Incident runbook from the repo — detect, decide rollback, write back — step 2 of 9

A runbook a junior can execute from the repo has to be data: a signal to detect, a rollback-versus-continue rule, a named human if the decision cannot be executed alone, and a path to write the record back. Which ONE of the artifacts above is that runbook?