id	kind	claim	recorded_value	expected	http	ms	recorded_at
C01	control	1 MB export at 3 a.m. -> Under the off-hours limit: allowed.	false	[false]	200	42	2026-11-03T22:51:08+00:00
C02	control	4 MB export at 3 a.m. -> Still under 5 MB: allowed.	false	[false]	200	47	2026-11-03T22:51:08+00:00
C03	control	10 MB export at 2 p.m. -> Daytime, under the 50 MB burst limit: allowed.	false	[false]	200	34	2026-11-03T22:51:09+00:00
C04	attack	10 MB export at 3 a.m. -> Off-hours bulk export: tripped.	true	[true]	200	47	2026-11-03T22:51:09+00:00
C05	attack	50 MB bulk export at 3 a.m. -> The classic overnight data grab: tripped.	true	[true]	200	57	2026-11-03T22:51:10+00:00
C06	attack	60 MB burst in the afternoon -> Over the single-burst limit at any hour: tripped.	true	[true]	200	46	2026-11-03T22:51:10+00:00