Record while it happens
Reconstructing a timeline afterwards from chat history and memory costs hours and loses the order of events. Keep a running note with a timestamp on every line: what you saw, what you checked, what you changed.
A structure that works
Keep each part short; link to the details rather than pasting them.
- Summary: one paragraph on what users saw, for how long, and whether it is resolved.
- Timeline: detection, first response, key findings, the fix, the confirmation.
- Cause: what failed and why it was possible, in plain language.
- Actions: a short list, each with an owner and a date.
Write for someone who was not there
Spell out what each system does the first time you name it. Prefer what users experienced over internal identifiers. Leave out blame: the question is what made the mistake possible, not who made it.