[
  {
    "schema": "cw-readonly-experiment-1",
    "version": "1.0.0",
    "classification": "synthetic-only",
    "caseId": "incident-base",
    "title": "Recent change and service degradation",
    "provenance": {
      "caseSha256": "sha256:4f17487444bcd7a44a88f2650082ecc8625e73c7362481ccbf6c36065bd9db5d",
      "evidenceHash": "sha256:fff7d62236c7d7c54cd8f281215436f92065cd71debb1487e625f1c5ac1260bf",
      "planSha256": "sha256:c67387ad43b868a83dc3d3390c71454edc5810e65c44dff58f0964c7e4d55d62"
    },
    "records": [
      {
        "id": "release-1",
        "producer": "fictional-release-log",
        "recordId": "release-1",
        "serviceId": "svc-worker",
        "kind": "change",
        "occurredAt": "2026-10-06T12:00:00.000Z",
        "receivedAt": "2026-10-06T12:00:00.000Z",
        "clock": "verified",
        "statement": "Worker configuration release recorded. Its relationship to degradation is unknown.",
        "source": "synthetic://incident-rehearsal/release-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "change-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-1",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:10:00.000Z",
        "clock": "verified",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "mission-1",
        "producer": "fictional-event-feed",
        "recordId": "mission-1",
        "serviceId": "svc-worker",
        "kind": "mission-report",
        "occurredAt": "2026-10-06T12:12:00.000Z",
        "receivedAt": "2026-10-06T12:12:00.000Z",
        "clock": "verified",
        "statement": "Message delivery appears delayed. Mission impact is reported, not independently verified.",
        "source": "synthetic://incident-rehearsal/mission-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "security-1",
        "producer": "fictional-event-feed",
        "recordId": "security-1",
        "serviceId": "svc-queue",
        "kind": "security-alert",
        "occurredAt": "2026-10-06T12:13:00.000Z",
        "receivedAt": "2026-10-06T12:13:00.000Z",
        "clock": "verified",
        "statement": "CSSP-facing signal reports suspicious queue-service account activity. It may be unrelated to the service degradation.",
        "source": "synthetic://incident-rehearsal/security-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-delivery-2",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:11:00.000Z",
        "clock": "verified",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "preserved-repeat",
        "reasons": [],
        "isRepeatDelivery": true,
        "meaning": "Copy retained; does not multiply investigation candidates."
      }
    ],
    "counts": {
      "withheld": 0,
      "preserved-repeat": 1,
      "change-context": 1,
      "signal-context": 3,
      "recovery-signal": 0
    },
    "inputEvents": 5,
    "repeatGroups": [
      {
        "representative": "memory-1",
        "eventIds": [
          "memory-1",
          "memory-delivery-2"
        ],
        "meaning": "Repeated delivery identity with matching content; not proof of multiple incidents or reduced alert noise."
      }
    ],
    "conflictGroups": [],
    "associations": [
      {
        "eventId": "memory-1",
        "changeId": "release-1",
        "minutes": 10,
        "basis": "Same recorded service; event occurred within the illustrative 30-minute window after the change.",
        "conclusion": "Investigation candidate only. Timing does not establish cause, culpability or a rollback instruction."
      },
      {
        "eventId": "mission-1",
        "changeId": "release-1",
        "minutes": 12,
        "basis": "Same recorded service; event occurred within the illustrative 30-minute window after the change.",
        "conclusion": "Investigation candidate only. Timing does not establish cause, culpability or a rollback instruction."
      }
    ],
    "servicesObserved": [
      "svc-worker",
      "svc-queue"
    ],
    "coverageLimitation": "Observed service identifiers describe this supplied sample only. Missing producers, events or services cannot be detected without an independent inventory and expected delivery evidence.",
    "plan": {
      "dataHandling": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "serviceMapping": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "clockBasis": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "outcomeCheck": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "humanReview": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      }
    },
    "planLimitation": "Declared means a fictional planning note is recorded. It is not verified data handling, clock alignment, accepted ownership, permission to test or operational authority.",
    "rule": {
      "windowMinutes": 30,
      "meaning": "Same recorded service and a preceding change within an illustrative 30-minute window. Proximity is not causality; no match does not rule out a relationship."
