The first 30 minutes of every postmortem is just sorting timestamps

The alert has cleared. The graphs are green again. Now comes the part nobody puts on the incident channel: someone has to sit down and figure out what actually happened, and in what order. And before