# Feature incident runbook

1. Name an incident owner. Capture affected users, behavior, data and dependencies.
2. Stop additional exposure. Choose feature OFF, reduced exposure, code rollback or another containment action based on the real boundary.
3. Inspect in-flight requests, workers, jobs and clients holding old decisions. Drain, pause or cancel using the application's actual controls.
4. Verify the stable path and monitoring. Confirm new-path calls and effects have stopped where intended; an OFF dashboard alone is insufficient.
5. Assess previous writes and external effects. Repair or compensate independently with the required authorization and audit record.
6. Prepare the fix. Reproduce the failure, run a regression that fails before the fix and passes after it, check both paths and data compatibility.
7. Reintroduce to a reviewed audience. Expand only after the chosen evidence window and guardrails are healthy.
8. Record cause, decision, remaining impact, owner and follow-up. Retain or remove the temporary flag according to the release contract.

Do not disable authorization as a containment shortcut. Avoid switching to a fallback dependent on the same failed service.