The first thing customers in metro Detroit knew about this outbreak did not come from a press release. It came from a sign taped up at the counter. In early July, signs appeared at Detroit-area Taco Bell restaurants telling people the stores could not serve lettuce, cilantro, onions, pico de gallo or guacamole because of a national recall. The company itself said nothing publicly for days.

When it finally spoke, on July 14, Taco Bell spoke to reporters rather than to guests, and only after the Washington Post reported that federal and state agencies were looking at the chain. The statement said that guest health and safety was the top priority, that public health officials had not confirmed a link to Taco Bell or to any specific ingredient, supplier, restaurant or retailer, and that the company had “voluntarily and temporarily removed limited ingredients at select restaurants” as a precautionary measure.

Read those two sentences next to each other. Nothing has been confirmed, and also, we have pulled the produce. Both of those things were true on July 14, and only one of them was volunteered as news.

Two days later the language moved. On July 16 the company said it had taken “immediate action to voluntarily remove potentially impacted lettuce from a supplier” in select states, according to NPR, following what it described to ABC News as “ongoing conversations with public health officials.” That same day it told NBC News by email that the lettuce was out of its supply chain nationwide and “indefinitely,” with replacement product in selected states within a day. It did not name Taylor Farms.

On July 17, the day CDC and FDA named the five states and identified Taylor Farms de Mexico as the single supplier, the company issued its fullest statement. It said public health is “a shared responsibility among restaurants, their suppliers, and authorities,” described itself as proud to have acted quickly and proactively throughout, and encouraged other restaurants, retailers and foodservice operators to take the same precautionary action, per CBS News.

Five days after that came the part aimed at customers rather than at reporters. Chief executive Sean Tresvant posted an open letter on LinkedIn thanking the people who had stayed loyal, promising transparency about what the company knew and what it would do next, and offering the line that got quoted everywhere: “We aren’t entitled to your loyalty. We earn it one meal at a time.” The next day the chain sold Enchiritos and nacho fries for a dollar. The following week it did the same with the Mexican Pizza. Every promoted item was lettuce-free.

The most recent word came on July 30, on the Yum Brands second-quarter earnings call. Chief executive Chris Turner told analysts the brand had taken a meaningful near-term sales hit that he expects to be temporary, described Taco Bell as in the early days of recovery, and said consumers increasingly understand this to be “an industry-wide issue, not an issue specific to Taco Bell.” The chief financial officer said the damage bottomed out the weekend of July 18 and that United States same-store sales were down two percent quarter-to-date through July 27. The earnings press release did not mention the outbreak at all. Only the call did, and only because analysts asked.

One more document belongs in this file, and it predates all of it. Yum’s most recent annual filing with the Securities and Exchange Commission named Cyclospora by name as a business risk, listed among foodborne pathogens at the top of the company’s own risk disclosures. That is not a statement about this outbreak. It is a statement that the company understood this organism was a foreseeable threat to its business before anyone got sick.

Now the three things nobody has said.

Taco Bell has never said when it, or any of its franchisees, first received a complaint from a sick customer. It has never said what it knew about its supplier when it bought shredded iceberg lettuce grown and processed in central Mexico. And it has never said when it first had enough information in hand to do something to protect the people it was serving. None of those questions can be answered from press statements. They are answered from records and under oath.

The July 14 statement is where the pressure sits. Product does not come off a prep line for nothing. Something generated the decision to pull lettuce, cilantro, onions, pico de gallo and guacamole from restaurants in Michigan, and that something was written down. Whatever it was, it existed before July 14, because the signs were already up. The interval between that first internal decision and the July 16 nationwide removal is the whole question in this case. A company that says it consistently acted quickly and proactively will have to prove that against its own timestamps.

The records that answer it are ordinary and they exist. Local health departments keep complaint and inspection files on individual restaurants, and those can be obtained by public records request without waiting on anyone’s discovery obligations. Yum operates a guest-relations system that generates a dated ticket every time a customer calls or writes to report an illness, with a free-text field describing symptoms and an escalation threshold that triggers quality-assurance review. Franchisees file their own incident reports, and there are at least three separate reporting streams here, because Pacific Bells, Border Foods and corporate Taco Bell are three different operators serving the same lettuce. Then there is the supplier approval file: the specification, the audit reports, the sourcing terms for Mexican product, and whatever testing was or was not required of it. And there is the internal memo, or the email chain, or the distribution instruction that took the produce off the line in the first place.

The purchasing question has an answer too, and it is uncomfortable for the buyer. This supplier is not a stranger to this parasite. Cyclospora has been traced to product grown and processed in central Mexico before, in an outbreak that produced a public commitment to sample the water and thirteen years of not doing it. Product from Taylor Farms turned up behind outbreaks over the decades. A buyer who names this organism in its own securities filing as a leading risk and then sources ready-to-eat shredded iceberg from a region with that history, is going to have trouble arguing that any of this was a surprise. That will be a fun, under oath deposition,

There is one complication worth flagging before anyone overstates the case. CDC’s own investigation page says that not all Taco Bell locations sourced their shredded lettuce from the same supplier, while the traceback converged on Taylor Farms de Mexico for the locations where sick people ate. That cuts in more than one direction, and it is a fact to pin down in discovery rather than to argue around.

Everything above is public. The company’s statements have been consistent in one respect throughout: they describe what was removed, and never when the company learned it should be removed. That second date is the one that matters, and the only place it exists is inside the company.