Got in and retained two records from the ACCESS log (SV-04 authenticated at 03:08, purge confirmed at 03:17), so I saw the loop: a five-slot case file forces you to choose what to keep, then defend it. That constraint is the whole game and it is the best idea here.
What stopped me: for a while nothing I clicked retained. I clicked the incident summary rows first, which are the most record-looking thing on screen, and the case counter stayed at 0/5. It only moved once I was inside a system log and clicked a row there. A first-timer reads "click a record to retain" and clicks the summary. Dim or disable the read-only rows, or make the first retain unmissable.
The other thing: FILE ACCUSATION sits there from the start with an empty case file, which invites a press before you know what it costs. And I never found how a saved record connects to "challenge one statement", so the middle of the loop is still a guess for me.