{
  "_meta": {
    "__meta__": "synthetic",
    "disclaimer": "Synthetic demo data inspired by real Baltic geography. Not real observations.",
    "dataset": "s8-red-vessel-escalation/timeline",
    "version": "1.0",
    "anchor_ts": "2025-07-03T09:30:00Z",
    "window_open_ts": "2025-07-03T06:00:00Z",
    "window_close_ts": "2025-07-03T14:00:00Z"
  },
  "events": [
    {"ts_iso": "2025-07-03T06:00:00Z", "stage": "A", "actor": "MV KASPIYSK",       "event": "Enters Gulf of Finland radar coverage from east — AIS nominal, SOG 9 kn, COG 270°. Flag: Liberia. IMO 9234567 matches watchlist entry 'Tier-2 vessel of interest'.", "lat": 59.40, "lon": 27.50, "signals": ["ais"],                         "notes": "Automatic IMO cross-check triggers YELLOW alert. No prior Baltic port history."},
    {"ts_iso": "2025-07-03T07:00:00Z", "stage": "A", "actor": "MV KASPIYSK",       "event": "Transit continues westward at 8 kn. Course 268° — direct heading toward Gulf of Finland narrows.", "lat": 59.55, "lon": 26.80, "signals": ["ais"],             "notes": "COG anomaly: registered homeport Santos, Brazil; no declared destination."},
    {"ts_iso": "2025-07-03T07:30:00Z", "stage": "B", "actor": "MV KASPIYSK",       "event": "Crosses Finnish EEZ boundary. Threat level upgraded to ORANGE. Finnish Border Guard patrol plane RAD-PLN-01 tasked for observation.", "lat": 59.62, "lon": 26.10, "signals": ["ais", "plane_radar"], "notes": "EEZ crossing without prior notification. Vessel unresponsive to VHF hail."},
    {"ts_iso": "2025-07-03T08:00:00Z", "stage": "B", "actor": "RAD-PLN-01",        "event": "Patrol plane acquires KASPIYSK visually — old bulk carrier, deck cargo covered with tarps. No MMSI visible on hull markings.", "lat": 59.70, "lon": 25.70, "signals": ["plane_radar"],                "notes": "Deck configuration inconsistent with declared 'ballast-only' voyage."},
    {"ts_iso": "2025-07-03T08:30:00Z", "stage": "B", "actor": "MV KASPIYSK",       "event": "Vessel slows to 4 kn, executes wide 40° course change. No navigational hazard in area. Threat upgraded to RED.", "lat": 59.75, "lon": 25.20, "signals": ["ais"],  "notes": "Loiter pattern consistent with payload staging. SOG drop from 9 to 4 kn."},
    {"ts_iso": "2025-07-03T09:00:00Z", "stage": "C", "actor": "MV KASPIYSK",       "event": "Vessel comes to full stop at 59.85°N 24.70°E. SOG < 0.5 kn. Position holds. 18 km south of Helsinki coast. No anchor NOTAMs filed.", "lat": 59.85, "lon": 24.70, "signals": ["ais"],  "notes": "Stationary hold in open water — characteristic pre-launch positioning."},
    {"ts_iso": "2025-07-03T09:15:00Z", "stage": "C", "actor": "MAC-HEL-COAST-01",  "event": "SMOKING GUN — Sensor detects DJI controller MAC A4:83:E7:88:AA:01 at -68 dBm. Five drone boot MACs (5C:E2:8C:BB:01–05) detected sequentially over 3 minutes.", "lat": 60.17, "lon": 24.95, "signals": ["mac"], "notes": "Controller MAC seen 15 min before drones appear on radar. Confirms pre-launch staging."},
    {"ts_iso": "2025-07-03T09:25:00Z", "stage": "C", "actor": "MV KASPIYSK",       "event": "AIS transponder goes dark. Last known position: 59.85°N 24.70°E.", "lat": 59.85, "lon": 24.70, "signals": ["ais"],                          "notes": "First AIS dark window begins. Vessel stationary — dark window deliberate."},
