SUMMARY: Incident amnesia occurs when service recovery erases the decisions, affected cases, and unresolved evidence required to explain what happened. The infrastructure returns, the dashboard turns green, and the institution begins forgetting before the consequences have ended.
During disruption, knowledge scatters across alerts, chat channels, ticket notes, temporary spreadsheets, operator memory, participant reports, and vendor status pages. Recovery pressure rewards immediate coordination, not durable records. When the incident closes, only the easiest signals remain visible.
Green Dashboards Compress the Past
Availability metrics describe the service now. They do not preserve who was denied, which correction failed, how long a queue waited, or what temporary authority changed an outcome. A restored endpoint can coexist with unreconciled accounts and participants still carrying obsolete state.
The recovery privilege that returns a system to operation should also carry a duty to preserve the evidence of its choices. Otherwise the same operators who define restoration also define what remains knowable.
Temporary Channels Produce Disposable Truth
Incident rooms are optimized for speed. Messages are edited, threads fragment, screenshots lose context, and verbal decisions never enter the durable record. A later report reconstructs certainty from partial artifacts and often favors systems with automatic logs over people whose experience arrived through support.
This resembles data lineage failure. Claims appear in the final narrative without a visible path back to their source, timestamp, confidence, or superseding evidence.
Unresolved Cases Are Part of the Incident
A closure decision should inventory deferred transactions, pending appeals, manual overrides, missed notices, stale partners, and records that could not be reconstructed. Give each an owner and deadline. Do not move them into ordinary queues where their connection to the incident disappears.
Use the degraded-service drill to decide in advance which evidence must survive. The collection plan belongs in the fallback, not in the retrospective written after volatile context has vanished.
Memory Needs a Retention Owner
Name who captures decision records, freezes raw logs, preserves participant reports, and links later corrections to the original event. Retention should protect accountability without turning every incident artifact into permanent surveillance.
Field assessment: an incident is not over while the institution remembers restoration but forgets who still needs repair.
Continue the discussion in the Clandestinia forum.