The post-mortem wrote itself in the notification log

The outage lasted 23 minutes. After the dust settles, you write the post-mortem. Step one is reconstructing the timeline.

You don't search Slack. You curl: GET /api/v1/notifications/{display}?since=1714823400000. The notification server returns every alert that fired during the window: the disk-fill warning at 14:31, the latency spike at 14:33, the database-down critical at 14:35, the failover-completed normal at 14:42. Each entry has a timestamp, a category, the original summary and body. JSON, paginated, ready to drop into the doc.

You used to ask everyone where they were when the alert fired and what they saw. Now the alerts themselves are the witness. The timeline is whatever the JSON says, in the order the notification server received it.

The retention isn't a paid feature. The history is just data the container kept.

Forensics used to start with a Slack search. Now it starts with a curl.