Build a timeline that preserves what the evidence can prove

For each relevant event, retain the source service and instance, process or deployment identity, event identifier, raw timestamp and timezone, collection timestamp, and the query or export that produced it. OpenTelemetry distinguishes a record's event timestamp from the time it was observed by the collection system. That distinction matters when a telemetry buffer flushes late. A deployment event, a request error, and an operator's later recollection are different evidence types even if they appear on the same incident page.

Preserve original exports before filtering or joining them, and document transformations so another investigator can reproduce the derived view. Include missing ranges and dropped-record indicators rather than silently excluding them. Protect sensitive payloads and restrict access while retaining the identifiers needed for analysis. A digest can help show that an exported artifact has not changed since capture, but it does not prove that the original source was truthful or complete. Provenance supports scrutiny; it is not a substitute for it.

If two time intervals overlap, their wall-clock evidence alone may not determine which event occurred first. More printed decimal places do not reduce clock error. A message send/receive relation, a local sequence number, or a valid monotonic duration can add ordering evidence, but only under its own semantics. A monotonic clock is useful for elapsed time within its defined clock domain; values from unrelated hosts are not automatically comparable because both were called monotonic.

Record uncertainty in the timeline itself: definite before, definite after, or unresolved under the available bounds. Separate a code rollout's start, its arrival at one replica, and the first request that exercised the new path. An observed error preceding an uncertain deployment marker does not conclusively exonerate the release, nor does a nearby timestamp prove it caused the error. First establish which versions and operations were actually involved, then build and test a causal explanation.

During mitigation, record the hypothesis motivating each action, its intended effect, who or what executed it, and when the effect was actually observed. Keep attempted, acknowledged, and verified changes distinct. A rollback command returning success is not evidence that every worker loaded the earlier artifact. This decision log lets later reviewers distinguish what responders knew at the time from explanations inferred after additional evidence arrived, and helps avoid blaming a decision using information unavailable to its maker.

The waves lab illustrates only how visible alignment can be changed without adding event evidence. Reset, set both phase difference to 0 degrees and amplitude ratio to 1, predict the aligned components, then Play or Step. Reset and set both phase to 90 degrees and ratio to 1 for a separate comparison. The two analytic waves are not service logs, clocks, or a causal model. Their similar shapes remind us to inspect provenance and ordering rather than treating an attractive overlay as proof of a shared incident sequence.