respond-to-production-incidents

Investigate, contain, and permanently remediate production incidents through Emisar. Use when an operator asks an agent to investigate production, explain why a service is degraded, stop the bleed, stabilize an environment, or fix an infrastructure incident; gather evidence, test hypotheses, use the smallest authorized action, fall back to explicitly approved break-glass access only when Emisar has no viable path, turn the root cause into a source-controlled application or infrastructure-as-code fix, verify the operator's deployment, iterate until recovery, and write the incident report. An investigation-only request authorizes observation, never a production-changing or break-glass action.