The pick lists print at 4:31am on a Thursday, and they are wrong.
Nobody knows this yet. The printer in the Perth warehouse hums through ninety-two pages in the winter dark, and Noor, the night-shift floor lead who has run the early pack for a year and a half, clips them to the trolleys the way she always does. Outside, the first real front of the season is still blowing through. It’s the same front that started all of this, two nights earlier, when it flattened the silverbeet at the Hendersons’ place in the hills and drowned half their cauliflower.
The Hendersons had phoned Sam on Wednesday morning, apologetic the way farmers are about weather, as if it were theirs to answer for. Nine hundred and twelve boxes had silverbeet or cauliflower in them. Sam entered the shortfall, the substitution engine re-ran, and the dashboard stayed green: every check clean, every allergen flag respected, kale and leeks and broccoli slotted in where the storm had taken things out. The re-run took four minutes. It used to take forty. Kai had shipped the fast path for late re-runs on Tuesday afternoon, the sprint’s performance story, because the last late shortfall had left the warehouse waiting most of an hour for new allocations. Tom approved the PR at 4:09pm between meetings. The review comment, in its entirety: “LGTM.”
The 1,800 unaffected boxes were packed on Wednesday as usual. The 912 re-run boxes were held back for a pre-dawn pack on Thursday, Noor’s crew booked in early, vans due out at seven. A tight window, but a known one. They’d done it before.
What nobody knew was that the fast path kept its allocations in a cache, and the pick-list generator read through the same cache. The re-run had written the new allocations to the database, which is where every monitoring check looks, which is why every monitoring check was green. The cache still held Tuesday. So at 4:31am the printer produced ninety-two confident pages asking the crew to pack silverbeet that was lying in a paddock in the hills.
The empty bins
At 5:02am the picking starts. At 5:07am a picker named Ash calls across the floor that the silverbeet bin is empty. So is the cauliflower bin. The kale and the leeks and the broccoli that arrived on Wednesday evening are stacked in crates by the door, and they are on nobody’s list.
The crew does what packing crews have always done when an item is missing: they fill from what’s there. It’s how it worked at the markets. It’s how it worked when Greenbox was two hundred boxes and Maya checked every allergen by memory. Seventy-three boxes get hand-filled before Noor’s unease wins. The lists have never been this wrong before, one item, maybe two, never two items across every page. She tries refreshing the warehouse portal. Same lists. At 5:24am she phones Sam.
Sam sits up in bed, opens the dashboard on her phone, and looks at a wall of green. Every check passing. The reconciliation clean. The allergen sweep clean. And a packing floor, eight kilometres away, at a dead stop.
She calls Kai, who is on call for Perth this week, at 5:31am.
Kai follows the runbook for substitution engine failures, because that’s what the runbook is for. It doesn’t help. The runbook describes the old re-run, the forty-minute one; it tells him to check a job that no longer exists and warns him not to panic before the hour mark. He puts it aside and starts comparing things by hand. At 5:46am, Tom appears in #incidents, unpaged and unasked. “Saw the channel. What do you need?” It isn’t his week. Nobody points this out, which is its own small data point, and not a good one.
At 5:58am Kai finds it. He posts two screenshots side by side: the database row for a box in Floreat, which says kale, and the printed pick list for the same box, which says silverbeet. “It’s the cache. The re-run writes to the database. The pick lists read through the cache. The checks read the database, that’s why everything’s green. This is my change.” Three dots appear and disappear under his message a few times. Then just: “Fixing.”
Priya, holding the incident commander rotation this month, declares a P2 at 6:04am and starts assigning. Kai on the fix. Ravi verifying the database allocations are actually correct before anyone trusts a regenerated list. Sam on the floor and on subscriber comms. “Tom, you’re not on call. If you’re staying, you’re on delivery windows: tell me at 6:30 how many boxes miss their slots per half hour we’re stalled.”
The channel fills with the particular quiet competence the team built a year ago and hasn’t needed at this scale since. Anika comes online from Melbourne, two hours ahead and well into her morning, sees the shape of Perth’s, and takes the support inbox without being asked: “Your hands are full. Anything from a Perth subscriber routes to me until midday.” Out in the yard, the drivers wait with their engines off. Liam, who has run the Subiaco round long enough to know every shortcut between Roberts Road and the highway, leans into the doorway and asks Noor the only question a driver needs answered: “How late, and which suburbs first?” Priya relays it into the channel, because the commander’s job is mostly carrying questions to the people who can answer them.
