Implement sliding-window device anomaly

Streaming detection algorithm: Implement a function process_logins(stream) that consumes a time-ordered stream of login events (user_id, ts, device_id, success) and emits an alert (user_id, window_start_ts, window_end_ts, distinct_devices) whenever a user accumulates ≥4 distinct device_ids with successful logins within any 10-minute sliding window. Constraints: (1) Memory must be O(U * K) where U is active users and K is the number of distinct devices within the last 10 minutes; (2) Support out-of-order events up to 30 seconds late; (3) Amortized time per event should be O(1)–O(log K). Tasks: A) Describe the data structures (e.g., per-user deque keyed by ts plus a hash map of device_id→count) and eviction strategy; B) Explain how you’d handle late events while avoiding duplicate alerts; C) Provide pseudocode (Python-like) and the exact alerting semantics when events arrive on the boundary (inclusive/exclusive).