I'm not a network engineer, but from software incidents, a clear timeline of what changed and what was already tried helps a lot.

The handovers I've seen work best cover: current state and impact, a timestamped timeline of changes and actions, what's been ruled out (and how), open hypotheses, who's been contacted, and the next step. "Ruled out" is the one that gets skipped most and costs the next person the most time.

The ruled-out list is a useful callout; including how each item was checked could save the next person time. Pairing that with the current impact and next step makes the handover actionable.

Yes, "how it was checked" matters a lot. "Ruled out the firewall" and "ruled out the firewall by testing from inside the VLAN" lead the next engineer to very different places.

That contrast is clear: “ruled out” is only useful if the handover says how it was tested. Including the test vantage point and time should help someone avoid repeating it or drawing a different conclusion.