What happened?
List key events with event_id and timestamps.
Technical + governance + incentive factors.
How was it detected? What failed to detect it earlier?
What actions were taken?
What was restored and what was lost?
What assumptions were wrong?
Policy updates, code patches, governance changes.
Did the system cause harm beyond itself?