of all 22 committed groups (plus the one reopened/superseded group), sorted by S/O coherence score in the accompanying table. The large red pie (bottom-right cluster) is the K=15 T0 credit_collection topic — the single largest group found after the two original obvious groups.
Figure 28. Final 2D arrangement of all 22 committed groups (plus the one reopened/superseded group), sorted by S/O coherence score in the accompanying table. The large red pie (bottom-right cluster) is the K=15 T0 credit_collection topic — the single largest group found after the two original obvious groups.

Table 1 lists every group committed during the session, in commit order, with its size, share of the full dataset, dominant outcome, and provenance (which step produced it).

#Descriptionn% of datasetDominant outcomeSource / stepStatus
0 Obvious group: Create Fine → Payment (S – · O 0.99) 46,371 30.8% paid full (99.9%) obvious-group (step 1) active
1 Obvious group: Create Fine → Send Fine (S – · O 1.00) 20,385 13.6% unresolved (100.0%) obvious-group (step 1) active
2 Obvious group: Create Fine → Payment → Send Fine (S – · O 0.81) 362 0.2% unresolved (94.8%) obvious-group (step 1) active
3 Topic T1-dominant (K=6, step 4) (S 2.9× · O 0.54) 635 0.4% paid full (97.3%) topic (step 4) active
4 Topic T3-dominant (K=6, step 4) (S 2.9× · O 0.23) 589 0.4% paid full (94.7%) topic (step 4) active
5 Topic T4-dominant (K=6, step 4) (S 2.8× · O 0.16) 594 0.4% paid full (94.1%) topic (step 4) active
6 Topic T0-dominant (K=15, step 4) (S 1.9× · O 1.00) 56,482 37.6% credit collection (100.0%) topic (step 4) active
7 Topic T4-dominant (K=15, step 4) (S 1.9× · O 0.70) 3,848 2.6% paid full (93.2%) topic (step 4) active
8 Topic T6-dominant (K=15, step 4) (S 1.9× · O 1.00) 1,523 1.0% credit collection (100.0%) topic (step 4) active
9 Topic T14-dominant (K=15, step 4) (S 1.6× · O 1.00) 257 0.2% credit collection (100.0%) topic (step 4) active
10 Topic T0-dominant (K=9, step 4) (S 3.2× · O 0.92) 4,779 3.2% paid full (98.3%) topic (step 4) active
11 Topic T1-dominant (K=9, step 4) (S 3.3× · O 0.91) 3,318 2.2% unresolved (98.0%) topic (step 4) active
12 Topic T3-dominant (K=9, step 4) (S 3.6× · O 0.62) 1,471 1.0% paid full (85.7%) topic (step 4) active
13 Topic T6-dominant (K=9, step 4) (S 3.4× · O 0.74) 993 0.7% paid full (93.0%) topic (step 4) active
14 Topic T8-dominant (K=9, step 4) (S 3.5× · O 0.48) 860 0.6% credit collection (83.5%) topic (step 4) reopened/superseded
15 Topic T0-dominant (K=20, step 4) (S – · O 0.78) 1,547 1.0% unresolved (92.3%) topic (step 4) active
16 Topic T2-dominant (K=20, step 4) (S – · O 0.84) 1,018 0.7% paid full (95.2%) topic (step 4) active
17 Topic T3-dominant (K=20, step 4) (S – · O 0.87) 549 0.4% credit collection (96.2%) topic (step 4) active
18 Topic T5-dominant (K=20, step 4) (S – · O 0.69) 399 0.3% unresolved (90.5%) topic (step 4) active
19 Topic T18-dominant (K=20, step 4) (S – · O 0.69) 229 0.2% unresolved (90.0%) topic (step 4) active
20 Homogeneous cluster: T15-dominant, 72% dismissed (S 3.9× · O 0.45) 328 0.2% dismissed (72.0%) homogeneous cluster (step 5) active
21 Homogeneous cluster: T17-dominant, 84% unresolved (S 4.2× · O 0.61) 292 0.2% unresolved (84.2%) homogeneous cluster (step 5) active
22 Homogeneous cluster: T4-dominant, 75% unresolved (S 3.9× · O 0.38) 295 0.2% unresolved (74.9%) homogeneous cluster (step 5) active

Table 1. All 23 rows exported from the session's knowledge base (22 active, 1 reopened/superseded). "S/O coherence" scores are not reproduced here — see the exported knowledge_report.html for the full per-group fingerprint panels.

