Personal Notes After an Incident vs the Postmortem

2026-10-03 · Yesterself

The postmortem gets written over the next three days, by a group, with a template and a review meeting. That process works. It is also the reason the other record has to be written tonight, before anyone circulates a timeline — because the incident produced one thing the official process cannot capture: what you actually thought was happening while it was happening.

The postmortem is a team artifact with an audience

The blameless postmortem exists for a good reason. John Allspaw's writing on the practice at Etsy, drawing on Sidney Dekker's work on just culture, made the central move explicit: assume people's actions made sense to them given what they knew at the time, then find out what they knew. That reframing is what lets a team learn from a bad night.

But blameless is a norm the document tries to uphold, not a promise about who reads it. The postmortem has an audience — the rest of engineering, sometimes leadership, sometimes a customer — and it is written in the past tense of a group. "The team believed the cache was healthy." Nobody believed that. You believed something stranger, for nineteen minutes. That is not a flaw in the format: a document written for strangers should say only what strangers can check.

What the shared document structurally cannot hold

Not because your team is dishonest. Because of who reads it.

• Your model of the failure, minute by minute, including the wrong one you held for twenty minutes and dropped without telling anyone.
• The minute you froze. The doc will say there was a delay before the rollback. It will not say that a person sat with a cursor on a command and did not press enter, or why.
• Who you were afraid of. Sometimes a specific person joining the call. Sometimes just being the one whose name is on the change.
• The thing you almost did, and what you did not say on the call, and why.

Write it the same night

Not because tonight is a good time to write. Because of what the next three days do to your memory.

The postmortem process is, in memory terms, a stream of post-event information: a reconstructed timeline, four people describing the same hour, an agreed wording. Elizabeth Loftus and John Palmer showed in 1974 that such input is not inert. Witnesses asked how fast cars were going when they smashed into each other gave higher speed estimates, and were likelier to report broken glass that was never there, than those asked about cars that hit. One verb moved the recollection.

A week of drafting is more than one verb. By the time the document is published, you will remember the document. So: twenty minutes, tonight, before you read anyone else's version. Half sentences are fine.

The five lines worth having

1. Your clock, not the system's. Timestamps of your beliefs. "22:14 sure it was DNS. 22:31 stopped being sure, said nothing. 22:52 saw the queue depth and everything rearranged."
2. The freeze. Where, how long, what stopped you, and what would have unfrozen you: a second pair of eyes, permission you already had, a dry run.
3. Who was in your head. Name the fear, not the person's character. "I did not want to roll back before he was on the call" records your own hesitation.
4. The thing you almost did, and what you think would have happened.
5. One sentence you would not have said out loud that night.

A plain note, since bad incidents follow people home. In 2000 the physician Albert Wu described the clinician who makes or witnesses a serious error as a second victim, and the observation travels. Writing it down is a record, not a treatment. If it is still waking you weeks later, that is a conversation for a doctor or a therapist, not something a notebook resolves.

The rule: it can never contradict the official document

This is where the practice quietly goes wrong. A private file that says something the postmortem denies is not a journal. It is a shadow record — a place to be right in silence — and it corrodes both documents. Three rules keep them separate.

If you know a fact the document gets wrong, correct the document. A private note is not the place to park a correction you are afraid to make in public.

Keep the two in different registers. The doc holds what happened to the system; your note holds what happened to you. "The failover took fourteen minutes" is theirs. "I did not believe the failover would work and did not say so" is yours, and the two do not compete.

If your line is "I skipped step four," that belongs in the postmortem. It is a fact about the incident, and blameless culture is what makes it sayable. If it is not sayable where you work, you have learned something important — but holding it privately is worse for you, not better.

The test is one question, line by line: could this be true at the same time as the whole official document being true? If yes, you have an interior record. If no, you have an unsent objection, and that goes into the document or into a conversation, not into a file.

Where the note lives

Not the company wiki, the work account, the incident channel, or a repository. Anything in a shared system is eventually read by someone you did not picture. And a note about work is not privileged because you called it private; what an employer can access depends on your contract and where you live. None of this is legal advice. If the incident touched customer harm, money, safety, regulators, or another person's conduct, talk to a lawyer before deciding what to write down and where to keep it.

What you want is dull: your own device, encrypted, exportable, kept with the rest of your personal writing rather than in a special incident file you never reopen.

That is the part Yesterself is built for: a journaling app for iOS and Android, not released yet, with a waiting list. Each morning it brings back one letter from your own past writing, and a sentence can be postmarked to a date you choose. It is end-to-end encrypted with no account, no email, and no password, and export is free forever in open formats.

Mining it later without ever quoting it

Set two dates the night you write. Thirty days out, to read the entry beside the published postmortem. And one before your next rotation, when it is worth most and you are least likely to remember it exists.

At thirty days, three questions: which private line became an action item, which dissolved, and which is still true and still unsaid. Across four or five entries, patterns appear that no single night reveals.

• Your recurring first hypothesis. Everyone has one. If yours has been wrong four times out of five, that is a checkable habit rather than a personality trait.
• The freeze repeats, and it has a category. Usually irreversible actions, or ones needing someone's blessing. The fix is usually mechanical: an approval path, a pre-approved action list, a dry-run flag, access you should already have at 3 a.m.
• The name that keeps appearing. If the same person is in your head during every incident, that is a one-to-one topic, framed as what you need — "I want to know it is fine to roll back without waiting for you" — not as an accusation.
• The gap between what you believed and what the dashboards said. Each instance is an observability ticket with the title already written.

Then the conversion. Every finding leaves the note as something sayable: a runbook edit, a request in a one-to-one, a line in a self-review, a proposal for what the on-call may do alone. The entry itself is never quoted or shown. What leaves it is a request, not a confession. The lighter version during a rotation is the on-call journal; tonight's entry is its longer sibling.

The postmortem is the record the organization needs. The other one only you can write, and it has a shelf life of about a week before the shared version replaces it. Twenty minutes tonight, then sleep.

Common questions

My team already runs blameless postmortems. Why write anything privately?

Because the two documents answer different questions. The postmortem answers what happened to the system and what the organization will change. The private entry answers what you believed at each point, where you hesitated, and what you did not say, none of which the shared document was ever designed to hold.

What if my private note contradicts the official postmortem?

Then it is not a private note, it is an unsent correction, and storing it privately is the wrong move. If you know a fact the document gets wrong, put it into the document or raise it in the review. Keep for yourself only the things that can be true at the same time as the whole official record.

Where should the file live?

Somewhere that is yours rather than your employer's, on your own device and in your own writing tool, and not in a work account, a shared drive, the incident channel, or a repository. This is a practical point about audience creep and not a statement about your legal position.

When should I read it again?

Set two dates the night you write it. Thirty days out, to read it beside the published postmortem, and again before your next rotation or the next incident of the same class, which is when the note is worth the most and when you are least likely to remember it exists.

Is it unfair to write down that I was afraid of a specific person?

Write the fear rather than a verdict. There is a real difference between recording that you delayed a rollback because you did not want to be questioned by someone, which is a fact about you, and writing a case against a colleague, which is something else and tends to harden with rereading.