[P0] Build a unified incident timeline and evidence-access ledger

[deucebucket]

Problem

A Deck failure may leave evidence in the kernel journal, user journal, Gamescope service, core dumps, Steam dumps, probe events, storage counters, and physical observations. Today those sources are separated, and an empty source can mean either no evidence or no permission/retention.

Scope

Create a normalized incident timeline plus an access ledger for every collection.

Each event should record timestamp/time basis, boot ID, source, subsystem, severity, raw locator, and confidence class. Each source should record attempted/readable/empty/inaccessible/not-retained/not-applicable.

Acceptance criteria

• Current boot, previous boot, rolling windows, and retained history remain visibly distinct.
• Monotonic and wall-clock timestamps are normalized without inventing precision.
• Probe triggers appear in the same timeline as journal, restart, OOM, GPU, storage, dock, and resume evidence.
• Every module contributes source-access status.
• Correlation rules use bounded time windows and disclose the window.
• Tests cover clock changes, missing journals, permission denial, stale cores, and cross-boot evidence.
• Reports never equate empty or inaccessible with healthy.

Non-goals

This issue does not create automatic root-cause verdicts or hide raw evidence.

Source

See docs/research/steamdeck-issue-deep-dive.md and docs/wiki/Reading-DeckDoc-Reports.md.