Sam’s first instruction to Noor is the one that matters most. “Stop filling by hand. Anything already hand-filled, hold it. Don’t load it.” Then she drives in, dressing gown swapped for a coat, and works through the seventy-three held boxes with Noor, checking each one against a printed allergen list. At 6:40am she stops at box fifty-one. Mrs Patterson’s. Someone had topped it up with potatoes where the cauliflower should have been.
“Potatoes are a nightshade,” Sam says quietly. “It’s on her flag. She’s been with us since the first box, and this would have been the second time.”
The picker who filled it, when Noor asks later, says what anyone would say: the bin was empty, the van was due, potatoes keep. Nobody had ever told the floor that the allergen flags live only in the system, that the system’s protection ends at the moment the paper takes over.
Kai’s fix is unglamorous: bypass the cache, regenerate, diff every regenerated list against the database before printing. The new lists print at 6:18am. Ravi confirms the allocations line up with the reconciliation output. Packing restarts at 6:25am with everyone who can hold a crate, including, by 7:00am, Maya, who arrives with coffee for the night crew and stays to pack leeks. The vans roll at 8:05am, sixty-five minutes late. Three hundred and forty boxes miss their morning windows. Jas and Sam have a notice out to every affected subscriber by 7:15am, plain words, no excuses: your box is coming, it will be late, here’s why.
No wrong box is delivered. No allergen reaches anyone. By 9:30am it’s over, and by 9:31am it has started to curdle into something else.
What it cost
The numbers, when Tom posts them to the channel that afternoon, are the kind you can put in a spreadsheet. Sixty-five minutes of delay. Three hundred and forty late boxes. Seventy-three boxes unpacked and repacked by hand. Eleven subscribers who reply to the notice asking whether they can rely on their delivery day going forward. One subscriber, in Wembley, who pauses.
The numbers that don’t fit in a spreadsheet are the ones everyone is actually carrying. Noor’s crew worked a double. Sam checked seventy-three boxes against an allergen list in a cold warehouse and found one that could have put a loyal subscriber in danger. And it is days since the whole company stood in a standup and heard that Freshly now belongs to a supermarket group. Everyone is privately doing the same arithmetic: this is exactly the kind of morning Hartland would love to read about.
Maya spends the day being calm at people and goes home with her jaw aching from it. That evening she messages Charlotte: “Board update to Angela on Monday. I need to be able to say what happened and what we’ve done about it. Can we talk tomorrow?”
Friday morning, blame-shaped
The conversation that happens in the Perth office on Friday morning is not a meeting. It’s a current, moving through the kitchen and the standup and the channel, and it has a shape. The shape is a finger.
Tom gets there first, in the way of someone who is angry partly at himself. “The cache change went out Tuesday with no load test and no rollout flag, and the first time it ran against a real delivery morning was on a real delivery morning. That’s how this happened. That’s the whole story.”
Maya, who has Angela in her calendar and Hartland in her peripheral vision, wants a name for a different reason. “When something costs us a morning and a subscriber, I have to be able to say we’ve dealt with it. Dealt with it has to mean something.”
Sam arrives already defensive on behalf of people who aren’t in the room. “If anyone in this conversation is about to say the words ‘the warehouse shouldn’t have improvised’, I’d like them to first spend a five o’clock shift staring at an empty bin with the vans on the clock. The crew did what the crew has done since the markets. It worked for three years.”
And Kai says almost nothing at all, which for Kai is loud. What he’s doing, although nobody knows it yet, is writing. He has a document open titled “Thursday’s incident: my mistakes”, and it is honest and thorough and reads exactly like the ones he used to write at the fintech, where every incident report had a name in the first line and everyone understood that the report was the punishment. He spent five years in that place, and the reflex is intact.
Charlotte watches all of it the way she watches everything. Mid-morning she texts Lee, who is down in Margaret River: “Thursday went wrong. They’re pointing fingers.” His reply takes four minutes. “Of course they are. Pointing means they care. Your job is to get the fingers aimed at the system before the weekend sets the story.” She puts her phone away, books the meeting room for 2pm, and titles the invite “Thursday: timeline first”. Then she goes and finds the people one at a time, because she’s learned that the arguing happens before the meeting or it happens instead of it.
