Incidents
Alerts & Incidents
Alerts are the signal. Incidents are the investigation record. Opening an alert creates or attaches an incident for the same project.
Alert opens incident
When a monitor failure opens an alert, Mydle opens an incident (or attaches the alert to an existing open incident for that project). Operators work the incident desk while the alert remains the underlying failure record.
Deduplication
Repeated evaluations of the same ongoing outage update last_seen on the open alert and keep a single incident — they do not spawn duplicate desks for every failed check.
Code-level identity uses a stable dedupe key per project (for example alert code + rule). Touched alerts do not re-fire open notifications.
Recovery
When the underlying check recovers, the alert and attached incident can resolve together with a recovery notification when delivery is configured. Manual resolve with optional RCA remains available on the incident detail.
Limitations
- Incidents compose on alerts — they do not invent failures without an alert path.
- Resolved alert history in the project UI may still show an honest empty state.
- See lifecycle for allowed state transitions.