Observed repeatable structural drift before incident clusters across RTT, DNS and HTTP telemetry layers.
Dataset:
~292k measurements
42 incident clusters
median lead times:
RTT → 15.99 min
DNS → 19.0 min
HTTP → 29.51 min
78.6% of incidents show precursor behaviour
19% show multi-layer confirmation
curious whether others working on observability or reliability engineering have seen similar early drift behaviour.
