Timeline reconstruction → root cause analysis → impact assessment → remediation plan. Structured blameless postmortem workflow for production incidents.