Technical leaders who read unfamiliar systems well do two things that distinguish them. First, they separate the system model from the failure model. They build the model of the system (F6, F5) before they build the model of the failure (F3). Engineers who skip to the failure model build a narrative that makes the symptoms make sense but may miss the actual cause.
Second, they commit to a hypothesis before gathering more evidence. Experienced technical leaders name their current best hypothesis explicitly — “I think this is FM5 at the payment dependency, and the symptom is order queue backup” — because naming it forces the hypothesis to become falsifiable. Evidence gathering that has no hypothesis is just reading.
They also make the system read collaborative when time permits. One person asking the F5 questions out loud while another verifies against the actual system is faster than one person doing both — the externalised model catches the errors the single reader misses.