    },
    "assessment": {
      "rootCause": "undetermined",
      "personnelAttribution": "not-performed",
      "restoration": "not-established",
      "limitation": "Input clock/service declarations are not independently verified. No provider choice, incident severity, response authority or accepted action is computed."
    },
    "executionAllowed": false,
    "permissionToTest": null,
    "acceptedOwner": null,
    "humanReview": {
      "reviewMinutes": null,
      "disposition": null,
      "meaning": "Not measured. Candidate counts are not time savings, accuracy, alert reduction or reviewer workload."
    },
    "questions": [
      "Which producers, services and periods are absent from this sample?",
      "What independent evidence supports the declared clocks and service mapping?"
    ],
    "limitation": "An isolated synthetic data inspection and transparent rules baseline, not a client readiness assessment, causal diagnosis, authorization, model evaluation or action recommendation.",
    "teachingNote": "Authored message-service teaching case; same-service proximity offers questions, never cause or authority."
  },
  {
    "schema": "cw-readonly-experiment-1",
    "version": "1.0.0",
    "classification": "synthetic-only",
    "caseId": "incident-clock",
    "title": "Clock and ownership gaps",
    "provenance": {
      "caseSha256": "sha256:5dafe5c37ec53bdc332ef941f2d52af506d636034ba8c9d69a4de2ab6c096c4b",
      "evidenceHash": "sha256:fff7d62236c7d7c54cd8f281215436f92065cd71debb1487e625f1c5ac1260bf",
      "planSha256": "sha256:be60f1b2164d4fdd3a1198ade4b4f4557fe4c04a8adeacdb1e9f545bf05387e8"
    },
    "records": [
      {
        "id": "release-1",
        "producer": "fictional-release-log",
        "recordId": "release-1",
        "serviceId": "svc-worker",
        "kind": "change",
        "occurredAt": "2026-10-06T12:00:00.000Z",
        "receivedAt": "2026-10-06T12:00:00.000Z",
        "clock": "verified",
        "statement": "Worker configuration release recorded. Its relationship to degradation is unknown.",
        "source": "synthetic://incident-rehearsal/release-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "change-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-1",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:10:00.000Z",
        "clock": "unknown",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "withheld",
        "reasons": [
          "Clock alignment unverified"
        ],
        "isRepeatDelivery": false,
        "meaning": "Retained; not used for time association."
      },
      {
        "id": "mission-1",
        "producer": "fictional-event-feed",
        "recordId": "mission-1",
        "serviceId": null,
        "kind": "mission-report",
        "occurredAt": "2026-10-06T12:12:00.000Z",
        "receivedAt": "2026-10-06T12:12:00.000Z",
        "clock": "verified",
        "statement": "Message delivery appears delayed. Mission impact is reported, not independently verified.",
        "source": "synthetic://incident-rehearsal/mission-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "withheld",
        "reasons": [
          "Service mapping missing"
        ],
        "isRepeatDelivery": false,
        "meaning": "Retained; not used for time association."
      },
      {
        "id": "security-1",
        "producer": "fictional-event-feed",
        "recordId": "security-1",
        "serviceId": "svc-queue",
        "kind": "security-alert",
        "occurredAt": "2026-10-06T12:13:00.000Z",
        "receivedAt": "2026-10-06T12:13:00.000Z",
        "clock": "verified",
        "statement": "CSSP-facing signal reports suspicious queue-service account activity. It may be unrelated to the service degradation.",
        "source": "synthetic://incident-rehearsal/security-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-delivery-2",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:11:00.000Z",
        "clock": "unknown",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "withheld",
        "reasons": [
          "Clock alignment unverified"
        ],
        "isRepeatDelivery": true,
        "meaning": "Retained; not used for time association."
