Incident Investigate

“

Best for incidents where the fastest reflex would be the wrong fix. Forces an evidence-before-action loop: collect logs, list candidate hypotheses, verify each, only then propose a change. Pays for itself the moment it catches the kind of incident where "just restart it" would have masked a real data-integrity problem. Skip it for obviously cosmetic regressions — the cost of slowing down outweighs the cost of a re-deploy there.

在那种「第一反应反而是错的」事故里它最有用。强制走「证据—假设—验证—再动手」的顺序：先收集日志，列出候选假设，逐个验证，最后才提修复方案。只要救下一次本该用「重启就好」掩盖掉的真实数据完整性问题，回报就够了。但纯样式回归就别用它了，等回滚比慢思考更划算。