Interview question. Two services in different data centers write audit events with local timestamps. A payment request reaches the second service after the first service accepts it, but the second log entry appears earlier. Explain how that happens, what the timestamps do and do not prove, and how you would reconstruct a defensible event order.