{
  "disclosure": "Fictional, app-neutral worked excerpt. No customer account or live API call. Not the complete package.",
  "title": "Incident evidence timeline",
  "columns": [
    "Event",
    "UTC timestamp",
    "Observation"
  ],
  "sourceRows": [
    [
      "E01",
      "10:00",
      "error count increased"
    ],
    [
      "E02",
      "10:02",
      "deployment reported"
    ],
    [
      "E03",
      "10:05",
      "alert sent"
    ]
  ],
  "resultRows": [
    [
      "10:00",
      "error increase predates reported deployment"
    ],
    [
      "10:02",
      "deployment is a separate observed event"
    ],
    [
      "10:05",
      "alert timing retained"
    ]
  ],
  "rule": "Sequence alone does not establish cause. Missing clocks or time zones must be resolved before making timing conclusions.",
  "sourceRowCount": 3,
  "outputRowCount": 3
}