Whose Clock Counts

A mobile app buffers analytics events while offline and uploads them when connectivity returns, sometimes hours later. Your hourly active-users chart shows a suspicious spike every morning at 08:00 and a trough overnight, even though instrumentation on the device says usage is smooth. What is the most likely cause?

The window operator has too little parallelism, so backpressure holds the overnight buckets in the source and releases them during the morning

The job windows by processing time, so buffered events count in the hour they were ingested rather than the hour they occurred

The job windows by event time, but the device clocks are set to the phone's local timezone rather than UTC, so each upload lands in the wrong bucket

The consumer group rebalances at 08:00 when the morning deploy runs, replaying committed offsets and double counting the first hour of the day