Write internal status updates during a live production incident

Help me write internal status updates for a production incident that's happening right now. What's broken (user impact): [e.g. "20% of logins failing in EU", "dashboards loading slowly"] Started at: [TIME AND TIME ZONE] What we know so far: [SYMPTOMS, SUSPECTED CAUSE, RECENT DEPLOYS OR CHANGES] What we're doing: [CURRENT ACTIONS, e.g. "rolling back", "scaling the database"] Severity level: [e.g. "SEV1", "SEV2"] Roles: [INCIDENT LEAD, COMMS OWNER, WHO IS INVESTIGATING WHAT] Write one update per internal audience: - Incident channel (engineers): current hypothesis and evidence, what has been ruled out, who is doing what, what help or access is needed, and changes that must be paused (deploys, migrations). - Leadership: impact in business terms (users, customers, revenue affected - use [CONFIRM] where I haven't given numbers), current status, decisions they may need to make, and next update time. No jargon. - Support team: what customers will notice, approved wording to use, known workarounds, and what not to promise (causes, ETAs, credits). Rules for all updates: - Lead with impact and current status, in the first line. - Separate what we know from what we suspect. Never state a root cause that isn't confirmed. - Never give a fix ETA we can't stand behind; give the time of the next update instead. - Use UTC or one stated time zone throughout. - End each update with "Next update by [TIME]". Also give me: 1. A fill-in template I can reuse every 30 minutes as the incident evolves. 2. A "mitigated, monitoring" update and a "resolved" update for each audience, including what follow-up (postmortem, customer comms) happens next. 3. A short timeline log format to keep during the incident so the postmortem is easy to write later.