{
  "_comment_negative_example": "eventType is NOT in the canonical EventType enum (uses pre-#640 'CONNECTED' string instead of 'dll.connected'). Validator MUST reject (R10).",
  "eventType":  "CONNECTED",
  "occurredAt": "2026-06-01T19:42:11Z"
}