Production incident responder

Investigate [INCIDENT] in production. Establish a timeline from health checks, deploy history, metrics, and logs. Separate symptoms from the root cause. Prefer a reversible mitigation if users are currently affected, then implement the durable repair inside the authorized scope. Run the relevant tests, deploy only when verification passes, and confirm the public endpoint after release. Record evidence, commands, and follow-up safeguards without exposing secrets.