# Pre-mortem: receipt download

Fictional example: Northstar customer portal. The failure below is hypothetical.

## Planned outcome
Customers can download a receipt containing the correct payment information for their own completed order.

## Hypothetical failure
The download is released, but some customers receive an incorrect receipt or cannot tell whether a failed download can be retried.

## Context
- Participants: a product owner, developer, reviewer and Support representative.
- Sources and known facts: the agreed receipt fields, access model and current order page; link the real versions in the actual plan.
- Assumptions: the existing PDF generator supports the required fields without a new dependency.

## Risks worth acting on

### Risk: the payment date means different things to different readers
- Why it could happen: the display timezone is not yet agreed.
- Consequence: a customer may read a date that differs from the expected payment record.
- Early signal: the brief and receipt-format document disagree or omit the timezone.
- Prevention or response: agree the timezone before implementation and add a boundary-date check.
- Agreed owner: the product owner confirms the decision with the reviewer.
- Work link: link the receipt-field decision and implementation item.
- Review point: inspect the definition before work starts.
- Remaining exposure: this action does not cover refund dates.

### Risk: a PDF request uses an order without checking its owner
- Why it could happen: access checks can be lost when a new download path is introduced; this is a risk to verify, not a known defect.
- Consequence: private payment details could be shown to another customer.
- Early signal: the proposed implementation or tests do not cover a different customer's order.
- Prevention or response: reuse the current ownership check and require a refused cross-customer request test.
- Agreed owner: the developer implements the check; the reviewer inspects the evidence.
- Work link: link the implementation and access-test results.
- Review point: complete this check before deployment review.
- Remaining exposure: the team still needs to check its normal operational and access requirements.

## Decisions and next check
- Actions selected: resolve date ambiguity and verify order ownership before review.
- Risks accepted or deferred: refund behavior is outside this request and needs its own brief.
- Next check: inspect the selected actions with the code and receipt example at review.