Post-mortem review

A post-mortem is the review a SOC runs after the shift ends: not "were you right?", but "was your reasoning sound?". For every verdict below you get the evidence you actually looked at, the lookups you skipped, and the log lines that decided the answer.