# Incident postmortem: <short title>

> Blameless. We focus on systems, not individuals.

- **Severity:** S0 / S1 / S2 / S3
- **Service(s) affected:**
- **Detected:** YYYY-MM-DD HH:MM UTC (via alert / customer / synthetic / log)
- **Mitigated:** YYYY-MM-DD HH:MM UTC
- **Resolved:** YYYY-MM-DD HH:MM UTC
- **Customer impact:** users affected, GMV affected, support tickets filed
- **Author:** <name>
- **Reviewers:** <names>

## Summary

One paragraph: what happened, who was affected, how it ended.

## Timeline (UTC)

| Time | Event |
|---|---|
| HH:MM | First alert |
| HH:MM | On-call engaged |
| HH:MM | Hypothesis A ruled out |
| HH:MM | Mitigation applied |
| HH:MM | Confirmed mitigated |
| HH:MM | Resolved |

## Root cause

The technical or process condition that allowed the incident, in plain language.

## Contributing factors

Things that didn't *cause* the incident but made it worse or harder to detect.

## What went well

We're allowed to celebrate the things that worked.

## What didn't go well

The things to fix.

## Action items

| # | Description | Owner | Due | Type (Prevent / Detect / Mitigate / Process) |
|---|---|---|---|---|
| 1 | | | | |
| 2 | | | | |

## Customer communication

Status page entries, emails sent, partner outreach. Timestamps.

## Lessons

Two or three sentences future-us will thank past-us for.