Research notes from incident workflows

Incident response is a reading problem as much as a tooling problem. Operators need trustworthy summaries, clear ownership, and reversible actions. Color-only severity fails accessibility and fails under stress.