# Incident Postmortem: [one-line title]
Occurred: YYYY-MM-DD HH:MM – HH:MM (total: N minutes / hours)

- What happened (from the user's perspective):
- Why it happened (root cause):
- How we found out: [alert / found ourselves / user report] ← if user report, fix the monitoring gap first
- How we recovered: [rollback / restart / config fix]
- Prevention (at least one of): [add alert / add checklist item / automate]
- One line to add to the development rules doc (lesson from Ch.14):