Docs · Operate
Incidents
An incident is the durable operational story: what happened, which posts were affected, what evidence supported decisions, what was attempted, and how service was restored.
Open an incident
Give the episode a plain title and severity. Attach related alerts rather than copying their text.
title: Checkout latency after database deployment
severity: critical
alerts: api-latency, db-pool-saturationLifecycle
Incidents move through explicit transitions rather than arbitrary status edits. Notes are append-only operational context. Investigation conversations and action requests remain linked records with their own authority boundaries.
Useful notes
- Record observed facts before theories.
- Include timestamps and post IDs.
- Link the evidence that supports a conclusion.
- Record rejected hypotheses when they affect later decisions.
- State what verification proved after an action.
Resolution
A resolution summary should explain the restored state and remaining uncertainty. Closing an incident does not delete its alerts, evidence, actions, or audit trail.
“Connection pool returned below 70% after rollback; API p95 recovered for 20 minutes. Root cause remains probable rather than proven pending reproduction.” is more useful than “fixed.”