# Postmortem — Template

Use for incident write-ups. The structure follows the standard blameless
format: what happened, what was supposed to happen, why it didn't, what we
change.

## Sections

- Summary (two or three sentences: who was affected, for how long, by what)
- Impact (the numbers: users, requests, dollars, internal teams)
- Timeline (UTC timestamps, one row per significant event)
- Root cause (the chain of decisions and conditions that produced the
  incident; not a single "the bug")
- Detection (how we found out, and how long after it started)
- Response (what we did, what worked, what didn't)
- Recovery (what we did to get back to a steady state)
- Lessons (the things we want to remember)
- Action items (table with owner, due date, status)
- Related (links to the incident ticket, runbook, and follow-up docs)

## Anti-patterns

- Don't assign blame. The postmortem is about the system, not the person.
- Don't hide the timeline. The reader's first question is "how long"; the
  timeline is the answer.
- Don't list action items without owners. An action item without an owner
  is a wish.

## Storage template

```xml
<h1>{Incident title — short, dated}</h1>
<table>
  <tbody>
    <tr>
      <th>Date</th>
      <td>{YYYY-MM-DD}</td>
    </tr>
    <tr>
      <th>Severity</th>
      <td>{SEV-1 / SEV-2 / SEV-3}</td>
    </tr>
    <tr>
      <th>Duration</th>
      <td>{start} → {end} (UTC)</td>
    </tr>
    <tr>
      <th>Incident commander</th>
      <td>{name}</td>
    </tr>
  </tbody>
</table>

<h2>Summary</h2>
<p>{two or three sentences}</p>

<h2>Impact</h2>
<ul>
  <li>{users affected}</li>
  <li>{requests failed / throttled}</li>
  <li>{internal teams paged}</li>
</ul>

<h2>Timeline (UTC)</h2>
<table>
  <tbody>
    <tr>
      <th>Time</th>
      <th>Event</th>
    </tr>
    <tr>
      <td>{HH:MM}</td>
      <td>{event}</td>
    </tr>
  </tbody>
</table>

<h2>Root cause</h2>
<p>{chain of decisions and conditions}</p>

<h2>Detection</h2>
<p>{how we found out, and how long after the incident started}</p>

<h2>Response</h2>
<p>{what we did}</p>

<h2>Recovery</h2>
<p>{how we got back to steady state}</p>

<h2>Lessons</h2>
<ul>
  <li>{lesson}</li>
</ul>

<h2>Action items</h2>
<table>
  <tbody>
    <tr>
      <th>Action</th>
      <th>Owner</th>
      <th>Due</th>
      <th>Status</th>
    </tr>
    <tr>
      <td>{action}</td>
      <td>{owner}</td>
      <td>{YYYY-MM-DD}</td>
      <td>{OPEN / DONE}</td>
    </tr>
  </tbody>
</table>
```

## Cross-references

- Storage macros: `confluence-page/references/macros.md`
- BASS / AVP page hierarchy — see the owning team's incident process doc