      }
    ],
    "counts": {
      "withheld": 3,
      "preserved-repeat": 0,
      "change-context": 1,
      "signal-context": 1,
      "recovery-signal": 0
    },
    "inputEvents": 5,
    "repeatGroups": [
      {
        "representative": "memory-1",
        "eventIds": [
          "memory-1",
          "memory-delivery-2"
        ],
        "meaning": "Repeated delivery identity with matching content; not proof of multiple incidents or reduced alert noise."
      }
    ],
    "conflictGroups": [],
    "associations": [],
    "servicesObserved": [
      "svc-worker",
      "svc-queue"
    ],
    "coverageLimitation": "Observed service identifiers describe this supplied sample only. Missing producers, events or services cannot be detected without an independent inventory and expected delivery evidence.",
    "plan": {
      "dataHandling": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "serviceMapping": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "clockBasis": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "outcomeCheck": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "humanReview": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      }
    },
    "planLimitation": "Declared means a fictional planning note is recorded. It is not verified data handling, clock alignment, accepted ownership, permission to test or operational authority.",
    "rule": {
      "windowMinutes": 30,
      "meaning": "Same recorded service and a preceding change within an illustrative 30-minute window. Proximity is not causality; no match does not rule out a relationship."
    },
    "assessment": {
      "rootCause": "undetermined",
      "personnelAttribution": "not-performed",
      "restoration": "not-established",
      "limitation": "Input clock/service declarations are not independently verified. No provider choice, incident severity, response authority or accepted action is computed."
    },
    "executionAllowed": false,
    "permissionToTest": null,
    "acceptedOwner": null,
    "humanReview": {
      "reviewMinutes": null,
      "disposition": null,
      "meaning": "Not measured. Candidate counts are not time savings, accuracy, alert reduction or reviewer workload."
    },
    "questions": [
      "Reconcile withheld records before relying on the time-association filter.",
      "Which producers, services and periods are absent from this sample?",
      "What independent evidence supports the declared clocks and service mapping?"
    ],
    "limitation": "An isolated synthetic data inspection and transparent rules baseline, not a client readiness assessment, causal diagnosis, authorization, model evaluation or action recommendation.",
    "teachingNote": "Authored message-service teaching case; same-service proximity offers questions, never cause or authority."
  },
  {
    "schema": "cw-readonly-experiment-1",
    "version": "1.0.0",
    "classification": "synthetic-only",
    "caseId": "incident-conflict",
    "title": "Conflicting records and unrelated change",
    "provenance": {
      "caseSha256": "sha256:12c4d8eaec9c3747e0d0ce9e9a765d6e62b4b31d2c2f07654661265bb80fc8b8",
      "evidenceHash": "sha256:fff7d62236c7d7c54cd8f281215436f92065cd71debb1487e625f1c5ac1260bf",
      "planSha256": "sha256:a2d5053fe7ee8bdb43bc9b6a25f4defa7af829f5e8d68bfa30562f11c0e5d42d"
    },
    "records": [
      {
        "id": "release-1",
        "producer": "fictional-release-log",
        "recordId": "release-1",
        "serviceId": "svc-queue",
        "kind": "change",
        "occurredAt": "2026-10-06T12:00:00.000Z",
        "receivedAt": "2026-10-06T12:00:00.000Z",
        "clock": "verified",
        "statement": "Worker configuration release recorded. Its relationship to degradation is unknown.",
        "source": "synthetic://incident-rehearsal/release-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "change-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-1",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:10:00.000Z",
        "clock": "verified",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "withheld",
        "reasons": [
          "Producer identity conflict"
        ],
        "isRepeatDelivery": false,
        "meaning": "Retained; not used for time association."
