Restored a deleted incident but its timeline is gone

Yes, and I would change two things straight away. 1. Restrict who can delete. Deleting an incident requires organization owner or admin. If people who only need to work incidents currently hold admin, move them to the member role. Members can still create incidents, change status, comment and link sources, which covers normal incident work completely. This alone removes most accidental deletions. 2. Use close instead of delete. Closing archives an incident and keeps everything: timeline, assignees, source links. Deletion should be reserved for records created entirely by mistake, such as a duplicate test incident. Make this an explicit team convention, because the two buttons look equally harmless. Also worth knowing for your risk assessment: permanent deletion is restricted further, only the organization owner can do it, and it cannot be undone at all. I have passed the restore behaviour to our development team as feedback, since restoring an incident without its context is surprising.