Briefing people who were not in the channel
The chronology is for people who missed the night shift. It should not require the slang of the channel to be understood.
A visibility briefing fails when it is a recap for the people who already lived it. Those people have Slack. The report is for finance, legal, or an operations lead who needs to know what was seen, what was not seen, and which decisions still hang on missing evidence.
We keep detector names in an appendix and use ordinary verbs in the main chronology: “the mail gateway wrote a reject,” “the laptop failed to check in,” “the ticket sat unassigned for fourteen hours.” If a tool name is unavoidable, it gets a one-line gloss the first time it appears.
Anomaly language is easy to overdo. “Suspicious” is not a finding. The finding is the deviation: a login from a city the staff roster does not include, a volume spike against a known baseline the client supplied, a process that is new in thirty days of local tracking files.
When we brief in Jackson, we print the chronology on paper. Screens invite scrolling past the coverage-gap page. Paper makes that page as heavy as the timeline.