Root cause analysis

A postmortem is a written argument that a class of failure is now less likely. It is not a timeline, not an apology, and not a record of who was on shift.

If it ends with "we will be more careful", nothing changed and the incident will recur, because care is not a control.

Blamelessness is a mechanism, not manners

The reason to write blamelessly is instrumental: people who expect blame withhold information, and incomplete information produces wrong conclusions. The engineer who ran the command knows more about what happened than anyone else. If naming them costs them, you lose that.

So the rule is: name systems, not people.

"The deploy tool accepted a production target without confirmation" , not "Priya deployed to prod by mistake"