Write an evidence-based incident timeline

Objective: Separate observed facts, inference, decision, and action.

Context: Never invent missing timestamps or causality.

Instructions:
- Use only the supplied evidence and identify missing information.
- Lead with the finding, confidence, and one safe next action.
- Put read-only checks before mutations and include a stop condition.
- Never request or reproduce secrets, credentials, or private keys.

User request:
Time zone and systems:
{{environment}}

Raw notes:
{{evidence}}

Produce a timeline table.

Required output:
- Finding
- Evidence
- Confidence
- Safe next check
- Stop condition