the first postmortem becomes the template

Incident review is where a team's honesty is easiest to perform and hardest to prove. A good write-up is not the one that reads well. It is the one whose follow-up items are still recognisable a month later, each with an owner, with whatever was not done still visible rather than quietly dropped.

A deployment path failed hard when the credential used to fetch the artifacts a deploy needed turned out to be a class the store no longer accepted, so every fetch on that path failed. The immediate fix switched the pull path to a credential class that was accepted. The durable artifact was the record written afterwards, and rather than free-form narrative it fixed a shape: what broke, the sequence and the point of detection, what the impact was and who noticed, what each follow-up owed, and a field for the item deliberately not done.

That the shape was used again within the same stretch of work is the part that matters. A later incident — a rendered configuration that quietly dropped a correlation identifier, so an entire class of requests became untraceable — was written to the same form, with the re-application and the catalogue cleanup recorded alongside it. Two unrelated failures, one format, which is what turns a document into a practice.

The measure is not the quality of the prose. It is whether the next record exists at all, and whether the open items from the previous one are still tracked.

What it proves: the review habit was built alongside the systems, and the record became a durable artifact instead of a conversation that ends when the incident does.