# Postmortem: <short description>

**Date:** <incident date> | **Severity:** <sev> | **Duration:** <impact start to end>
**Author:** <name> | **Status:** draft | reviewed | actions tracked

## Summary

<Three or four sentences. What broke, who it affected, how long, how it was resolved.
Someone should be able to read only this and understand the incident.>

## Impact

- **Users affected:** <number or percentage, and of what>
- **Duration of impact:** <start to end, UTC>
- **What they experienced:** <the actual user-visible symptom>
- **Business impact:** <orders, revenue, SLA, whatever applies>
- **Not measured:** <what you could not quantify, and why>

## Timeline

All times UTC.

| Time | Event | Evidence |
|---|---|---|
| | Fault introduced | <commit, deploy, config change> |
| | Impact began | <first affected request> |
| | Detected | <alert, or customer report> |
| | Mitigation attempted | <what, and the result> |
| | Impact ended | |
| | Confirmed resolved | |

**Time to detect:** <duration> | **Time to mitigate:** <duration>

## What happened

<The narrative, in plain language. What the system was doing, what went wrong, why it
had the effect it had. Written so a new engineer could follow it.>

## Contributing factors

### Technical
### Detection
### Response
### Systemic

## What went well

<Genuinely. What worked, so it is preserved and not refactored away.>

## Actions

| Action | Owner | Due | Done means |
|---|---|---|---|
| | | | |

## Open questions

<What is still not understood. Do not paper over this.>