# Triage: <symptom>

## Symptom

<One sentence, observable terms. What, to whom, from when.>

## Timeline

| Time (UTC) | Event | Source |
|---|---|---|
| | First occurrence | |
| | Rate change | |
| | Coinciding change (deploy, flag, config) | |

**Shape:** <constant / growing / spiky / step change>

## Error groups

| Shape | Count | First seen | Last seen | Background? |
|---|---|---|---|---|
| | | | | |

## One traced request

<Correlation id. The sequence across services, ending at the first thing that actually
went wrong, not the last thing logged.>

## Hypotheses

### 1. <Claim> — <confidence>

- **For:** <evidence>
- **Against:** <evidence>
- **Does not explain:** <any fact it fails to cover>
- **Cheapest test:** <what to run, and what result would confirm or kill it>

### 2. <Claim> — <confidence>

### 3. <Claim> — <confidence>

## Next action

<The single cheapest discriminating test, and what you expect it to show.>

## Known unknowns

<What you could not see: missing logs, gaps in retention, services with no tracing.>