    {"ts_iso": "2025-07-03T09:30:00Z", "stage": "D", "actor": "5 × DJI drones",   "event": "All five drones lift off simultaneously. Climb to 80–110 m. RAD-PLN-01 acquires 5 simultaneous low-RCS airborne contacts. Fan pattern confirms coordinated swarm.", "lat": 59.85, "lon": 24.70, "signals": ["drone_radar", "plane_radar", "mac"], "notes": "Unprecedented: 5 contacts from single stationary vessel in training data."},
    {"ts_iso": "2025-07-03T09:35:00Z", "stage": "D", "actor": "T-DRN-S8-01",       "event": "D1 (5C:E2:8C:BB:01) bearing 350° toward Espoo coast. MAC-HEL-COAST-01 RSSI strengthens to -61 dBm.", "lat": 59.95, "lon": 24.60, "signals": ["drone_radar", "mac"], "notes": "D1 leading the swarm westbound."},
    {"ts_iso": "2025-07-03T09:38:00Z", "stage": "D", "actor": "T-DRN-S8-03",       "event": "D3 bearing 005° toward Helsinki West Harbor. D4 bearing 015° toward Helsinki center. Two radar contacts closing on port area.", "lat": 59.98, "lon": 24.78, "signals": ["drone_radar"],              "notes": "Dual port-approach track — possible diversion tactic."},
    {"ts_iso": "2025-07-03T09:40:00Z", "stage": "D", "actor": "MV KASPIYSK",       "event": "AIS brief reappearance (09:35), then goes dark again. Vessel begins southbound turn.", "lat": 59.84, "lon": 24.69, "signals": ["ais"],    "notes": "Second dark window begins. Recovery departure commences."},
    {"ts_iso": "2025-07-03T10:00:00Z", "stage": "E", "actor": "RAD-DRN-PAT-01",    "event": "Border Guard patrol drone scrambles from Helsinki-Malmi. Intercept vector plotted to D3/D4 cluster near Helsinki harbor approach.", "lat": 60.25, "lon": 25.04, "signals": ["drone_radar"],          "notes": "Response asset airborne. 4 contacts still tracked."},
    {"ts_iso": "2025-07-03T10:15:00Z", "stage": "E", "actor": "MV KASPIYSK",       "event": "AIS reappears. Vessel at 59.83°N 24.68°E, SOG 11 kn, COG 185° — accelerating south. Departure confirmed.", "lat": 59.83, "lon": 24.68, "signals": ["ais"],  "notes": "Vessel never stops after dark window 2. Clear exfiltration manoeuvre."},
    {"ts_iso": "2025-07-03T10:30:00Z", "stage": "E", "actor": "T-DRN-S8-02–04",    "event": "D2, D3, D4 reach coast approach zones. D3 enters restricted airspace over Helsinki West Harbor approach corridor.", "lat": 60.16, "lon": 24.80, "signals": ["drone_radar"],              "notes": "Geo-fence violations confirmed for D3. D4 dips below radar at 60 m AGL."},
    {"ts_iso": "2025-07-03T11:30:00Z", "stage": "F", "actor": "MV KASPIYSK",       "event": "Vessel exits Finnish EEZ southbound. SOG 12 kn. Last radar contact before EEZ boundary.", "lat": 59.55, "lon": 24.50, "signals": ["ais", "plane_radar"], "notes": "Vessel departs without intercept. Finnish authorities alerted."},
    {"ts_iso": "2025-07-03T14:00:00Z", "stage": "F", "actor": "Fusion engine",     "event": "Composite score 0.94: IMO watchlist + AIS dark × 2 + MAC co-observation + 5-drone swarm + geo-fence violation → INC-S8-2025-07-03-001", "lat": null, "lon": null, "signals": ["composite"], "notes": "Highest-confidence incident: 6 corroborating signal chains."}
  ]
}