# YYYY-MM-DD Incident Title

## Summary

One paragraph. State what happened and whether live capital, journal truth,
public proof, or operator control was affected.

## Timeline

All times in UTC.

| Time | Event |
| --- | --- |
| 00:00 | Detection event. |
| 00:00 | Mitigation started. |
| 00:00 | Resolution verified. |

## Impact

- Severity:
- Affected components:
- Live capital affected:
- Operators affected:
- Public artifacts corrected:

## Detection

How the system or operator detected it.

## Root Cause

The actual mechanism, not the symptom.

## Resolution

What changed immediately.

## What Worked

Controls that prevented worse impact.

## What Failed

Controls that were missing, late, noisy, or wrong.

## Follow-Up Changes

| Owner | Change | Due |
| --- | --- | --- |
|  |  |  |

## Tests Added

List exact tests or monitors added.

## Journal / Replay Evidence

- Replay id:
- Stream:
- Sequence:
- Entry hash:
- Journal root hash:
- Anchor URL:
- If unavailable, why:

## Public Artifacts

Links to commits, dashboards, journal roots, signed proofs, or issue IDs.