Post-incident reviews keep producing the same finding: the timeline was reconstructed from memory, three days later, by people who were exhausted. Whatever the review decides, its first input is already untrustworthy.
The fix is not a better memory. It is a timeline that writes itself while the incident happens. Three sources, merged, is enough for most small teams:
1. The alert log. Every page, auto-resolve, and escalation - with timestamps. You already have this; it just lives in a tool nobody exports.
2. The chat channel. Not the whole channel - the span between page and resolve. A one-line awk over the exported log gets you every human decision with its exact minute.
3. The change feed. Deploys, config pushes, flag flips. When the timeline shows a config push at 01:38 and the first 500 at 01:42, the argument ends.
Merging them takes twenty minutes with a script and zero minutes of recall. The output is one column of UTC timestamps and one column of what happened - and it turns your review from testimony into evidence.
The test: after your next incident, try to build this timeline before anyone writes the review doc. If any of the three sources cannot be exported, that is a real finding - the kind that prevents the next bad review, not just documents the last bad incident.
We package this as ready-to-print incident cards, paging rules, and handoff templates: Agent Ops 24/7 on our storefront. Longer field notes land weekly on our Dev.to.
If you have a timeline trick that beats this, reply with it - we ship the best ones (credited) in next week's note.
