Observed repeatable structural drift before incident clusters across RTT, DNS and HTTP telemetry layers.

Dataset: ~292k measurements 42 incident clusters

median lead times:

RTT → 15.99 min DNS → 19.0 min HTTP → 29.51 min

78.6% of incidents show precursor behaviour 19% show multi-layer confirmation

curious whether others working on observability or reliability engineering have seen similar early drift behaviour.