Use a five-part closure note
- Impact: what was unavailable or incorrect and who was affected.
- Action: the changes or checks performed.
- Validation: how service was confirmed, and by whom or through what operational check.
- Current status: what works now and what has not been verified.
- Follow-up: remaining risk, owner, and next action.
Keep facts separate from hypotheses
Label a suspected cause as a hypothesis until evidence confirms it. Preserve the difference between a procedure that was researched, a repair that was attempted, and a repair that was verified.
This distinction makes future searches more reliable and prevents an old guess from turning into a repeated runbook step.