The hour nobody wrote down

The dashboards are up, the graphs are saved, the alerts have their timestamps. Then somebody asks the only question that matters — what was the queue doing when the workers started dying? — and three people give three answers, all of them sincere.

Graphs are summaries, and a summary is lossy on purpose

A metric is a number per interval. It is designed to throw away the events that produced it, which is what makes it cheap enough to keep. That trade is right for alerting and wrong for diagnosis: by the time you are reading a p95 line, the requests that made it have been gone for an hour.

Logs are better and still not enough on their own, because a log is a list and the question is about state. “What was the queue depth at eighteen minutes past” is not something you read off a list. It is something you compute from every event up to that point.

The reconstruction people do in their heads during a review is exactly that computation, run from partial data, under time pressure, by someone who was awake at 03:00. Nobody is careless. The arithmetic is simply not human-sized.

Fold it instead

Keep the events and fold them on demand. The state at an offset stops being a recollection and becomes a function of the log, which means two people at two desks get the same answer and can spend the meeting on the fix rather than on the timeline.

There is a second, quieter benefit. Once the hour is on file, a fix can be argued against it: run the change against the recorded window and watch the queue not climb. That is a far shorter conversation than a hypothesis.

Where the honest limits are

Not everything can be folded. Anything you did not emit is not there, sampling makes the fold incomplete, and a third party’s response was never yours to keep. We publish where those lines are on the security page rather than hiding them behind a demo that only ever shows the good hour.