Your only record of the incident is a chat thread

Who this is for

• SREs and on-call engineers who own the write-up.
• Engineering managers presenting a retro to people who were not there.
• Anyone rebuilding a timeline from a chat thread, because no tool recorded one.

The problem

• Three people were typing at once. Two timestamps are somebody remembering later.
• Fifteen quiet minutes in the middle were one person in a terminal, and the thread shows nothing.
• The cause got named at minute forty, the rollback worked, and that became a fact.
• Eight action items now inherit a story nobody tested.

What it does about it

• Numbers every timeline row: so the analysis can point at row 14 and mean it.
• Separates events from beliefs: the gap between them is usually the finding.
• Finds five moments, not four: including when the person who could fix it learned an incident was running.
• Records how the cause was confirmed: if the only evidence is that the rollback worked, the write-up says so.
• Names the three skipped questions: the near miss, the blast radius nobody checked, the decision nobody made.

Two minutes to first output

1. Strip customer names from the thread.
2. Paste the pack, the thread, the alerts and the deploy log.
3. Check the timeline before the analysis.

What it will not do

• Invent a time. Where the thread is silent, the timeline says unknown.
• Fetch the earlier write-up when the thread says this happened before. It makes that an action.
• Agree the actions for you. The table ships as proposed, with owners you still have to confirm.