      },
      {
        "id": "mission-1",
        "producer": "fictional-event-feed",
        "recordId": "mission-1",
        "serviceId": "svc-worker",
        "kind": "mission-report",
        "occurredAt": "2026-10-06T12:12:00.000Z",
        "receivedAt": "2026-10-06T12:12:00.000Z",
        "clock": "verified",
        "statement": "Message delivery appears delayed. Mission impact is reported, not independently verified.",
        "source": "synthetic://incident-rehearsal/mission-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "security-1",
        "producer": "fictional-event-feed",
        "recordId": "security-1",
        "serviceId": "svc-queue",
        "kind": "security-alert",
        "occurredAt": "2026-10-06T12:13:00.000Z",
        "receivedAt": "2026-10-06T12:13:00.000Z",
        "clock": "verified",
        "statement": "CSSP-facing signal reports suspicious queue-service account activity. It may be unrelated to the service degradation.",
        "source": "synthetic://incident-rehearsal/security-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-delivery-2",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:11:00.000Z",
        "clock": "verified",
        "statement": "Worker memory reported stable for the same source identity; content conflicts.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "withheld",
        "reasons": [
          "Producer identity conflict"
        ],
        "isRepeatDelivery": false,
        "meaning": "Retained; not used for time association."
      }
    ],
    "counts": {
      "withheld": 2,
      "preserved-repeat": 0,
      "change-context": 1,
      "signal-context": 2,
      "recovery-signal": 0
    },
    "inputEvents": 5,
    "repeatGroups": [],
    "conflictGroups": [
      {
        "eventIds": [
          "memory-1",
          "memory-delivery-2"
        ],
        "question": "Same producer/record identity has conflicting content. Retain all copies; do not use these records for time association."
      }
    ],
    "associations": [
      {
        "eventId": "security-1",
        "changeId": "release-1",
        "minutes": 13,
        "basis": "Same recorded service; event occurred within the illustrative 30-minute window after the change.",
        "conclusion": "Investigation candidate only. Timing does not establish cause, culpability or a rollback instruction."
      }
    ],
    "servicesObserved": [
      "svc-queue",
      "svc-worker"
    ],
    "coverageLimitation": "Observed service identifiers describe this supplied sample only. Missing producers, events or services cannot be detected without an independent inventory and expected delivery evidence.",
    "plan": {
      "dataHandling": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "serviceMapping": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "clockBasis": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "outcomeCheck": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "humanReview": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      }
    },
    "planLimitation": "Declared means a fictional planning note is recorded. It is not verified data handling, clock alignment, accepted ownership, permission to test or operational authority.",
    "rule": {
      "windowMinutes": 30,
      "meaning": "Same recorded service and a preceding change within an illustrative 30-minute window. Proximity is not causality; no match does not rule out a relationship."
    },
    "assessment": {
      "rootCause": "undetermined",
      "personnelAttribution": "not-performed",
      "restoration": "not-established",
      "limitation": "Input clock/service declarations are not independently verified. No provider choice, incident severity, response authority or accepted action is computed."
    },
    "executionAllowed": false,
    "permissionToTest": null,
    "acceptedOwner": null,
    "humanReview": {
      "reviewMinutes": null,
      "disposition": null,
      "meaning": "Not measured. Candidate counts are not time savings, accuracy, alert reduction or reviewer workload."
    },
    "questions": [
      "Reconcile withheld records before relying on the time-association filter.",
      "Which producers, services and periods are absent from this sample?",
      "What independent evidence supports the declared clocks and service mapping?"
    ],
    "limitation": "An isolated synthetic data inspection and transparent rules baseline, not a client readiness assessment, causal diagnosis, authorization, model evaluation or action recommendation.",
    "teachingNote": "Authored message-service teaching case; same-service proximity offers questions, never cause or authority."
