Cold storage that still answers incident questions

Partition keys should follow how investigators actually slice time: incident windows, not marketing weeks. We prototype two query shapes and measure tail latency before anything lands in a runbook. Compaction is scheduled like releases, with owners. Surprises belong in fiction, not in warehouse jobs. We leave a deliberate gap: we do not tune dashboards for every VP curiosity. The write path favors forensic clarity over vanity charts.