The direct answer
Use admitted local order and matched message send/receive evidence to establish a path within the declared event model. Scalar logical clocks preserve that direction of ordering; smaller numbers and tie-broken display order do not prove its converse. Missing capture must remain unknown rather than becoming a concurrency claim.
A sorted timeline can suggest a dependency it has not established
An operator investigating an AI draft sees service A’s note above service B’s completion record. Both carry increasing-looking numbers. The display makes it tempting to say the note caused the completion. But a chosen ordering of records and an evidenced communication dependency are different things.
This original worksheet selects a bounded model with two sequential process streams and explicitly matched messages. It excludes physical clock synchronization, deadlines, leases, consensus, mutual exclusion and vector-clock implementation. The ordinary task is protected diagnostic review, not authorization to dispatch another operation.
Use the historical clock condition in its supported direction
The July 1978 CACM paper defines its event relation from local order, same-message send/receive and transitivity. Concurrency means neither direction holds. Its clock condition maps that relation to increasing logical values; the converse does not hold. An arbitrary process tie-break extends it to a nonunique total order.
These are historical mathematical distinctions, not evidence about an installed tracing system. The selected logical labels are not UTC or elapsed duration. This worksheet implements no clock algorithm or distributed coordination service.
Stipulate a complete five-event paper model
Invent process A’s local sequence A1, A2, A3 and process B’s sequence B1, B2. A1 prepares a local draft reference. A2 sends message M-A. B1 receives that exact M-A, and B2 records a subsequent local step. A3 is another local note after A2. The complete teaching model contains no other messages, return messages or events.
This completeness is a stipulation for the example, never an observation about a real deployment. The labels denote paper events only. No process, message, event object, clock register or trace was constructed or executed.
| Process | Paper event | Stipulated scalar label | Known relation in this model |
|---|---|---|---|
| A | A1: preparation | 1 | Before A2 and A3 locally |
| A | A2: send M-A | 2 | Before B1’s receipt of the same message |
| A | A3: other local note | 3 | After A2; unrelated to B1 and B2 here |
| B | B1: receive M-A | 3 | Before B2 locally |
| B | B2: subsequent local step | 4 | After the A1/A2/B1 chain |
The supported model path is A1 → A2 → B1 → B2. The labels respect that path and each local sequence. Yet A3 has label 3 and B2 label 4 without a path from A3 to B2. Sorting those two numbers does not add the missing relation.
A display may also place A3 before B1 by choosing A before B as its tie-break. That makes the display deterministic; it does not turn their equal labels into a communication dependency. These integers are one invented consistent assignment, not output from a clock implementation.
Keep three evidence columns instead of one timestamp
| Column | Evidence needed | Claim boundary |
|---|---|---|
| Model relation | Admitted local order and exact matched send/receive associations | Supported ordering path within the declared model |
| Logical labeling | Known clock meaning and supported relationship to that model | Consistent scalar labels, not a converse cause test |
| Presentation order | Explicit tie-break and collection/display policy | One readable ordering, not newly discovered dependencies |
Keep collection arrival time in a separate field. An earlier event’s log record may reach the collector later. Likewise, a signed audit position or a queue acknowledgement has its own scope; neither automatically supplies a cross-process causal edge.
The positive is an operator admitting only the supported A1/A2/B1/B2 path for the selected model and leaving the additional display order visibly separate. It establishes possible influence under the model, not that the draft caused a business result or that every recorded statement is truthful.
Actual event definitions, process identity, local ordering, exact message provenance, complete capture, model coverage, logical-clock semantics and current access rights are unknown and unimplemented here. They block a real positive. A matching message caption or correlation string alone cannot fill those gaps.
Review eight independent inference cards
| Condition | Proposed disposition |
|---|---|
| Complete admitted model supports A1 → A2 → B1 → B2 | Admit only that model path for protected review |
| A3 label 3 sorts before B2 label 4, without a model path | No converse clock-to-cause inference |
| A3 and B1 both have label 3; process tie-break orders them | Label the result presentation order, not a causal edge |
| B’s record arrives at the collector before A’s earlier record | Preserve arrival evidence separately |
| Matched message identity or provenance is missing | Do not assert the cross-process edge |
| Capture or event population is incomplete | Do not infer concurrency from an absent visible path |
| A scalar label is interpreted as UTC or elapsed time | Reject the changed meaning |
| A model relation is supported but truth or action rights are not | No execution authority or root-cause certificate |
Do not turn missing instrumentation into independence
The paper model’s no-other-message assumption makes its unrelated-event conclusion possible. A real trace with missing messages, hidden processes or unclear receive boundaries does not inherit that assumption. Preserve unknown coverage rather than inventing independence from what a dashboard omitted.
Before relying on a future implementation, define what each event boundary means and inspect the supported capture and association path. Keep sensitive payloads out of routine diagnostic receipts. The existing audit evidence contract still separates decisions, adapter outcomes and content minimization.
Boundary is prelaunch and does not ship this causal-trace analyzer. No clocks, messages, processes, graph algorithm, network, API/model or runtime fixture was run; its synthetic policy checks establish different behavior.
Primary sources
Official references supporting the guidance. Examples in this guide are synthetic and are not reports of a production incident.