Find the root cause of an outage in 40,000 lines of logs

A 95 minute window of logs from five services covers a customer facing outage. One configuration change shrank a connection pool from 40 to 4, which exhausted the pool in the inventory service and cascaded into timeouts in checkout and 503s at the gateway. The log also contains three plausible distractions: a certificate expiry warning that fires throughout, a burst of scanner 404s twenty minutes before the incident, and an operator restarting an unrelated service in the middle of it. The deliverable is a findings file in a specified schema, so the answer is checked field by field rather than by eye.