Begin with the question being asked
In operational diagnosis, a typical question is: what is happening in this system, and why? Logs, metrics and traces help an operator investigate latency, failures and dependencies. The exact capabilities depend on the instrumentation and deployment.
In a witnessability assessment, the question is more specific: what grounds support this proposition for this evaluator? For example, does the evidence establish that a particular request reached a service, that a particular operation completed, or that an external effect occurred?
Design the two uses together
Systems can be instrumented to support both diagnosis and later evidentiary evaluation. Useful design questions include which propositions will matter, which boundaries can observe them, which records will be preserved and how identifiers bind records to the relevant instance.
When a potential adversary controls a producer, an additional component is not automatically independent. Examine shared credentials, administration and the ability to suppress or fabricate records. Independence is relative to the claim and adversary model.
Compare the arrangement, not the marketing label
This is not a ranking of tools. An observability deployment may provide strong grounds for some propositions; an evidence-oriented product may provide weak grounds for others. Evaluate each arrangement against its stated purpose, capture conditions and claims.
A practical review can reuse existing telemetry rather than require a new universal format. The task is to make the connections and limits explicit, and to identify where additional observation or enforcement would be needed.