Case Studies

One canonical public record per underlying incident, including one candidate control. Earlier overlapping writeups remain preserved in the source record but are not counted as separate cases. Linked transcripts retain explicit evidence roles.

Evidence base: provider account exports for three products, app-level exports for two, and 1,300 hashed captures with embedded timestamps. Nine canonical cases resolve to export-backed sessions with server timestamps.