The worst hour of an incident is not the outage. It is the following afternoon, when somebody has to reconstruct what happened from a scrolled-back chat log, four dashboard screenshots, and the fading memory of a person who was awake at four in the morning.
This reconstruction is expensive, it is done badly under time pressure, and it is done last — which means it is the first thing dropped when the week gets busy. Organisations then conclude they have a culture problem about writing post-mortems. Usually they have a tooling problem about retyping facts the system already holds.
The system was there the whole time
By the time an incident closes, the console already knows the sequence of events with better precision than any participant. It knows when the objective started burning and at what rate. It knows which services degraded and in what order. It knows which deploys landed in the preceding window and what changed in them. It knows who acknowledged, when, and what they did.
- Timeline — first burn, severity transitions, acknowledgement, mitigation, recovery, close.
- Suspect services — ranked by when they degraded relative to the objective, not alphabetically.
- Correlated deploys — every release to an implicated service in the preceding two hours.
- The last three commits to each suspect service, with authors.
- Budget accounting — consumed, remaining, and days to window close.
That is most of a post-mortem. It is not the whole of one, and this is the distinction that matters to us.
What a machine should not write
A draft is not an analysis. The document Meridian attaches to a closed incident contains what happened, in order, with evidence. It does not contain why it happened, what the team should do differently, or whether the mitigation was wise. Those sections are present and empty, with the cursor in them.
The draft was waiting in Linear when I got up. It had the timeline right and left the thinking to me. That is the correct division of labour.
L. CHEN · SRE LEAD · BASIN
We were tempted, more than once, to generate the causal narrative as well. We can produce something that reads plausibly. The problem is that a fluent wrong explanation is considerably more dangerous than a blank field, because it anchors every reviewer who reads it afterwards. A post-mortem is an argument, and the argument has to be made by someone accountable for it.
The measurable effect
Across the teams in our ninety-day study, the share of incidents with a completed written review rose from 34% to 91%. Median time from incident close to review completion fell from nine days to under two. We think almost none of that is enthusiasm. It is the difference between starting at a blank page and starting at a page that is already correct about the facts.