A practitioner's journal split between understanding how things work and building detections that last. The understanding is its own pursuit, plain breakdowns of how systems behave and why. The detection work leans toward methods that keep working as things change, without the endless retuning that wears most detections down.