> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aciona.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Timeline

> The complete record of what happened in an incident, from alert to close.

Every incident has its own timeline. It is what turns "someone fixed it overnight" into an auditable record of who did what and when.

## Recorded events

| Event                    | When it happens                                                                 |
| ------------------------ | ------------------------------------------------------------------------------- |
| **Alert received**       | An alert arrived through a source and was accepted.                             |
| **Incident created**     | The alert opened a new incident.                                                |
| **Alert aggregated**     | A new alert was attached to an already-open incident instead of duplicating it. |
| **Notified**             | Notifications were dispatched to the responders.                                |
| **Acknowledged**         | Someone acknowledged.                                                           |
| **Assigned**             | The incident got an owner.                                                      |
| **Reassigned**           | The owner changed.                                                              |
| **Escalated**            | The incident moved to the next target.                                          |
| **Escalation timeout**   | The response window expired and triggered escalation.                           |
| **Escalation exhausted** | There was no next target; the owners were notified.                             |
| **Fallback incident**    | No responder could be resolved; the owners were notified.                       |
| **Resolved**             | Manually, or automatically by the originating tool.                             |
| **Closed**               | Cycle finished.                                                                 |

## How to read the timeline

* **Names, not identifiers.** The timeline is written for humans: it records the name of the person involved.
* **Action source.** Actions performed by people can record where they came from — web dashboard, email, Slack or Microsoft Teams.
* **System actions have no author.** Automatic escalation and auto-resolution show up as system actions.

## What it is for day to day

<Columns cols={2}>
  <Card title="Shift handover" icon="repeat">
    Whoever takes over on-call reads the timeline and understands the state without asking.
  </Card>

  <Card title="Post-mortem" icon="file-search">
    Time to first acknowledgement and time to resolution come straight out of the record.
  </Card>

  <Card title="Configuration diagnosis" icon="wrench">
    Frequent escalations or recurring fallbacks point at a short schedule or a service with no team.
  </Card>

  <Card title="Audit" icon="scale">
    Who acknowledged, who took it, who resolved it — with date and time.
  </Card>
</Columns>

<Note>
  Older incidents may show timeline messages using legacy wording. Operational history is never rewritten — that is expected, not a bug.
</Note>