{
  "incident": "R14-2026-09-17",
  "timezone": "UTC",
  "exported": "2026-09-17T07:05:00Z",
  "note": "Compiled index; referenced artifacts remain the evidence of record.",
  "events": [
    {
      "id": "rain-watch",
      "time": "05:30",
      "source": "weather-desk",
      "event": "Heavy-rain watch remains active",
      "relevance": "context"
    },
    {
      "id": "routine-poll",
      "time": "06:00",
      "source": "monitor",
      "event": "Scheduled station status poll completes",
      "relevance": "context"
    },
    {
      "id": "login",
      "time": "06:02",
      "source": "authd",
      "event": "fieldtech password session opens outside the documented maintenance window",
      "ref": "access.log"
    },
    {
      "id": "update",
      "time": "06:03",
      "source": "update-agent",
      "event": "calibration-1.4 package accepted; verification record has no signature block",
      "ref": "update-server.log"
    },
    {
      "id": "secret",
      "time": "06:04",
      "source": "diagnostic-export",
      "event": "export contains the configured diagnostic authentication value",
      "ref": "firmware-strings.txt"
    },
    {
      "id": "session-close",
      "time": "06:05",
      "source": "authd",
      "event": "fieldtech session closes",
      "relevance": "context"
    },
    {
      "id": "alert-open",
      "time": "06:33",
      "source": "operations-dashboard",
      "event": "turbidity alert opens after consecutive elevated station reports",
      "relevance": "effect"
    },
    {
      "id": "replay",
      "time": "06:38",
      "source": "gateway-receipt",
      "event": "message R14-0087 arrives again with its earlier sensor time and sequence",
      "ref": "telemetry.jsonl"
    },
    {
      "id": "normal-display",
      "time": "06:39",
      "source": "operations-dashboard",
      "event": "next displayed reading returns near the earlier baseline",
      "relevance": "effect"
    },
    {
      "id": "loss-of-trust",
      "time": "06:40",
      "source": "incident-commander",
      "event": "station feed removed from automatic decision path pending independent comparison",
      "relevance": "containment"
    },
    {
      "id": "sample-dispatch",
      "time": "06:43",
      "source": "field-operations",
      "event": "independent sampling team dispatched; result pending",
      "relevance": "response"
    },
    {
      "id": "evidence-hold",
      "time": "06:47",
      "source": "incident-commander",
      "event": "logs, package record, and configuration placed on evidence hold",
      "relevance": "response"
    }
  ]
}