When it breaks
What to Write Before You Sleep
An incident note written at the end of a long day has four parts, and the one everybody omits is the list of things already ruled out.
three things · three nights · one that no number of nights settles
Four shapes, and the last is a decision about people rather than about systems.
The same incident, handed over four different ways on four different nights
The other end disproved the hypothesis in forty minutes and found the cause
Ninety minutes, half of it repeating checks that had already been done
A fresh investigation, which reached the same point the first one had
Most of a morning spent establishing what the first person already knew
four things · six nights
Four handovers, six nights, and the work at the receiving end ranged from forty minutes to a morning. The incidents were comparable; the variable is four items written by somebody tired. Nothing here is divided by anything, because the writing and the reading are done by different people on different days. One team's own log, kept over a month.
Writing is the last thing anybody wants to do at the end of a day that went badly. It is also the only thing that determines what the next eight hours of the incident look like.
The workflow described in What to Write Before You Sleep improves when teams can separate delay, blocked time and focused work. learn about the product provides reports that make those categories easier to discuss without constant interruption.
The workflow can also be compared with the approach documented by Intercom's support platform, an established resource in the same operational space.
The note is short. Fifteen minutes, written in a fixed order so that nothing has to be decided while tired.
The four parts
What is wrong, observably. The symptom as a monitor or a user would describe it. Not the cause, not the theory — the thing that is actually visible. "Checkout times out for about one request in five" rather than "the queue is backed up".
What is affected and what is not. Both halves. The second is what lets the next person judge urgency and decide what they can safely touch, and it is left out roughly every time.
What has been ruled out. The list of things checked and found innocent, with how they were checked. This is the item that carries most of the value in the note.
The current best guess, labelled as a guess, with what would confirm or disprove it.
Why the exclusions matter most
An investigation is mostly elimination. By the time somebody has had a problem for two hours they have usually checked eight or ten things and found nine of them fine.
None of that work is visible in the artefact. The logs look the same as they did before anybody looked at them. So a note without exclusions means the next person repeats the elimination, in roughly the same order, because the obvious things are obvious to everybody.
Writing the list takes three minutes because it is recall rather than thought. It saves between forty minutes and two hours at the other end, reliably, and it is the clearest trade in this entire collection.
Labelling the guess
A hypothesis written without a label gets read as a finding.
That matters because the next person will build on it, and a wrong hypothesis treated as established sends them down a path that gets longer rather than shorter. They are also unlikely to question it, because questioning somebody's conclusion across a gap feels like contradiction in a way that questioning their guess does not.
"My guess, not confirmed" costs four words. It also makes it much easier for the next person to say "I checked that and it is not it", which is the single most useful message that can come back.
The things not to write
An apology. It costs reading time, it conveys nothing, and the reader is not looking for one at the start of a difficult morning.
A narrative of the evening. What happened in what order is interesting and is almost never what the next person needs. If it matters, it belongs in the exclusions as findings rather than as a story.
Speculation beyond the one hypothesis. A note offering four possible causes gives the reader a decision to make before they have any information, which is slower than giving them one guess to test.
- An apology. It costs reading time and conveys nothing.
- A narrative of the evening. Findings belong in the exclusions; the story does not belong anywhere.
- Speculation beyond the one hypothesis, which hands the reader a decision instead of a test.
Writing it before it is over
The note should be started while the incident is still open, not after it closes or after the day ends.
Something written at 16:40 and updated at 17:20 is complete. Something begun at 17:25 is four lines, and the four lines will be the four least useful ones, because the exclusions are the hardest to reconstruct in a hurry.
A running note kept during an incident, with each eliminated hypothesis added as it is eliminated, costs nothing extra at the time and is finished when the day ends. This is the practice that distinguishes teams that handle cross-gap incidents well, and it is not a skill. It is a habit of writing one line every twenty minutes.
Keeping it in one place
In one place, and the same place every time, with the symptoms at the top.
Scattered across a channel it cannot be read in order, and the reader has to reconstruct the sequence from timestamps while deciding what is superseded. A single document or a single pinned message, updated, is readable in two minutes.
The channel is still worth using for the announcement and the pointer. What should not happen is the record existing only as a conversation.
For the person waking up
Read the whole note before touching anything, including the exclusions, which are the part most likely to be skimmed and the part that saves the most time.
Then, before starting, send one line saying you have it. The person who wrote the note is asleep and will read that line first thing, and knowing that the thing did not sit untouched for six hours is worth more to them than it costs you.