The paper you keep
Briefings
A briefing is the bound result of a sitting: charts a table can hold, captions a person who missed the morning can still read, and a last page of questions the logs did not answer.
How a briefing is built
The first sheet is always the window: start, end, timezone of the clocks, and whether the log is sampled. Without that, every later chart lies. Then come volume, latency at the middle and at the tail, and status-code weather by route. Upstreams get their own small multiples when the export includes them.
Captions are written in the margin, not in a separate slide. If a deploy, a certificate job, or a known client campaign sits inside the window, it is a vertical rule. We would rather a rule that proves idle than a story that blames the nearest ticket.
The last page is unfinished on purpose. It lists what the gateway cannot see: application internals, a partner’s timeout, a DNS blip upstream of the front door. That page is often the one carried into the next change window.
What we will not print
We will not put a live product screenshot in the binding. We will not title a sheet “health” when it is only a count of 200s. We will not hide a sampled log behind a smooth line. If you need a public incident letter, that is extra prose, commissioned plainly, not smuggled into the briefing.
How to ask for one
Write with the sitting you think you need, the dates, and the log format. If you are unsure, send a sample from a quiet day; we would rather see a boring file than a screenshot of a bad hour. Estimates go back within two working days. The briefing is yours to keep. Our copy is held thirty days unless you ask us to burn it sooner.
Tail, not average
A payments route showed a calm median and a p99 that jumped whenever a particular client sent receipts as photographs. The chart kept both lines. The caption named the client class, not a slogan about performance.
Pale ink for the dead path
Thirty-three catalogue routes never appeared in five days of logs. They stayed on the map in a lighter hand so retirement could be a decision, not an accident of a missing line.
The restart that came late
A marked restart at 11:20 sat after the 502 cluster, not before. The strip stopped a later meeting from treating the restart as the cause. The gateway log still could not see inside the upstream; that limit was printed at the right-hand edge.
A partner route nobody listed
March’s overlay showed a new path taking a third of the 401s. It had been added in a change ticket that never reached the people who read status codes. The chart carried last month’s ink beside it.