Run Incident Response
Stabilize first. Communicate observed facts, actions underway, and the next update time. Keep estimates labeled as estimates. Keep security-sensitive and personal data in authorized incident channels. A timeline of inferences is not a timeline of observations. Do not wait for root cause before stopping active harm.
Use maintain-product once harm is stable and the owning repair remains. Use write-high-signal-update for the customer or internal update text.