What an incident window actually covers
A report that starts too early buries the reader. A report that starts too late pretends the first alert was the beginning.
An incident window is not the same as the moment someone felt worried. It is the span of timestamps the report is allowed to treat as in-scope. Everything outside that span belongs in a footnote or in a later commission.
We ask coordinators to name two clocks: the first timestamp they can defend with a record, and the last timestamp after which they stopped collecting. If the first clock is a hallway conversation with no note, we do not start there. If the last clock is “when we got tired,” we cut the window at the last export.
Anomaly notes inherit the same edges. An outlier that sits two days before the window can be mentioned as prior context, but it does not get a row in the chronology. Readers deserve to know which facts were admitted and which were only gestured at.
Jackson clients often bring ticket systems that stamp in Eastern Time and packet captures that stamp in UTC. The window lock includes a single displayed zone for the report. Mixed zones without conversion notes are one of the most common reasons a draft comes back marked “cannot tell.”