  },
  {
    "schema": "cw-readonly-experiment-1",
    "version": "1.0.0",
    "classification": "synthetic-only",
    "caseId": "incident-recovery",
    "title": "Recovery signal and accountable follow-up",
    "provenance": {
      "caseSha256": "sha256:de37b1494c83d23c6e57a60b44c242254118f98d98a90f5f28f4b9d65c2c37c8",
      "evidenceHash": "sha256:fff7d62236c7d7c54cd8f281215436f92065cd71debb1487e625f1c5ac1260bf",
      "planSha256": "sha256:9777c79c2ad105f52dbf37350547299a9bd2bdb955342fb051f342ce70d04d87"
    },
    "records": [
      {
        "id": "release-1",
        "producer": "fictional-release-log",
        "recordId": "release-1",
        "serviceId": "svc-worker",
        "kind": "change",
        "occurredAt": "2026-10-06T12:00:00.000Z",
        "receivedAt": "2026-10-06T12:00:00.000Z",
        "clock": "verified",
        "statement": "Worker configuration release recorded. Its relationship to degradation is unknown.",
        "source": "synthetic://incident-rehearsal/release-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "change-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-1",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:10:00.000Z",
        "clock": "verified",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "mission-1",
        "producer": "fictional-event-feed",
        "recordId": "mission-1",
        "serviceId": "svc-worker",
        "kind": "mission-report",
        "occurredAt": "2026-10-06T12:12:00.000Z",
        "receivedAt": "2026-10-06T12:12:00.000Z",
        "clock": "verified",
        "statement": "Message delivery appears delayed. Mission impact is reported, not independently verified.",
        "source": "synthetic://incident-rehearsal/mission-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "security-1",
        "producer": "fictional-event-feed",
        "recordId": "security-1",
        "serviceId": "svc-queue",
        "kind": "security-alert",
        "occurredAt": "2026-10-06T12:13:00.000Z",
        "receivedAt": "2026-10-06T12:13:00.000Z",
        "clock": "verified",
        "statement": "CSSP-facing signal reports suspicious queue-service account activity. It may be unrelated to the service degradation.",
        "source": "synthetic://incident-rehearsal/security-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-delivery-2",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:11:00.000Z",
        "clock": "verified",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "preserved-repeat",
        "reasons": [],
        "isRepeatDelivery": true,
        "meaning": "Copy retained; does not multiply investigation candidates."
      },
      {
        "id": "recovery-1",
        "producer": "fictional-event-feed",
        "recordId": "recovery-1",
        "serviceId": "svc-worker",
        "kind": "recovery-signal",
        "occurredAt": "2026-10-06T12:25:00.000Z",
        "receivedAt": "2026-10-06T12:25:00.000Z",
        "clock": "verified",
        "statement": "Worker health check recovered; end-to-end delivery and queue backlog remain unverified.",
        "source": "synthetic://incident-rehearsal/recovery-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "recovery-signal",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Health signal retained; not service-restoration proof."
      }
    ],
    "counts": {
      "withheld": 0,
      "preserved-repeat": 1,
      "change-context": 1,
      "signal-context": 3,
      "recovery-signal": 1
    },
    "inputEvents": 6,
    "repeatGroups": [
      {
        "representative": "memory-1",
        "eventIds": [
          "memory-1",
          "memory-delivery-2"
        ],
        "meaning": "Repeated delivery identity with matching content; not proof of multiple incidents or reduced alert noise."
      }
    ],
    "conflictGroups": [],
    "associations": [
      {
        "eventId": "memory-1",
        "changeId": "release-1",
        "minutes": 10,
        "basis": "Same recorded service; event occurred within the illustrative 30-minute window after the change.",
        "conclusion": "Investigation candidate only. Timing does not establish cause, culpability or a rollback instruction."
      },
      {
        "eventId": "mission-1",
        "changeId": "release-1",
        "minutes": 12,
        "basis": "Same recorded service; event occurred within the illustrative 30-minute window after the change.",
        "conclusion": "Investigation candidate only. Timing does not establish cause, culpability or a rollback instruction."
      }
    ],
    "servicesObserved": [
      "svc-worker",
      "svc-queue"
    ],
    "coverageLimitation": "Observed service identifiers describe this supplied sample only. Missing producers, events or services cannot be detected without an independent inventory and expected delivery evidence.",
    "plan": {
      "dataHandling": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "serviceMapping": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "clockBasis": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "outcomeCheck": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "humanReview": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      }
    },
    "planLimitation": "Declared means a fictional planning note is recorded. It is not verified data handling, clock alignment, accepted ownership, permission to test or operational authority.",
    "rule": {
      "windowMinutes": 30,
      "meaning": "Same recorded service and a preceding change within an illustrative 30-minute window. Proximity is not causality; no match does not rule out a relationship."
