OBSERVED LOGS + USER-REPORTED ASSOCIATION
Auth Failures: The Event Sequence Does Not Prove Cause
A long-scroll visual companion to the article. It summarizes the article’s evidence boundary and method; it does not extend the underlying result.
At a glance
Evidence in scope
- 4 auth-invalidated records
- 2 sessions in the redacted diagnostic
- 383.69 seconds to auth-store refresh
Evidence boundary: The plan-change association was user-reported. The logs do not prove the plan change caused the auth events.
How to use the diagram
Keep observed events and reported context on separate tracks; preserve timestamps and omit session IDs/credentials.
What this visual explains: An event timeline can establish sequence and elapsed time without establishing causation.
What it does not establish
383.69 seconds is elapsed time to store refresh, not measured human reauthentication time.