The tabletop exercise from lesson 3.15.3 ended with "mitigated". For the users, the incident is over at that point, for the team not yet. Whether the same incident comes back in three months is decided afterward: in the postmortem. Lesson 3.4.6 introduced it, one page following a template, without blame. This lesson turns it into a craft: how to get from the timeline to the causes, why "human error" is never the answer, how actions actually get done and how what was learned reaches those who weren't there.
When there is a postmortem
Not every small thing needs one. The Kladde writes a postmortem when one of these applies:
- an incident of SEV 1 or SEV 2 (3.15.3),
- an incident that used up more than a fifth of the error budget of an SLO (3.15.2), even if nobody reported it,
- an alert that woke someone at night when there was nothing to do: Then the alert is the incident,
- an exercise, that is, the tabletop exercise from 3.15.3 and later the experiment from 3.15.6,
- a near miss, where only luck prevented the damage.
The last line is the one that is missing most often. A near miss is the cheapest opportunity to learn: Nothing happened, nobody is defending themselves, and the cause is the same as in the next real outage.