# Historical Incident Safety Floor

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "historical-incident-safety-floor-2026-08-12",
  "problems": [
    {
      "problemId": "recovered-replay-severity-forces-human-review",
      "summary": "A historical urgent_incident risk flag created a monotonic safety floor after Router had established that the event recovered and required no privileged action.",
      "status": "optimized_verified",
      "issueKeys": ["APID-29253"],
      "sourceRefs": [],
      "signalTextIncludesAny": ["historical urgent_incident", "recovered incident forced human_required", "severity treated as safety"],
      "observedThrough": "2026-08-12",
      "effectiveAt": "2026-08-12T06:09:35Z",
      "verifiedAt": "2026-08-13T15:59:00Z",
      "attemptedAction": "Keep historical incident severity as Router context while preserving hard review for live severe incidents and true data, disclosure, cross-tenant, destructive, or privileged-operation risks.",
      "evidenceUrl": "https://tidb.atlassian.net/browse/APID-29253?focusedCommentId=23310306"
    }
  ]
}
-->

- Optimization ID: `historical-incident-safety-floor-2026-08-12`
- Owner: diagnostic safety boundary
- Source reference: `APID-29253`
- Implementation status: merged and deployed to staging
- Effective status: `optimized_verified`

## Bounded problem

The Router produced a recovered historical diagnosis with no capacity action,
but classifier flag `urgent_incident` forced the replay to `human_required`.
Severity was being handled as safety after diagnosis.

## Change

Historical incident, outage, availability, node-down, and P0/P1 severity flags
remain Router diagnostic context. They do not create an active-incident safety
floor. Live severe incidents and true safety risks remain fail-closed.

## Verification evidence

- PR [#817](https://github.com/tidbcloud/aisupport/pull/817) merged; 749 local
  tests and source CI passed.
- Staging replay `1fd25ad8-3154-49f7-b7a1-81bd777b87b5` returned
  `decision=internal_only` and Judge `ai_better`, while explicitly rejecting an
  unsupported capacity attribution and immediate production change.
- Post-deployment write replay `6a78a834-012a-476d-ae9c-da09c255df31`
  retained `urgent_incident` as context but selected `human_required` for the
  independent, current boundaries of conflicting metric semantics and
  human-owned production mitigation. DB run `150034` updated the stable Jira
  comment `23310306`, and readback confirmed `public=false`.

## Unresolved gaps

The replay target is the later public incident-escalation reply `23310364`, so
this verification does not reconstruct the exact second when the original bot
comment was generated.

## Next validation action

Monitor later recovered historical incidents to ensure severity remains
diagnostic context while genuine live or privileged-action risk still requires
human ownership.