Table 2 breaks the final 4,106 unexplained traces down by outcome. The pattern is stark: the session captured the overwhelming majority of paid_full, credit_collection, and unresolved traces (99.2%, 99.6%, and 94.3% respectively), but only recovered 323 of the dataset's 2,060 dismissed-outcome traces (15.7%) — leaving dismissed traces the single hardest outcome to structurally separate in this log, echoing the same finding surfaced independently in an earlier verification session against a prior knowledge-base export from this dataset.

OutcomeTotal in datasetCaptured by knowledge baseStill remaining% of that outcome remaining
credit collection59,01058,7972130.4%
dismissed2,0603231,73784.3%
paid full60,29059,7974930.8%
unresolved29,01027,3471,6635.7%
Total150,370146,2644,1062.7%

Table 2. Outcome breakdown of the 4,106 traces that remained in the working set at the end of the session.

The session log's own closing note: "remaining 4,106 traces — mostly dismissed and unresolved — hard to separate." The numeric breakdown in Table 2 confirms unresolved is actually the larger of the two remaining pools in absolute terms (1,663 vs. 1,737 dismissed), but dismissed is the more strikingly under-captured outcome relative to its total size in the dataset.

Takeaways for students

Start with the free wins. Two obvious groups (Create Fine → Payment, Create Fine → Send Fine) accounted for 66,756 traces — 44.4% of the entire dataset — before any modeling was run at all. Always check Stage 2's ranked common-variant list before reaching for NMF.
Let the data pick the encoding. The same subset can call for completely different encodings depending on how much internal variety it still has: a single-DFG subset (Step 2) needs timing features because activities carry no signal, while the full heterogeneous remainder (Step 3) needs activities back because that's exactly where the signal now is. Always re-run the encoding recommender after every "take remaining" hand-off rather than reusing the previous round's choice.
The K/N-sweep filters are a search tool, not a truth oracle. Every round in this session used the same recipe — sweep a range, filter by dominant-outcome share and/or structure coherence, then eyeball the elbow curves — to narrow from a whole range of K down to one candidate worth inspecting topic-by-topic. The filter thresholds were also relaxed step over step (0.95 → 0.90 → 0.90 → 0.75) as the remaining population got smaller and noisier, which is expected: coherence naturally degrades as the "easy" structure is carved away.
Count and weight tell different stories about the same edge. The T0 process graph in Step 4 makes this concrete: its dominant chain covers 4,778 of 4,779 traces yet reads as merely common, while a branch followed by only 18 traces reads as distinctive — because "distinctive" means characteristic of this topic specifically, not simply frequent. A topic's identity is often carried by its rare branches, not its majority path.
Topic modeling and clustering are complementary, not interchangeable. NMF topic modeling did the heavy lifting for four rounds while the residue was still large and structurally varied; once it stopped producing anything new, switching to a 2D UMAP view plus k-means on the same residue (Step 5) was what surfaced three more usable groups that a fifth topic round likely would not have found — but even that combination topped out at 34% coverage of its own small input, a useful calibration point for how much signal is left to find in a genuinely hard residue.
Iterative partitioning has diminishing, not guaranteed, returns. 97.3% of the dataset was explained by five rounds, but the last round's most successful cluster still covered only 328 traces at 72% purity — far short of the ≥90%+ purity typical of the early rounds. Knowing when to stop (and report the residue honestly, rather than force-fitting it into a low-confidence group) is as much a part of the method as running the sweep.