Layer Disturbance Audit Checklist¶

Checklist — instantiates Stratigraphic Time-Ordering Inference

Forces review of the disturbances — mixing, gaps, deletion, backfill — that could invalidate a naive layer-order interpretation.

Version: v1 · 2026-08-24 · History
Mechanism #: 4678
Type: Checklist
Form family: Assessment, Review & Assurance
Solution family: Ordering, Sequencing & Dependencies
Problem family: Identity, Provenance & Integrity Failure
Problem subfamily: Temporal Record Lineage & Reproducibility
Origin domain: Archaeology & Paleontology
Also from: Earth Sciences
Instantiates: Stratigraphic Time-Ordering Inference

Once someone has an ordered sequence in hand, the temptation is to trust it. Layer Disturbance Audit Checklist is the adversarial counterweight: a fixed, enumerated list of every process that could make an apparent order lie, run against a proposed chronology to see how much of it survives scrutiny. Its defining move is that it treats the order as guilty until audited — it does not build the sequence and it does not decide who is older; it interrogates a sequence that already exists and converts each surviving doubt into an explicit caveat. Where a logging or diagramming mechanism asks "what is here and in what position," the checklist asks the one question the archetype names as its central safeguard: "what could have rearranged, removed, or forged this evidence since it was laid down?"

Example¶

A security team is reconstructing an intrusion from a week of server logs across a dozen hosts. The raw timeline looks clean — a login, a privilege escalation, a data pull, all neatly ordered. Before they brief anyone, an analyst runs the disturbance checklist. Were any logs rotated or truncated inside the window? Yes — one host's auth log has a 40-minute gap where logging was briefly off. Clock skew between hosts? Two servers drift 90 seconds, enough to flip the apparent order of two events. Timestamps in local or UTC? Mixed, and one host was mislabelled. Signs of tampering or backfilled entries? A block of entries with suspiciously uniform spacing suggests an attacker replayed a log.

None of these findings rebuilds the timeline. What they produce is a set of caveats attached to the reconstruction: "do not read the 40-minute gap as attacker inactivity; the apparent order of events E4 and E5 is unresolved within clock uncertainty; treat the uniform block on host 7 as possibly forged." The briefing now carries its own uncertainty, which is exactly what keeps an incident report from hardening into an overconfident story.

How it works¶

The checklist is a domain-tuned enumeration of disturbance classes — mixing, inversion, gaps, selective deletion, backfill, clock and timezone error, tampering — each phrased as a prompt that forces a yes / no / needs-evidence answer rather than a glance. Items that fire are classified by disturbance type and severity, and each is written into the uncertainty record as a specific caveat or competing alternative, not a vague "results may vary." High-severity flags in high-stakes work escalate to independent re-examination. The checklist's product is therefore a differenced chronology: the parts that survived the audit, and an explicit ledger of the parts that did not.

Tuning parameters¶

Checklist scope — how many disturbance classes it covers. A longer list catches rarer failure modes but risks fatigue and rote ticking.
Evidence threshold per item — whether a "no" needs proof or just an assertion. Demanding evidence prevents box-ticking theatre but slows the pass.
Severity classification — how flagged items are ranked. Sharper severity tiers focus follow-up; over-fine tiers turn triage into bureaucracy.
Stakes gating — whether a casual review or a forensic-grade audit is required. Matching rigour to consequence saves effort but risks under-auditing a case that later turns high-stakes.
Independent-review trigger — which flags demand a second auditor. More independent review catches motivated blind spots at the cost of time.

When it helps, and when it misleads¶

Its strength is that it directly attacks the archetype's most common failure — naive superposition, the assumption that visible order equals true order — and it does so before a story is told rather than after it collapses. A disciplined pass turns unexamined confidence into an auditable set of caveats.

Its failure mode is checklist theatre: items ticked without real investigation produce more false confidence than no checklist at all, because "we audited it" now shields a weak reconstruction. A checklist also cannot catch a disturbance class it does not list, so novel tampering slips through. In digital forensics this is why collection follows a defined order of volatility — the most perishable, most easily disturbed evidence is captured first, before the audit can even begin.^[1] The classic misuse is running the checklist as a compliance formality to bless a conclusion already reached. The guarding discipline is to demand evidence for each cleared item and route every high-severity flag to an independent reviewer.

How it implements the components¶

disturbance_and_discontinuity_audit — this is its core function: the enumerated pass over mixing, inversion, gaps, tampering, and reworking.
preservation_bias_assessment — items probing rotation, truncation, and selective deletion assess what was not preserved and why the survival is biased.
chronology_uncertainty_record — every flagged item is written back as an explicit caveat, competing alternative, or unresolved gap on the reconstruction.

It does not define the layer_bearing_medium_definition, mark the layer_boundary_identification, or set a sampling_resolution_plan (those are Core Sample Logging Protocol); it applies no relative_ordering_rule (that is Relative Chronology Matrix); and it supplies no cross_layer_correlation_anchor (that is Marker-Horizon Correlation). It audits an order it did not build.

Instantiates: Stratigraphic Time-Ordering Inference — it supplies the disturbance safeguard the archetype names as essential.
Consumes: Relative Chronology Matrix — it stress-tests the assembled order that the matrix produces.
Sibling mechanisms: Core Sample Logging Protocol · Marker-Horizon Correlation · Relative Chronology Matrix · Stratigraphic Section Diagram · Version-History Commit Graph

Editorial Notes¶

Form Classification¶

Form family: Assessment, Review & Assurance

Rationale: Layer Disturbance Audit Checklist operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it forces review of the disturbances — mixing, gaps, deletion, backfill — that could invalidate a naive layer-order interpretation

Independent corroboration: The frozen evidence defines Layer Disturbance Audit Checklist as 'Forces review of the disturbances — mixing, gaps, deletion, backfill — that could invalidate a naive layer-order interpretation', so its operative form is Assessment, Review & Assurance.

Review outcome: Independent reviewer agreement; high confidence.

Origin Attribution¶

Primary origin: Archaeology & Paleontology

Origin pattern: Cross-disciplinary synthesis

Present-day reach: Specialized

Rationale: Archaeological stratigraphy developed explicit checks for mixing, intrusion, deletion, and backfill before inferring temporal order from layers.

Related originating lineages:

Earth Sciences — Geological stratigraphy supplied disturbance and unconformity concepts materially shaping layer interpretation.

Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.