概念概述
事故时间线重建（Incident Timeline Reconstruction）指的是：事故时间线按顺序记录检测、诊断、缓解与解决事件，把混乱的中断转化为可供复盘与学习的序列。
从更严格的定义看，An incident timeline is a chronological record of the key events during an incident, including when it started, when it was detected, what actions were taken, and when it was resolved. 该概念在工程实践中的价值，在于它能帮助团队用统一的语言描述一个具体的质量属性或设计约束，从而在评审与协作中减少歧义。
为什么需要它
It is the backbone of a post-incident review and of measuring detection and response performance. 它与 Heap Profiling、Centralised Log Aggregation、The USE Method for Resource Analysis 等概念经常一起出现，用于解决相近的工程问题。理解它的适用场景，有助于在多种备选方案之间做出有依据的取舍，而不是凭直觉选择技术方案。
常见误解
- the timeline is only a formality after the fact
- timestamps can be reconstructed reliably from memory
需要避免的反模式
- writing the timeline after the review instead of capturing events live
- omitting the detection lag between impact and alert
实践要点
- Distinguishing time of impact from time of detection exposes monitoring gaps, which is often a more valuable finding than the code defect that caused the outage.
- Capturing events as they happen, including who did what and the outcome, prevents hindsight bias from rewriting the sequence later.
- A timeline also feeds metrics such as time to detect and time to mitigate, which track whether the response process is improving over time.