Thu Aug 27 2026 · research · RSS
Public postmortems are the best free education in operations writing. I reread a pile of them — GitLab's database-deletion write-up, GitHub's October 2018 day-long degradation, Cloudflare's regex-catastrophe note, Fastly's 2021 config change, assorted AWS us-east-1 sagas, Discord's July 2021 CBP study, both KrebsOnSecurity-relevant CDN events — looking for what recurs when serious teams explain themselves.
Every strong report converges on the same spine: detect (how alarms fired) → impact quantified (percentages, durations, customers affected — never "some users") → timeline table → cause chain → remediation. Deviation from this shape correlates with defensiveness. If your org debates format every time, you're paying a tax each incident.
"What went well." Weak docs skip it or turn it into PR boilerplate ("team responded quickly"). Strong versions extract reusable assets: the runbook step that saved twenty minutes, the alert threshold that fired correctly, the comms channel discipline that kept execs informed without derailing mitigation. That inventory is future speed.
Serious publishers treat the timeline table as the center of gravity — normalized timestamps, sources per row. It's tedious to build from chat logs, alert systems, and deploy records… which is exactly why tools exist to assemble it mechanically (that's the problem space we work in). Steal the spine, borrow the tone rules, and stop hand-formatting tables under sleep deprivation.
Paste rough timeline notes, get the full blameless structure in about 90 seconds.