{
  "_about": "CoreGuard recorded example — hand-authored illustration, NOT telemetry from a real Mac. See https://coreguard.app/incidents/photoanalysisd-after-update/",
  "incident": "photoanalysisd runaway",
  "process": "photoanalysisd",
  "classification": "real — but benign",
  "note": "Values are compressed onto one scrub of the timeline. No verdict, no failure date — CoreGuard observes and explains.",
  "clock_start": "09:04",
  "minutes_per_step": 6,
  "series": {
    "cpu_temp_c": [
      46,
      47,
      47,
      46,
      47,
      50,
      51,
      54,
      59,
      61,
      62,
      65,
      68,
      68,
      69,
      72,
      73,
      73,
      73,
      75,
      76,
      75,
      76,
      77,
      76,
      75,
      75,
      76,
      75,
      75,
      77,
      76,
      74,
      75,
      76,
      76,
      75,
      76,
      76,
      75,
      74,
      75,
      76,
      72,
      70,
      69,
      66,
      62,
      60,
      59,
      56,
      55,
      55,
      54,
      52,
      52,
      52,
      52,
      50,
      50,
      50
    ],
    "fan_rpm": [
      1400,
      1414,
      1425,
      1437,
      1450,
      1463,
      1474,
      1487,
      1501,
      1884,
      2266,
      2650,
      3034,
      3416,
      3799,
      3931,
      4061,
      4190,
      4319,
      4450,
      4580,
      4709,
      4840,
      4971,
      5100,
      5088,
      5078,
      5067,
      5055,
      5044,
      5034,
      5023,
      5010,
      4999,
      4989,
      4978,
      4966,
      4956,
      4945,
      4933,
      4921,
      4911,
      4901,
      4562,
      4225,
      3888,
      3550,
      3211,
      2875,
      2538,
      2200,
      2130,
      2060,
      1990,
      1919,
      1849,
      1781,
      1711,
      1640,
      1570,
      1500
    ],
    "process_cpu_%": [
      3,
      4,
      4,
      4,
      85,
      165,
      168,
      172,
      178,
      182,
      184,
      184,
      185,
      184,
      183,
      184,
      184,
      182,
      182,
      182,
      182,
      181,
      181,
      182,
      181,
      179,
      180,
      180,
      179,
      179,
      180,
      179,
      177,
      177,
      178,
      177,
      176,
      177,
      177,
      175,
      174,
      175,
      176,
      118,
      62,
      7,
      6,
      4,
      5,
      6,
      5,
      4,
      5,
      5,
      3,
      3,
      4,
      4,
      3,
      3,
      4
    ]
  },
  "process_metric": {
    "label": "PROCESS CPU %",
    "unit": "%",
    "max_scale": 220
  },
  "events": [
    {
      "minute_index": 5,
      "clock": "09:34",
      "kind": "observed",
      "text": "photoanalysisd rises to ~165% CPU"
    },
    {
      "minute_index": 11,
      "clock": "10:10",
      "kind": "observed",
      "text": "CPU die 65°C and climbing — it idled at 46°C"
    },
    {
      "minute_index": 15,
      "clock": "10:34",
      "kind": "observed",
      "text": "fans respond: 1,500 → ~3,900 RPM"
    },
    {
      "minute_index": 19,
      "clock": "10:58",
      "kind": "alert",
      "text": "CoreGuard alert: photoanalysisd has held >150% CPU for over an hour — photo-library re-indexing, common after a macOS update"
    },
    {
      "minute_index": 31,
      "clock": "12:10",
      "kind": "interpreted",
      "text": "heavy but legitimate: it finishes on its own — killing it only restarts the job"
    },
    {
      "minute_index": 45,
      "clock": "13:34",
      "kind": "observed",
      "text": "indexing completes — process falls back to single-digit CPU"
    },
    {
      "minute_index": 53,
      "clock": "14:22",
      "kind": "interpreted",
      "text": "temps and fans settle on their own. Nothing to fix — you just knew WHY the whole time"
    }
  ]
}