The CMMS reports 93.8% SLA compliance. The event log says 73.4%.

The compliance number is a summary. The event log is the evidence.

Every maintenance contract I have worked with reports an SLA percentage, and the number is usually good. What the number cannot show is how it was achieved. A work order closed on the system before the technician verified the fix counts as met. A P1 downgraded to P2 forty minutes before breach counts as met. A case that bounced between three technicians before anyone touched it still counts, as long as the final clock landed. The event log underneath the CMMS holds all of that, timestamp by timestamp, and almost nobody mines it. This demo does, on synthetic data, so the method can be shown without a client's log.

The process as it ran, and four ways the number flattered it.

• The as-is map. Report, triage, assign, work, parts wait, complete, verify, close, mined from the events rather than drawn from the procedure manual, with an abstraction slider to hide the rare paths and a performance view that colours the slow edges. In the unfiltered performance view the parts-wait edge is the red one.
• Closed before verified. 54 cases marked closed with no verification event before the close, or verification stamped before the work was completed. Met on paper, unproven on site.
• Ping-pong dispatch. 69 cases reassigned two or more times, 46 of them in one trade, which points at a roster gap rather than at any technician.
• The parts-wait black hole. 77 cases that spent more than three days waiting for parts, the longest single wait in the process at a median of 2.8 days per case.
• SLA breach masked by downgrade. 66 cases whose priority was lowered inside the last fifth of the SLA clock and which would have breached the original clock. Measured the CMMS way, compliance reads 93.8%. Measured on wall-clock against the priority as reported, it reads 73.4%.

What this is not.

The event log is generated by a seeded script I wrote, and the generator plants the four behaviours only as timestamps and event order, the way a real log carries them, and writes no labels. No client data and no real CMMS export is involved. The rules are deterministic and every flagged case is listed by name; no model is used anywhere in this demo. A real engagement adds the hard part: getting a clean event export out of a CMMS, agreeing what "verified" means with the contractor, and deciding which findings change the contract. The thresholds (three days for parts, the last fifth of the clock for downgrades) are visible constants and would be set with the owner.