Move from symptoms to evidence

Each pattern defines a starting signal, the fields needed to connect it to another view, a worked scenario, and checks that catch misleading matches. Keep service, environment, and time window consistent as you follow the evidence.