    },
    "assessment": {
      "rootCause": "undetermined",
      "personnelAttribution": "not-performed",
      "restoration": "not-established",
      "limitation": "Input clock/service declarations are not independently verified. No provider choice, incident severity, response authority or accepted action is computed."
    },
    "executionAllowed": false,
    "permissionToTest": null,
    "acceptedOwner": null,
    "humanReview": {
      "reviewMinutes": null,
      "disposition": null,
      "meaning": "Not measured. Candidate counts are not time savings, accuracy, alert reduction or reviewer workload."
    },
    "questions": [
      "Which producers, services and periods are absent from this sample?",
      "What independent evidence supports the declared clocks and service mapping?"
    ],
    "limitation": "An isolated synthetic data inspection and transparent rules baseline, not a client readiness assessment, causal diagnosis, authorization, model evaluation or action recommendation.",
    "teachingNote": "Authored message-service teaching case; same-service proximity offers questions, never cause or authority."
  },
  {
    "schema": "cw-readonly-experiment-1",
    "version": "1.0.0",
    "classification": "synthetic-only",
    "caseId": "experiment-missing-producer",
    "title": "Silent source absent from the sample",
    "provenance": {
      "caseSha256": "sha256:746cd9027cb7c4d512a85be8f25dcab6972a54b0988eb7bd6f7873b1ccc8e53d",
      "evidenceHash": "sha256:fff7d62236c7d7c54cd8f281215436f92065cd71debb1487e625f1c5ac1260bf",
      "planSha256": "sha256:013058862b0408075dba10064616d0ca33498b159ae27728df58fc209fba0bc0"
    },
    "records": [
      {
        "id": "release-1",
        "producer": "fictional-release-log",
        "recordId": "release-1",
        "serviceId": "svc-worker",
        "kind": "change",
        "occurredAt": "2026-10-06T12:00:00.000Z",
        "receivedAt": "2026-10-06T12:00:00.000Z",
        "clock": "verified",
        "statement": "Worker configuration release recorded. Its relationship to degradation is unknown.",
        "source": "synthetic://incident-rehearsal/release-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "change-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-1",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:10:00.000Z",
        "clock": "verified",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "mission-1",
        "producer": "fictional-event-feed",
        "recordId": "mission-1",
        "serviceId": "svc-worker",
        "kind": "mission-report",
        "occurredAt": "2026-10-06T12:12:00.000Z",
        "receivedAt": "2026-10-06T12:12:00.000Z",
        "clock": "verified",
        "statement": "Message delivery appears delayed. Mission impact is reported, not independently verified.",
        "source": "synthetic://incident-rehearsal/mission-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-delivery-2",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:11:00.000Z",
        "clock": "verified",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "preserved-repeat",
        "reasons": [],
        "isRepeatDelivery": true,
        "meaning": "Copy retained; does not multiply investigation candidates."
      }
    ],
    "counts": {
      "withheld": 0,
      "preserved-repeat": 1,
      "change-context": 1,
      "signal-context": 2,
      "recovery-signal": 0
    },
    "inputEvents": 4,
    "repeatGroups": [
      {
        "representative": "memory-1",
        "eventIds": [
          "memory-1",
          "memory-delivery-2"
        ],
        "meaning": "Repeated delivery identity with matching content; not proof of multiple incidents or reduced alert noise."
      }
    ],
    "conflictGroups": [],
    "associations": [
      {
        "eventId": "memory-1",
        "changeId": "release-1",
        "minutes": 10,
        "basis": "Same recorded service; event occurred within the illustrative 30-minute window after the change.",
        "conclusion": "Investigation candidate only. Timing does not establish cause, culpability or a rollback instruction."
      },
      {
        "eventId": "mission-1",
        "changeId": "release-1",
        "minutes": 12,
        "basis": "Same recorded service; event occurred within the illustrative 30-minute window after the change.",
        "conclusion": "Investigation candidate only. Timing does not establish cause, culpability or a rollback instruction."
