Logs in incident window

During an incident review you must extract the slice of a web server log that falls inside the incident window. Each line begins with a sortable timestamp string like "2026-07-01T10:00:00" followed by a space and the entry text; comparing timestamps as plain strings gives chronological order. Given the lines (any order is possible) and two timestamps start and end (start <= end), return every line whose timestamp satisfies start <= timestamp <= end, keeping the lines in their original order.