incident reviews

Start an incident review with a shared timeline before assigning explanations

Build a shared incident timeline from evidence before deciding causes, then turn the review into owned actions with clear checks.