Incident Timeline Reconstruction

When a gateway morning goes badly, memory and the status page rarely agree. This sitting rebuilds the hours as a single annotated strip: request volume, error counts, timeout counts, and vertical marks for deploys, restarts, and certificate events.

We ask for an hour before the first complaint and an hour after recovery, not only the red window. Quiet minutes matter; they stop a later meeting from treating the whole morning as one smear. Timeouts are drawn in a separate ink from application errors so a hung upstream is not filed as “the API returned 500.”

The deliverable is a long sheet and a ninety-minute sitting. We do not write your public incident letter unless you commission that prose separately. We will not guess at root cause when the logs stop at the gateway; we will mark the edge where visibility ends.

Rush work, when the desk is already in Batumi that day, is acknowledged the same afternoon. The reconstruction still needs sleep; charts drawn at two in the morning are usually wrong about timezone.