State what happened.
Never fill in the gaps.

# Incident postmortem (draft)

## Summary
The service was unavailable one evening. Exact start and end times need verification.

## Timeline
- To verify: the exact start time (source says “around eight last night”)
- To verify: detection and escalation time
- [Recorded] Recovery method: service recovered after a restart
- To verify: exact recovery time and total duration

## Impact
- Affected functionality: pages would not open (source: user reports; exact endpoints to verify)
- Affected users: source says “maybe a few thousand”, not counted — to verify
- Financial loss: source says “probably not small”; no amount or method given — to verify

## Root cause
- Hypothesis (unverified): the source suggests “probably a database issue”; no logs or metrics support it yet
- To verify: database monitoring, slow queries, and error logs before concluding

## Follow-up actions
- Add monitoring and alerting: owner [to be assigned], due date open
- To verify: whether the restart was a temporary mitigation or the actual fix

## Items to verify
- Exact start and end time and total duration
- Affected user count and how it was counted
- Whether any financial loss applies and how it would be calculated
- Database metrics and logs during the incident