## Summary
- What happened: <1–2 sentences>
- Customer impact: <who/what/when>
- Status: <mitigated / monitoring / resolved>

## Timeline (UTC)
- <HH:MM> — Alert fired: <signal>
- <HH:MM> — Triage: <what we checked>
- <HH:MM> — Suspect identified: <component/change>
- <HH:MM> — Fix shipped: <PR/link>
- <HH:MM> — Verified: <metrics/logs/tests>

## Evidence
- Logs: <links/excerpts>
- Deploy diff: <commit range>
- Metrics: <before/after snapshots>
- Repro: <steps>

## Root Cause Hypothesis
<tight paragraph: mechanism, why it triggered now, contributing factors>

## Fix Plan (PR-ready)
1. <code change>
2. <tests/validation>
3. <rollout steps>
4. <rollback steps>

## Comms Draft
Internal: <what we tell the team>
External (if needed): <what we tell customers>

## Follow-ups
- <hardening>
- <alerting>
- <runbook>