Contemporaneous Event Log¶
Logging artifact — instantiates Capture-Latency Evidence Stratification
Captures events into the record as they happen, at near-zero latency, so a timestamped primary trace exists before memory or hindsight can reshape it.
The whole point of a Contemporaneous Event Log is that the writing happens while the event is live, not after it is over. It is the mechanism that manufactures the primary observation layer in the first place — the earliest, thinnest, least-interpreted trace of what was seen and done, written before anyone knows how the story ends. Its defining discipline is a latency of near zero: the gap between "this happened" and "this is in the record" is measured in seconds, so hindsight has no window in which to sneak in. That is what separates it from every reconstruction that comes later. The log does not try to be complete, correct, or coherent; it tries only to be early, and to prove it was early with a timestamp it did not choose.
Example¶
At 02:14 an on-call engineer gets paged: checkout latency is spiking. She opens the incident channel and starts typing as she works — "02:14 paged, p99 checkout 8s, looking now"; "02:19 db connections maxed, not sure why"; "02:23 rolled back the 01:50 deploy, watching." Each line lands with an automatic channel timestamp she cannot backdate. She is guessing, wrong twice, and admits it in the log. At 02:41 the graphs recover.
Three days later the postmortem reconstructs a clean causal story: the deploy exhausted a connection pool. That story is correct — but it was not known at 02:19, and the log proves it. When someone later asks "did we know it was the deploy from the start?", the contemporaneous log answers honestly: no, the rollback at 02:23 was a hunch that happened to be right. The value is not the polish; it is the frozen, timestamped record of what was actually visible in the moment, uncontaminated by the tidy explanation that arrived later.
How it works¶
The mechanism is thin by design, and three properties do all the work:
- Write-at-the-moment. Entries are made during the event, by whoever is present, in whatever rough form is fast enough not to interrupt the work. Roughness is a feature — it signals the entry was not composed after the fact.
- Externally-assigned timestamps. The time on each entry comes from the system (channel clock, log ingest time, sensor tick), not from the author, so the latency claim is verifiable and hard to forge.
- Append-only in spirit. New understanding is added as new entries, never by editing old ones. The log grows forward; it does not get rewritten backward.
What it deliberately does not do is interpret, corroborate, or preserve itself against later tampering. It produces the first layer; other mechanisms guard and reconstruct it.
Tuning parameters¶
- Capture granularity — everything versus milestones only. Fine granularity captures the moment-to-moment uncertainty but adds noise and can slow the responder; coarse granularity is cheaper but loses the "what did we know when" detail.
- Latency ceiling — how many seconds may pass before an entry stops counting as contemporaneous. Tightening it strengthens the primary-layer claim but demands more discipline (or more automation) during the event.
- Timestamp source — self-typed, client clock, or server-assigned. Moving toward server-assigned raises trust and forgery-resistance at the cost of some flexibility.
- Automation vs. hand-entry — how much is machine-captured (metrics, deploys) versus typed by a human. Automation lowers latency and effort but only records what is instrumented.
When it helps, and when it misleads¶
Its strength is that it is the only mechanism that can create an uncontaminated first trace — once the moment passes, no later diligence can reconstruct what a contemporaneous log simply recorded. This is exactly the property that legal systems lean on when they admit records "made at or near the time" by someone with knowledge as an exception to the hearsay rule.[1] A live log is the cheapest possible insurance against a future argument about what was known when.
Its failure mode is that people confuse early with accurate. A contemporaneous entry is trustworthy about its own timing, not about its content — the 02:19 guess was wrong. Treating the raw log as ground truth, rather than as the honest first draft it is, imports the responder's in-the-moment errors into the final record. The classic misuse is back-editing: quietly fixing an early entry once the answer is known, which destroys the one thing the log was for. The guarding discipline is to keep the log append-only and to hand correction and interpretation to other layers — the log's job ends at "written early, timestamped, untouched."
How it implements the components¶
primary_observation_layer— the log is the primary layer: the earliest captured trace of the event, preserved as first written.automated_timestamp_capture— each entry carries a system-assigned time the author cannot set, making the "captured live" claim verifiable.capture_latency_window— by pinning entry time against event time at near-zero gap, the log establishes the low-latency end of the window the archetype cares about.
It does not implement delayed_reconstruction_layer or independent_corroboration_channel — those belong to Reconstruction Workspace or Replay Table — and it does not implement provenance_and_custody_trace; keeping the trace read-only and tamper-evident after the fact is the job of Read-Only Raw Evidence Archive, the near-twin that preserves what this mechanism captures.
Related¶
- Instantiates: Capture-Latency Evidence Stratification — this mechanism produces the primary observation layer the whole pattern is built to protect.
- Sibling mechanisms: Read-Only Raw Evidence Archive · Delayed Interview Protocol · Layered Case Note · Provenance and Chain-of-Custody Log · Late-Entry and Backfill Protocol · Reconstruction Workspace or Replay Table
Editorial Notes¶
Form Classification¶
Form family: Record, Log & Register
Rationale: Captures events into the record as they happen, at near-zero latency, so a timestamped primary trace exists before memory or hindsight can reshape it, making its operative form a durable record, ledger, register, or trace whose value depends on preserving actual state or history.
Independent corroboration: The frozen evidence defines Contemporaneous Event Log as 'Captures events into the record as they happen, at near-zero latency, so a timestamped primary trace exists before memory or hindsight can reshape it', so its operative form is Record, Log & Register.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Law & Governance
Origin pattern: Convergent development
Present-day reach: Multi-domain
Rationale: Evidentiary practice cohered records made at or near the event by a knowledgeable person as a privileged primary trace resistant to hindsight reconstruction.
Related originating lineages:
- Criminology & Forensic Studies — Forensic chain-of-events practice supplied timestamped operational incident logs.
- History & Historiography — Source criticism treats contemporaneous records as primary evidence whose timing and perspective must remain visible.
- Organizational & Management Science — Operational incident practice contributes timestamped live logs of observations and actions before a postmortem narrative forms.
Review resolution: Near-event recording cohered independently in evidentiary, forensic, historical, and operational practice; law best captures the reliability doctrine, while the generalized schema is synthesized.
Attribution caveat: Legal, operational, and historical traditions independently privilege near-time recording for related reasons.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; medium confidence.
Notes¶
A contemporaneous log and a read-only archive are easy to conflate but do opposite things in time: the log writes the first trace as the event unfolds, while the archive freezes an already-captured trace so it can never be overwritten. You often want both — the log to create the primary layer, the archive to preserve it.
References¶
[1] Judicial Conference of the United States. Federal Rules of Evidence. United States Courts; amended through December 1, 2025. Provides a hearsay exception for qualifying records made at or near the time by someone with knowledge. registry ↩