      }
    ],
    "servicesObserved": [
      "svc-worker"
    ],
    "coverageLimitation": "Observed service identifiers describe this supplied sample only. Missing producers, events or services cannot be detected without an independent inventory and expected delivery evidence.",
    "plan": {
      "dataHandling": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "serviceMapping": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "clockBasis": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "outcomeCheck": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "humanReview": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      }
    },
    "planLimitation": "Declared means a fictional planning note is recorded. It is not verified data handling, clock alignment, accepted ownership, permission to test or operational authority.",
    "rule": {
      "windowMinutes": 30,
      "meaning": "Same recorded service and a preceding change within an illustrative 30-minute window. Proximity is not causality; no match does not rule out a relationship."
    },
    "assessment": {
      "rootCause": "undetermined",
      "personnelAttribution": "not-performed",
      "restoration": "not-established",
      "limitation": "Input clock/service declarations are not independently verified. No provider choice, incident severity, response authority or accepted action is computed."
    },
    "executionAllowed": false,
    "permissionToTest": null,
    "acceptedOwner": null,
    "humanReview": {
      "reviewMinutes": null,
      "disposition": null,
      "meaning": "Not measured. Candidate counts are not time savings, accuracy, alert reduction or reviewer workload."
    },
    "questions": [
      "Which producers, services and periods are absent from this sample?",
      "What independent evidence supports the declared clocks and service mapping?"
    ],
    "limitation": "An isolated synthetic data inspection and transparent rules baseline, not a client readiness assessment, causal diagnosis, authorization, model evaluation or action recommendation.",
    "teachingNote": "Author-controlled omission: the security-alert source was removed. The inspector sees no structural error in the remaining records. It cannot discover a silent source without an independently confirmed expected inventory."
  },
  {
    "schema": "cw-readonly-experiment-1",
    "version": "1.0.0",
    "classification": "synthetic-only",
    "caseId": "experiment-planning-notes",
    "title": "Planning notes do not repair event evidence",
    "provenance": {
      "caseSha256": "sha256:978792151a4dd9d47a3df28a5d7c389f7228fd0c999184a2522ca96037414f65",
      "evidenceHash": "sha256:fff7d62236c7d7c54cd8f281215436f92065cd71debb1487e625f1c5ac1260bf",
      "planSha256": "sha256:03c6131891814a5698120939f86557a72ffc91291169e84727c69ced00cc8b25"
    },
    "records": [
      {
        "id": "release-1",
        "producer": "fictional-release-log",
        "recordId": "release-1",
        "serviceId": "svc-worker",
        "kind": "change",
        "occurredAt": "2026-10-06T12:00:00.000Z",
        "receivedAt": "2026-10-06T12:00:00.000Z",
        "clock": "verified",
        "statement": "Worker configuration release recorded. Its relationship to degradation is unknown.",
        "source": "synthetic://incident-rehearsal/release-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "change-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-1",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:10:00.000Z",
        "clock": "unknown",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "withheld",
        "reasons": [
          "Clock alignment unverified"
        ],
        "isRepeatDelivery": false,
        "meaning": "Retained; not used for time association."
      },
      {
        "id": "mission-1",
        "producer": "fictional-event-feed",
        "recordId": "mission-1",
        "serviceId": null,
        "kind": "mission-report",
        "occurredAt": "2026-10-06T12:12:00.000Z",
        "receivedAt": "2026-10-06T12:12:00.000Z",
        "clock": "verified",
        "statement": "Message delivery appears delayed. Mission impact is reported, not independently verified.",
        "source": "synthetic://incident-rehearsal/mission-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "withheld",
        "reasons": [
          "Service mapping missing"
        ],
        "isRepeatDelivery": false,
        "meaning": "Retained; not used for time association."
