The first two days after a bad store push

Hour one is not for traces. Write the timeline: push time, rollout percentage, first ticket, first named cluster. If you skip this, every old crash looks new.

Hour four is the first cluster cut: this version versus the previous one. If the spike is an aged library, say so out loud so operations does not roll back for nostalgia.

Day two morning is the rollback question, asked with the freeze column in view. A native crash in a new decoder is a different decision from an ANR on a font download that a staged rollout can still pause.

Then stop. Exhausted readers invent causes. If you need App Garden Base, the incident study is built for these two days; the five-day review is for the week after, when you want a cut list instead of a fire story.