PRODUCTION PROXY INCIDENT: REDACTED RECORD / 生产代理事故脱敏记录
Mode / 模式: [DRILL 演练 / LIVE 真实事故]    Incident ID / 事故编号: [填入 / fill in]
This is a manual record, not an automated control. Use synthetic data for a drill.
这是人工记录，不是自动控制工具。演练请使用合成数据。
Do not include credentials, cookies, customer data, personal data or sensitive URLs.
不要填写凭据、Cookie、客户数据、个人数据或敏感网址。

1. COMMAND AND SCOPE / 指挥与范围
Declared at (timezone) / 宣布时间（含时区）: [ ]
Business impact and affected workflow / 业务影响与受影响工作流: [ ]
Target group, region, time window / 目标组、地区、时间窗口: [ ]
Last known good observation / 最后一次已知正常观察: [ ]
Cause (unknown until evidenced) / 原因（证据不足填未知）: [ ]
Commander / 指挥人: [ ]  Operations owner / 操作负责人: [ ]
Communications owner / 沟通负责人: [ ]  Next update time / 下一次更新时间: [ ]
Handoff: outgoing -> incoming, acknowledged at / 交接：交出人 -> 接手人，确认时间: [ ]

2. CONTAINMENT AND RESTRICTIONS / 止损与限制
Affected jobs held, unaffected scope / 已暂停任务、未受影响范围: [ ]
Authorization and target pause checked by / 授权及目标暂停核查人: [ ]
Applicable rate, concurrency and pause / 适用速率、并发与暂停期限: [ ]
Unknowns, escalation owner and next review / 未知项、升级负责人及复核时间: [ ]
Stop conditions / 停止条件: [ ]

3. CHANGE RECORD (repeat per change) / 变更记录（每次变更一份）
Change ID and non-secret previous-state reference / 变更编号及旧状态非敏感引用: [ ]
Proposed action, scope, reason / 拟执行操作、范围、原因: [ ]
Operator and approver / 执行人与批准人: [ ]
Expected observation and stop condition / 预期观察与停止条件: [ ]
Authorized rollback and safety checks / 已授权回退及安全核查: [ ]
Start and finish time; actual observation / 开始与结束时间；实际观察: [ ]
Decision and next owner / 决策及下一负责人: [ ]

4. RESTORATION / 恢复
HOLD checks complete? owner, permissions, pause, limits, plan / 暂停阶段检查：负责人、授权、暂停、限制、计划: [ ]
CANARY jobs, approval, observation window, business validation / 小流量任务、批准、观察窗口、业务校验: [ ]
RAMP next step, acceptance and stop conditions / 恢复下一步、通过及停止条件: [ ]
Decision HOLD / CONTINUE / ASSESS AUTHORIZED ROLLBACK / 决策：暂停 / 继续 / 评估已授权回退: [ ]

5. BACKLOG LEDGER / 积压台账
Precedence: uncertain prior completion or effects -> HOLD and reconcile, even if expired/duplicate; only then classify. Expiry does not waive reconciliation.
优先级：之前完成状态或副作用不确定 -> 先暂停核对，即使已过期或疑似重复；核对后再分类。过期不免除核对。
Snapshot time and total unique job IDs / 快照时间与不重复任务总数: [ ]
Reconciled and expired or duplicate / 已核对且过期或重复: [ ]
Held pending reconciliation / 等待核对: [ ]
Reconciled and potentially eligible, not automatically released / 已核对且可能符合释放条件、不自动释放: [ ]
Counts reconcile to total? / 分类总数与总数一致？ [ ]
Owner and evidence for each disposition / 各类处置负责人及证据: [ ]
Release order, batch limit, capacity for new work / 释放顺序、批次限制、新任务保留容量: [ ]
Before each batch: authorization, deadline, state, dependencies, limits, stop conditions / 每批前核验：授权、期限、状态、依赖、限制、停止条件: [ ]
Remaining held jobs and next review / 剩余暂停任务与下次复核: [ ]

6. HANDOFF AND CLOSE / 交接与关闭
Observed restored scope and window / 已观察恢复的范围与窗口: [ ]
Open impact, held-work owners and next update / 未解决影响、暂停任务负责人和下次更新: [ ]
Ledger reconciled and stakeholders informed / 台账已核对、相关方已获告知: [ ]
Cause / 原因: [UNKNOWN 未知 / supported evidence 有证据支持: ]
Follow-up action, owner, due date / 后续行动、负责人、期限: [ ]

DRILL / 演练: Use 100 fictional jobs: 30 reconciled and expired, 10 with uncertain side effects,
and 60 reconciled and potentially eligible. These groups are disjoint. Assign owners; reconcile 30+10+60; decide one
authorized canary and one bounded release. The 60 are not automatically released.
使用100个虚构任务：30个已核对且过期、10个副作用不确定、60个已核对且可能符合释放条件。三组互不重叠。
指定负责人，核对30+10+60，决定一次获准的小流量验证和一次有界释放；
60个任务不自动释放。