After the fire

Monday, 10 a.m., the big room again, pastries again, and the morning’s incident on the screen in past tense. Priya runs the meeting under one rule, stated out loud at the start the way it always is: we are here to blame systems, not people.

The hunt is for the root causeConcept · lights on your maproot causeThe deepest cause that, corrected, prevents the whole class of failure. Not the typo: the reason the typo survived. Fixing symptoms buys days; fixing root causes retires the failure mode., and the discipline of digging past symptoms to reach it is root-cause analysisConcept · lights on your maproot-cause analysisThe structured hunt past symptoms to the deepest correctable cause, classically by asking why repeatedly, each answer fixable, the deepest fix retiring the whole class.: ask why, then ask why of the answer, and keep going. The map slowed. Why: tracking saturated. Why: refresh storms during a GPS gap. Why: the refresh interval was fixed instead of adaptive, so the system invited the storm it then had to shed. Four whys down sits something fixable that is not anybody’s finger to point: an interval chosen years ago, reasonable then, wrong for a bridge. Blame would have found a person by the second why and stopped, which is precisely why blame is banned. Blame ends the digging early, and hides next year’s failure behind this year’s embarrassment.

The document that outlives the morning

The meeting’s product is the postmortemConcept · lights on your mappostmortemThe incident’s formal written account: timeline, impact, root cause, and the real payload, action items that make recurrence harder. Blameless by convention: analysis names system gaps, never guilty individuals.: the timeline to the minute, the impact honestly counted, one root cause, and the payload, four action items with owners. Adaptive refresh, a saturation alert two notches earlier, the cheer timestamp fix, and a runbook page titled Bridges. It goes in the repository next to the ADRs, one more page of the written culture, and next year’s race morning will be quietly better because this one was honestly described. The postmortem’s epigraph echoes, word for word, what Molly asked her laptop at 11:04 from a couch: the question the whole wall exists to answer.

The freeze lifts at noon. Merges flow, the roadmap unfreezes, somebody deploys a feature by 2 p.m. because they can. The system held, the race was true, the marathon is run.

And at 3:12 p.m., a support email lands with Dana, who walks it to Finn’s desk without a word. It is from Case. Polite, baffled: the official results show no 25K split. Every other mat, present. That one, nothing. Finn pulls the trace for 11208 again, the same trace that read clean end to end on Sunday afternoon, and looks at the stretch nobody had reason to check: between 20K and the bridge there is, for the first time in this story, a hole. Act IV is the week the hole gets a name.