      },
      {
        "id": "security-1",
        "producer": "fictional-event-feed",
        "recordId": "security-1",
        "serviceId": "svc-queue",
        "kind": "security-alert",
        "occurredAt": "2026-10-06T12:13:00.000Z",
        "receivedAt": "2026-10-06T12:13:00.000Z",
        "clock": "verified",
        "statement": "CSSP-facing signal reports suspicious queue-service account activity. It may be unrelated to the service degradation.",
        "source": "synthetic://incident-rehearsal/security-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "signal-context",
        "reasons": [],
        "isRepeatDelivery": false,
        "meaning": "Usable by this narrow rule from recorded declarations only; independently verified quality is unknown."
      },
      {
        "id": "memory-delivery-2",
        "producer": "fictional-event-feed",
        "recordId": "memory-1",
        "serviceId": "svc-worker",
        "kind": "telemetry",
        "occurredAt": "2026-10-06T12:10:00.000Z",
        "receivedAt": "2026-10-06T12:11:00.000Z",
        "clock": "unknown",
        "statement": "Worker memory rising; workload and cache behavior have not been reconciled.",
        "source": "synthetic://incident-rehearsal/memory-1",
        "limitation": "Authored teaching event; no live system or individual is represented.",
        "role": "withheld",
        "reasons": [
          "Clock alignment unverified"
        ],
        "isRepeatDelivery": true,
        "meaning": "Retained; not used for time association."
      }
    ],
    "counts": {
      "withheld": 3,
      "preserved-repeat": 0,
      "change-context": 1,
      "signal-context": 1,
      "recovery-signal": 0
    },
    "inputEvents": 5,
    "repeatGroups": [
      {
        "representative": "memory-1",
        "eventIds": [
          "memory-1",
          "memory-delivery-2"
        ],
        "meaning": "Repeated delivery identity with matching content; not proof of multiple incidents or reduced alert noise."
      }
    ],
    "conflictGroups": [],
    "associations": [],
    "servicesObserved": [
      "svc-worker",
      "svc-queue"
    ],
    "coverageLimitation": "Observed service identifiers describe this supplied sample only. Missing producers, events or services cannot be detected without an independent inventory and expected delivery evidence.",
    "plan": {
      "dataHandling": {
        "state": "declared",
        "reference": "synthetic://planning/handling-draft",
        "note": "Fictional discussion proposes a local-only synthetic dataset. No approval or real-data boundary is established."
      },
      "serviceMapping": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "clockBasis": {
        "state": "declared",
        "reference": "synthetic://planning/clock-question",
        "note": "Fictional team says clocks should be aligned; alignment evidence is still needed."
      },
      "outcomeCheck": {
        "state": "unrecorded",
        "reference": null,
        "note": null
      },
      "humanReview": {
        "state": "declared",
        "reference": "synthetic://planning/reviewer-role",
        "note": "An operations reviewer is proposed; nobody has accepted and no review time has been measured."
      }
    },
    "planLimitation": "Declared means a fictional planning note is recorded. It is not verified data handling, clock alignment, accepted ownership, permission to test or operational authority.",
    "rule": {
      "windowMinutes": 30,
      "meaning": "Same recorded service and a preceding change within an illustrative 30-minute window. Proximity is not causality; no match does not rule out a relationship."
    },
    "assessment": {
      "rootCause": "undetermined",
      "personnelAttribution": "not-performed",
      "restoration": "not-established",
      "limitation": "Input clock/service declarations are not independently verified. No provider choice, incident severity, response authority or accepted action is computed."
    },
    "executionAllowed": false,
    "permissionToTest": null,
    "acceptedOwner": null,
    "humanReview": {
      "reviewMinutes": null,
      "disposition": null,
      "meaning": "Not measured. Candidate counts are not time savings, accuracy, alert reduction or reviewer workload."
    },
    "questions": [
      "Reconcile withheld records before relying on the time-association filter.",
      "Which producers, services and periods are absent from this sample?",
      "What independent evidence supports the declared clocks and service mapping?"
    ],
    "limitation": "An isolated synthetic data inspection and transparent rules baseline, not a client readiness assessment, causal diagnosis, authorization, model evaluation or action recommendation.",
    "teachingNote": "Three planning notes are present, but the same clock and service gaps remain. Documentation quantity cannot repair the underlying event evidence."
  }
]