Day-0 incident page

This is the page I want written the night a hard customer issue lands. Half a page, before another backup or a bug hunt. Fill it as of the first escalation, using only what you actually know at that moment.

The page

What we can see

What's broken, for whom, and on which version. Only what's in the escalation and what support already tried. No guesses yet.

Two hypotheses

Two different ways this could be true. If you only have one, you haven't looked yet.

One check that settles it

The single thing we can run that tells hypothesis A from hypothesis B. Write what yes looks like and what no looks like before anyone runs it.

Owner

One name. Not "the team," not "dev."

Next action, with a time

What happens next and by when. A clock time, not "tomorrow."

What we won't claim tonight

Root cause, if we don't have it. Recovered data, if it isn't recovered.

Example (made up, so you can see the format)

What we can see: after Tuesday's desktop release, two customers say one report shows the wrong totals. Support reproduced it on one customer's data. Older releases look fine.

Hypothesis A: the release changed how the report adds things up.

Hypothesis B: some data saved before the release is bad, and the report is doing its job.

Check: run the report on a clean test database on the new release, with records where we already know the right total. Right total means it's the old data (B). Wrong total means it's the release (A).

Owner: the QA engineer on escalation that night, by name.

Next action: run the check and post the result in the escalation thread by 10 a.m.

Won't claim tonight: why the data went bad, if it's B.

Back to How I work. A real one, written after the fact, is on Selected work.