Blame the curse, not the caster
A postmortem exists to make the next incident less likely, not to find someone to turn into a newt. When people expect blame, they stop reporting near misses, and the near misses are where the useful lessons are.
Write the timeline first, in plain language and in order: what was seen, what was tried, what worked. Then do the root-curse analysis. Ask what made the mistake easy to make: a missing ward, an unclear runbook, or a rune that looks too much like another rune.
There is one exception. If a caster deliberately ignored a red warning rune, the postmortem says so. Even then, the follow-up is a better rune, not a punishment. Publish the postmortem where the whole team can read it, and track each follow-up until it ships.