Classify the incident by failing layer: model behavior, provider health, retrieval, tool integration, permission policy, prompt release, or operating process.
Record affected workflow, customer impact, release version, fallback state, owner, containment action, and validation signal before declaring recovery.