Incidents are opened automatically on a status transition and carry a full recovery task: diagnosis, dependency impact, last known good, remediation and closure criteria. Downstream symptoms are folded under the root cause rather than filed separately, and one active fault never produces two tickets.