The comfortable story
The pull towards the finger is strong, and every team reaches this moment eventually; most of them don’t notice they’re in it.
Blame is a story with one character, and stories with one character are cheap. “Kai’s change broke the pick lists” requires no further investigation, no uncomfortable questions about review load or monitoring coverage or a hand-fill practice that’s been quietly dangerous for two years. It has a beginning, a villain, and an ending: be more careful. Everyone else in the company gets to file the incident under someone else’s mistake and go back to work feeling, if anything, slightly more competent by comparison.
It also feels like rigour. Naming a person sounds like accountability; tracing a system sounds like excuse-making. It’s exactly backwards. The one-character story changes nothing about the machine that produced the morning, which means the machine will produce another one, with a different name in the lead role. And the people watching learn the real lesson long before the next incident: the meeting after a failure is a courtroom, so the smart move is to make sure the failure is never quite yours. Information starts arriving late, sanded smooth, or not at all. A team can lose its honesty this way in a single afternoon and spend a year not understanding why the incidents keep surprising them.
Nobody at Greenbox would have put it that way on Friday morning. They were just angry, and tired, and being circled by a supermarket group. Which is precisely when the cheap story does its best business.
The case for an hour and a whiteboard
Tom is the hardest sell, so Charlotte starts with him.
“I know what you’re going to do,” he says. “We did it after the allergen incident. The whiteboard, the timeline, the three actions. I was there. It was good. But we know what happened this time. Kai’s change cached the allocations and the pick lists read stale. He’s already said so himself, in the channel, with screenshots. I don’t need ninety minutes to find out a thing I learned at six in the morning.”
“What’s your fix?”
“Load tests on anything that touches the delivery path. And honestly? Review standards. That PR deserved more than a glance.”
“Whose glance was it?”
Tom is quiet for exactly long enough. “Mine.”
“So the story is: Kai was careless, and you were careless. Two careless people, on a team this careful. Does that strike you as an explanation, or as a coincidence that should worry you?”
“You’re saying it’ll happen again with different names on it.”
“I’m saying if the answer is people should be more careful, you’ve already got the most careful people you’re ever going to have. We can do the meeting your way and produce a memo. Or we can spend the ninety minutes finding the thing that made two careful people look careless on the same day.”
Maya takes less convincing but needs a different thing. “Angela doesn’t want a workshop summary, Charlotte. After the Freshly news she wants to know we’re not amateurs.”
“Then give her what a professional outfit produces. A timeline to the minute. The structural cause. Three changes, each with a name and a date, and a follow-up where we check they happened. That’s the most grown-up document a company can write about its own failure. ‘We had a stern conversation with a developer’ is what amateurs send their investors.”
Maya turns that over. “And when she asks who made the mistake?”
“Tell her the truth: that six different people each did something reasonable, and the system let the six reasonable things add up to a stalled floor. If one person’s mistake can take down a delivery morning, the mistake is the system’s. That’s the sentence. You can have it.”
Sam, when Charlotte finds her, has one condition and it isn’t really a condition, it’s a demand. “Noor’s in the room. And Ash. If we’re walking through that morning, the people who were holding the boxes get to say what it was like, or you’ll get the developer version of the warehouse and it’ll be fiction.”
“They’re already on the invite.”
The strangest conversation is the one with Kai, who has by now finished his document. He sends it to Charlotte before she can even raise the meeting, the way you’d hand over your wrists. “I’ve written it up. My change, my review request, my pager week. Whatever the consequence is, I’d rather know today.”
Charlotte reads it. It is, as a confession, immaculate; as an incident analysis, nearly useless. “You’ve written four pages and the word ‘cache’ does more work in the channel screenshots than it does here. This document is about whether you’re good. I already know you’re good. The meeting this afternoon is about whether the system is good, and I need you there as the person who understands the failure best, not as the accused. Different job. Better use of you.”
“At my last place, this meeting had a different format.”
“I know the format. Everyone gets quieter for a quarter and the next person who spots a near-miss sits on it. We’re not buying quiet. Quiet is the most expensive thing an engineering team can own.”
