A hunt correlates sign-ins with device events. Why should the join keys and time relationship be explicitly designed?

1. A join always proves causality between events
2. Any two columns with the same type represent the same entity
3. Joining automatically removes all duplicate evidence
4. Incorrect keys or unbounded correlations can associate unrelated events and multiply rows