# Incident and Recovery Timeline

| UTC time | Owner | Observation or decision | Command/action | Expected result | Actual result | Evidence |
|---|---|---|---|---|---|---|
| | | Detection | | | | |
| | | Customer impact confirmed | | | | |
| | | Recovery path selected | | | | |
| | | Unsafe writes isolated | | | | |
| | | Recovery source verified | | | | |
| | | Restore or promotion started | | | | |
| | | Routing changed | | | | |
| | | Technical validation passed | | | | |
| | | Business transaction passed | | | | |
| | | Normal traffic resumed | | | | |

## Decision record

- Decision:
- Alternatives considered:
- Evidence:
- Approver:
- Stop condition:
- Rollback or fallback:

## Follow-up

| Action | Risk addressed | Owner | Deadline | Verification |
|---|---|---|---|---|
| | | | | |