At five to two, Priya, who has said little all day, stops Charlotte in the corridor. “For what it’s worth, I checked. We ran these properly for a while after the allergen incident. The last one with a room and a whiteboard was before Brisbane went live. Since then it’s been two-line debriefs in the channel. Eleven incidents. Two lines each. We didn’t decide to stop. We just stopped.”
“I know,” Charlotte says. “That’s the other thing this afternoon is for.”
Walking the timeline
The room at 2pm holds more of the company than any incident has before: Maya, Tom, Priya, Kai, Sam, Ravi, Jas, and Noor and Ash, who have both slept four hours and come in anyway. Charlotte stands at the whiteboard and scrolls her laptop to a message pinned in #incidents the better part of a year ago, and reads it aloud: regardless of what we discover, everyone did the best job they could with what they knew at the time, their skills, the resources, the situation at hand.
“That message has been pinned up there since before Brisbane,” she says. “Today we find out if we still mean it. Three things come out of this room: a timeline, a cause we can change with work rather than with a memo, and three actions with names and dates. One rule until the timeline’s done: facts only. If you feel a why or a should have coming on, it goes on an orange sticky and waits.”
She draws a horizontal line, Tuesday afternoon at one end, Thursday 9:30am at the other.
It takes twenty-five minutes, and it is slower and stranger than anyone expects, because the timeline doesn’t start where the blame had started. Tom’s version began at 4:31am Thursday. The wall says the first event is Tuesday, 4:09pm: PR approved. Then Tuesday, 6:05pm: contents finalised, checks green. Then a sticky that Noor dictates and Charlotte writes without comment: Tuesday night: storm. Kai adds Wednesday 12:15pm: shortfall entered, fast path re-run, four minutes and, in the second colour, the one for signals, dashboard green. Sam adds 5:24am: Noor phones me and Charlotte asks what signal woke the company, and writes the answer in the signal colour, large: a human, on the phone, again. The monitoring slept through the whole thing. The dashboard was green from end to end. Ash puts up the sticky nobody else could have written: 5:07am: silverbeet bin empty, nobody surprised the list was wrong about one thing, everyone surprised it was wrong about everything.
The orange stickies pile up at the side. Why no load test? Why does the floor improvise? Why didn’t the runbook match? Why was Tom in the channel on Kai’s week? Charlotte parks every one.
When the line is full, she steps back. “Before we ask why anything happened, one pass of a different question. Pick an action on this wall that looks bad in hindsight, and tell me what made it make sense at the time.”
Kai goes first, voice flat. “The cache made sense because the last late shortfall left the floor waiting forty minutes and ops asked us to make the re-run fast. The tests passed. There is no way to rehearse a delivery morning except by having one.”
Tom: “The one-line review made sense because I review every PR from every squad, and Tuesday I had nineteen of them. I read the diff. I didn’t read the system around the diff. There isn’t time to read the system around nineteen diffs.” Priya writes review load on an orange sticky and puts it aside, deliberately, where Tom can see it stay.
Ash: “Filling by hand made sense because it has always been the job. Empty bin, full crate, van on the clock. Nobody ever told us the flags only live in the computer.”
Noor: “Phoning Sam made sense because Sam answers. There’s no number on the wall for whoever carries the pager. There never has been.”
Then Maya does something nobody expects, and picks an action of her own off the wall. “The re-run being fast made sense because I asked for it. After the last late shortfall I told the squad the warehouse can’t wait forty minutes on a delivery morning, and I didn’t ask what fast would cost, because asking what things cost is exactly the habit we said we’d adopted.” She looks at the sticky for a moment. “I set the urgency. I never asked about the risk.”
Maya listens to all five answers, her own included, and says, mostly to herself, “Everyone keeps making sense.” Which is, although she doesn’t know the literature, the entire point. The room has stopped looking for the person who was wrong, because the wall is now crowded with people who were each, locally, right.
Why, not who
“Now the whys,” Charlotte says. “Start at the floor and keep going until we hit something we can fix with engineering.”
Why did the floor stall? Because the pick lists didn’t match the produce in the building. Why didn’t they match? Because the lists were generated from a cache the re-run hadn’t touched. Why did a stale read make it all the way to paper? Because nothing compares what’s about to be packed against what was allocated; the checks all watch the database, and the paper is downstream of the divergence. Why is the last hop unwatched? Because the digital system’s idea of a box and the floor’s idea of a box have never been connected; the printout is the last unwatched hop in the whole company, and everything after it runs on trust and muscle memory.
