Query state as of a past time

When you need this

“A user reported a flap at 14:42 yesterday. Where was their MAC actually pinned at the time?”
“We rolled config to sw7 last night. What MACs disappeared between 21:00 and 22:00, and where did they reappear?”
“Did the path between these two hosts change after the maintenance window?”

All three are “what did the network look like at T?” questions, which the bitemporal log answers natively.

In the TUI

Every screen has an as-of header at the top. It accepts:

Input	Meaning
`now` (or empty)	Live mode — current belief
`5m ago`	5 minutes ago
`1h ago`	1 hour ago
`2d ago`	2 days ago
`2026-05-10T14:42:00Z`	A specific ISO-8601 timestamp

Press Enter to commit. The status pill flips to amber and every visible row re-queries.

The TRACE screen will re-run the last traceroute at the new as-of. The HISTORY screen filters its timeline to rows whose valid_during contains the new as-of. The OPS FDB tree rebuilds itself.

In SQL

If you’d rather just write SQL — make psql, then:

SELECT mac, port_id, vlan, source, observed_at
FROM mac_observation
WHERE valid_during @> '2026-05-10T14:42:00Z'::timestamptz
  AND mac = 'aa:bb:cc:11:22:33';

The @> operator is “range contains timestamp”. The query returns every row whose valid_during window includes the target T — which is exactly “what was the system reporting about this MAC at 14:42?”.

In the CLI

make trace SRC=aa:bb:cc:11:22:33 DST=aa:bb:cc:44:55:66 VLAN=10 \
  AS_OF=2026-05-10T14:42:00Z

The AS_OF env var drives the --as-of flag, which feeds the traceroute recursive CTE’s wire-time anchor.

Belief-time vs wire-time

The as-of picker controls wire-time — when the fact was actually true on the network. There’s a second axis, belief-time, which is when the system believed a fact. Most operators only ever care about wire-time.

If you need belief-time too (forensic auditing), use the CLI:

docker compose run --rm --no-deps reconciler \
  l2trace trace --src ... --dst ... --vlan 10 \
  --as-of 2026-05-10T14:42:00Z \
  --audit-at 2026-05-10T16:00:00Z

That reads: “the path at 14:42, but only counting beliefs we recorded by 16:00.” Useful for “did we know at the time?” investigations.