Blog
The bridge stayed in Slack
At 02:26 a guest session is in #incident-bridge. The plan says leave Slack. Marcus stays because the thread scrolls. The scribe writes that comms moved out of band.
At 02:26 on 21 October 2026, Priya S (on-call, platform) reads an Okta system log on the bridge. A session for slack-guest/nlee was created at 02:04, from an ASN the office and the VPN do not use, and that session is a member of #incident-bridge. The plan's comms section says: if the collaboration suite or the identity provider may be in the blast radius, leave Slack. The bridge is a phone call to the numbers on the wallet card. Marcus T (incident commander) stays in #incident-bridge. The thread is easier to scroll, and he says they will not paste secrets. At 02:31 Sam O (communications) pastes a draft customer sentence into that thread so Dana K (legal) can edit it. Dana edits it there. Nobody calls the numbers. At 02:44 the scribe writes that communications moved out of band.
A weak record of those eighteen minutes reads:
Moved to out-of-band communications per the plan. Discussion continued on the bridge.
A strong one reads:
21 October 2026, 02:26 to 02:44. Incident-response tabletop. Seats: Marcus T (incident commander), Priya S (on-call, platform), Sam O (communications), Dana K (legal). Inject at 02:26: Okta log shows slack-guest/nlee, session created at 02:04 from an ASN the office and the VPN do not use, member of #incident-bridge. Plan: if the collaboration suite or the identity provider may be in the blast radius, leave Slack. The bridge is a phone call to the numbers on the wallet card. Marcus stays in #incident-bridge because the thread is easier to scroll, and says they will not paste secrets. At 02:31 Sam pastes a draft customer sentence into that thread. Dana edits it there. No call to the wallet-card numbers. Facilitator stops the sitting before anyone treats the move as done. Nothing was posted to customers. The guest session was not revoked in this sitting. Follow-up: Dana prints the phone tree on the bridge card, as numbers, by 4 November 2026.
Both notes say the bridge moved. Only the second shows that the draft sat in #incident-bridge after the guest session was named, and that nobody dialed. The first costs you the sentence. On the night this is real, the guest session can read what you were about to tell customers, and a reader in March thinks you had already left.
Scrolling is not a bridge
Marcus is trying to keep the thread in one place. A channel the plan just named as readable is not a place to keep it. The line about not pasting secrets is not the control the plan wrote. The plan wrote a phone call. Sam's paste at 02:31 is the decision, and it happened in the channel Priya had already read out loud.
Whether that customer sentence should exist, and the rule that it does not get sent, is the customer-notice post. This sitting stops at the channel. A file that only makes sense if you still have the Slack thread is a different miss, covered in the packet post. Write the channel on its own lines, before anyone edits the wording.
The numbers have to be on the card
A wallet card with no numbers is the same failure as staying in Slack: the only channel left is the one the plan told you to leave. The free plan self-check asks whether out-of-hours contacts and vendor escalation paths are in the plan, and it asks for phone numbers rather than aliases, because email is the first thing you lose and it may be the thing the attacker is reading. If the card Dana would dial at 02:26 has no numbers, run that check before the next sitting. If you are already in the room, run the inject anyway. The finding is that you stayed. Do not smooth it into a line that says communications moved out of band.
What the packet records
Write the stay in the free evidence template: the plan sentence, Priya's read of the guest session at 02:26, Marcus's decision to remain, Sam's paste at 02:31, that nobody dialed, and Dana's follow-up with a date. Hang the inject on the sitting you already booked. The ransomware family in the scenario library walks encryption and whether data left. Add this channel decision after the first containment call, and do not fold the Slack line into the isolate note. Put the file in the evidence index on the row for that exercise, with the date and the owner, so the next questionnaire finds the channel you actually used.
The record shows that these named people kept the bridge in #incident-bridge after the guest session was named, and that a draft customer sentence was pasted there. It does not show that the guest token was revoked, that a phone on the wallet card would have been answered, or that a customer was told anything.
Bottom line: write the channel you stayed in, and the paste. Moved out of band is the smoothed version. The packet has to show the thread the guest session could read.