Before any model, the maintenance log has to be made trustworthy: dedupe events, reconcile timestamps, separate failures from suspensions.