The customer RCA ships with the frozen machine

Tuesday's outage cost your largest customer four hours. Their CTO wants a root-cause analysis by Friday, and she has read enough vendor RCAs to distrust all of them.

On-call snapshotted the container at 14:07, mid-incident, before anyone touched anything. Your RCA document has the usual timeline and the usual fix. It also has one line the usual RCA doesn't: a URL. It opens a read-only terminal on a clone restored from the 14:07 snapshot. Her engineers can tail the logs themselves, read the config as it was, run the query that was wedging.

You're not asking her to trust the narrative. You're handing her the evidence and letting her audit it.

The postmortem describes the incident. The snapshot is the incident.