Keep the conditions that make an incident lesson usable

A useful incident record distinguishes observed impact, the supported mechanism, unresolved alternatives, mitigation, and verified corrective behavior. Link the relevant artifact versions, configurations, workload conditions, and regression fixture. A blameless account explains how the system and available information shaped decisions rather than stopping at a person's last action. That makes the record more reusable: a future investigator can compare mechanisms and evidence instead of matching one error string and repeating an old command.

Historical uncertainty should remain visible. If a replay covered only short prompts on one accelerator type, do not rewrite the conclusion as proof for every model and shape. If an omitted telemetry interval prevented a complete impact estimate, retain that gap even after service is restored. Updating a report can add new evidence without erasing what was known at decision time. Version the interpretation when it changes so later readers can distinguish the original response from later analysis.

Attach explicit invalidators to operational instructions: changed storage semantics, a different service identity, a new retry layer, altered memory allocation, or replaced telemetry definitions. A periodic review date is useful but cannot certify applicability between reviews. Conversely, an old mathematical explanation can remain valid when its assumptions still hold. Treat age as a scheduling signal, while context checks decide whether the particular action and evidence still apply.

A runbook can include a cheap preflight that checks relevant versions and modes, plus a supported verification step after the action. If the preflight fails, direct the responder to reassess rather than silently applying the old procedure. Automation should preserve the same boundary. An AI assistant retrieving a familiar incident entry needs the current configuration and applicable evidence; similarity of text does not establish permission or correctness. Keep human decision responsibility and automated checks connected to concrete system state rather than a document's confident tone.

Track whether corrective actions were deployed and verified, whether recurrence fixtures still run, and whether their assumptions match current interfaces. A low count of similarly titled incidents is weak evidence if detection or classification changed. Review new failures for mechanism overlap, including cases where the original safeguard worked but another path bypassed it. Learning is observable when future decisions and system behavior improve under comparable conditions, not merely when the report is published and a meeting is held.

The cache lab illustrates retrieval without semantic validation. Reset, set both C=4 and s=4, predict twelve hits in the sixteen initial requests, then inspect and Play or Step. Reset and set both C=4,s=1 for a separate zero-hit initial case. Playback is capped at 4,096 evaluated requests, and parameter edits retain time. The cache knows only numeric identifiers, not document versions, preconditions, or expiry. A hit demonstrates retrieval of a retained identifier; it supplies no evidence that an old instruction is applicable to today's incident.