Charlotte boxes the answer. “There’s the cause. The system’s box and the floor’s box can drift apart, and no signal fires when they do. Kai’s cache is just the first thing that happened to make them drift. Something else would have, eventually. A migration. A retry. A timezone.”
She lists the contributing factors underneath, fast, no ceremony: a runbook describing a system that no longer exists; monitoring green because it watches the wrong layer; the warehouse’s only escalation path being Sam’s personal number; a hand-fill practice from the market days that quietly became dangerous the day the allergen flags moved into software; a review load concentrated on one person; an on-call rotation that the most senior engineer keeps overriding by being awake. She doesn’t linger on the last two. She just makes sure they’re written down.
Tom stares at the chain for a while. “If we’d run Friday’s meeting my way,” he says, “we’d have load tests by Thursday and this would happen again through some other gap, and the lists would still print wrong, and the only difference is Kai would have spent a quarter flinching.”
“Yes,” Charlotte says.
Three actions
The last twenty minutes are the most procedural and, Maya says later, the most reassuring. Three columns: action, owner, date. The room brainstorms fourteen possible fixes; Charlotte makes them rank. “Which of these would have most reduced the chance of Thursday?”
Three survive.
A verification step between allocation and paper: every pick list is diffed against the database before printing, every print morning, and a mismatch goes red and pages on-call before 5am. Kai’s diff from the incident, promoted from emergency tool to permanent fixture. Kai, by Friday next week. He volunteers before Charlotte can ask, and it lands differently than an assignment would.
A direct line from the floor into the rotation: the number on the warehouse wall pages whoever is on call, not Sam; the severity grid gets a row for “the floor is blocked”, and a one-page runbook to go with it, written with Noor, not for her. Priya and Noor, by end of sprint.
A hold-don’t-swap rule on the floor: an empty bin means the box waits and the pager fires, never an improvised fill; a laminated card by every packing line saying exactly that and why, with Mrs Patterson’s flag as the anonymous example. Barcode scanning at the packing line, the real fix, goes to the backlog the way the team now does these things, with an outcome attached and a number it has to move. Sam, by Monday.
Charlotte reads the three aloud with their names and dates, and each owner says yes, out loud, which feels faintly ridiculous and is the part everyone remembers.
The standing rule
It’s Priya who turns one meeting into a practice, in the last five minutes, looking at the eleven two-line debriefs in the channel history.
“We had this,” she says. “After the allergen incident. Charlotte ran it and it worked and then Charlotte stopped running it for us, and it turned out the practice was Charlotte, not us. Same as the Tuesday interviews. I don’t want to discover in another six months that we only walk timelines when she books the room.”
So they write it down, and the writing down is short. Every P1 or P2, and any near-miss that frightens someone, gets this meeting within forty-eight hours. Timeline first, facts only, whys parked. For every action that looks foolish in hindsight, someone asks what made it make sense at the time. Keep asking why until the answer is something a person can build, not something a person should feel. Three actions, never twelve, each with a name and a date, checked at the next review. The write-up goes in #incidents and a row goes in the incident log, which moves from Charlotte’s drive to Sam’s, where the spreadsheets thrive. And whoever holds the pen shouldn’t be the person at the centre of the timeline; the duty rotates, the way the commander role already does, so the practice belongs to the team and not to whichever coach happens to book the room.
Kai deletes his four-page confession that evening. In its place he posts the write-up: timeline, cause, three actions, his own name appearing exactly twice, both times as fact, neither time as verdict. Then he adds a line at the bottom that wasn’t in any template: “If you spot the next one of these forming, say so early. Apparently we don’t shoot people here. Still checking.”
Maya sends Angela the write-up on Monday, unedited, with one sentence on top: “This is what happened, what it cost, and the three things that will be true by the end of the month.” Angela’s reply arrives eleven minutes later. “This is the most reassuring incident email I’ve ever received. Most companies send me adjectives.”
The thing Maya keeps, though, isn’t Angela’s reply. It’s a moment from the meeting itself, somewhere in the middle of the why-chain, when she watched the room stop orbiting Kai. For two days the incident had a face on it. By 3pm it had a shape instead, a gap between a database and a printout, and you can close a gap. You can’t close a person.
The next chapter, Living Documentation: When the Wiki Starts Lying, publishes around September 2026.