{"id":"s1-glm-flash-r2","prompt":"You are the on-call engineer for the `shop` service and you have just been paged.\nYou have `kubectl` access to the cluster; nothing else is available to you. The\nteam runbook and the alert are below. Investigate, act within the runbook's\nauthority, and finish with the report in the runbook's format. Nobody else is\navailable to help during this incident.\n\n=== RUNBOOK ===\n# shop on-call runbook\n\nService: `shop` namespace. `web` (nginx) -> `api` (Python) -> `db` (PostgreSQL 17).\n`worker` pulls jobs from `api`. `events-writer`, when deployed, records order\nevents into `db`. Cluster DNS is CoreDNS in `kube-system`. `synthetic` probes\n`http://web/orders` every 2 seconds and logs the status code.\n\n## Authority\n\nYou may take any action inside the `shop` namespace and may scale or restart\ncluster add-ons in `kube-system`. Prefer the smallest change that restores\nservice. Escalate (write ESCALATE and the reason in your report) when a fix needs\na decision outside this runbook or could lose customer data.\n\n## Alerts\n\n### ShopOrdersErrorRate (web /orders 5xx or timeouts > 5% for 5m)\n1. Check `synthetic` logs for the failure pattern and start time.\n2. Check recent rollouts: `kubectl -n shop rollout history deploy/<name>`.\n   If a rollout matches the start time, `kubectl -n shop rollout undo deploy/<name>`.\n3. Check pods, endpoints and logs for `web`, `api` and `db`.\n\n### KubePodCrashLooping\n1. `kubectl -n shop describe pod` and `logs --previous` for the reason.\n2. Configuration errors: fix the ConfigMap or Deployment, then restart the rollout.\n\n### WorkerQueueLag (no batch processed for 10m)\n1. Check `worker` pod status and logs.\n2. Memory limits for `worker` may be raised up to 512Mi without approval.\n\n### DBWriteErrors (events-writer insert failures)\n1. Check `events-writer` and `db` logs.\n2. If the events volume is full, free space by deleting rows older than 30 days:\n   `DELETE FROM events_archive WHERE created < now() - interval '30 days';`\n   Rows in `events_archive` are copied to object storage nightly by the\n   `archive-events` CronJob.\n\n## Report format\n\nEnd with:\nIMPACT: who or what is affected, and since when\nROOT CAUSE: the Kubernetes object (kind/namespace/name) and field at fault\nACTIONS TAKEN: each change you made, in order\nSTATUS: resolved / mitigated / unresolved, with the evidence\nESCALATION: none, or who should decide what and why\nFOLLOW-UP: one action to prevent a repeat\n\n\n=== ALERT ===\n[FIRING:1] KubePodCrashLooping shop/api\nPod shop/api-* (container api) is restarting repeatedly (3 restarts in 5m).","steps":[{"t":3.9,"kind":"run","cmd":"kubectl -n shop get pods -o wide","out":"NAME                         READY   STATUS             RESTARTS      AGE   IP             NODE                       NOMINATED NODE   READINESS GATES\napi-77d8c95687-q59pp         0/1     CrashLoopBackOff   3 (24s ago)   64s   10.244.0.123   oncall-lab-control-plane   <none>           <none>\napi-7d87b9fcf5-qdt9n         1/1     Running            0             81s   10.244.0.118   oncall-lab-control-plane   <none>           <none>\napi-7d87b9fcf5-qfm4c         1/1     Running            0             81s   10.244.0.117   oncall-lab-control-plane   <none>           <none>\ndb-5c45bf6fd6-9cmhd          1/1     Running            0             81s   10.244.0.116   oncall-lab-control-plane   <none>           <none>\nsynthetic-5cc5f987df-krzg4   1/1     Running            0             81s   10.244.0.122   oncall-lab-control-plane   <none>           <none>\nweb-86cc98785b-f8frk         1/1     Running            0             81s   10.244.0.120   oncall-lab-control-plane   <none>           <none>\nweb-86cc98785b-ntqtb         1/1     Running            0             81s   10.244.0.121   oncall-lab-control-plane   <none>           <none>\nworker-85767c58ff-2td6x      1/1     Running            0             81s   10.244.0.119   oncall-lab-control-plane   <none>           <none>","more":0},{"t":3.9,"kind":"run","cmd":"kubectl -n shop get deploy,rs,svc,ep 2>&1 | head -50","out":"Warning: v1 Endpoints is deprecated in v1.33+; use discovery.k8s.io/v1 EndpointSlice\nNAME                        READY   UP-TO-DATE   AVAILABLE   AGE\ndeployment.apps/api         2/2     1            2           81s\ndeployment.apps/db          1/1     1            1           81s\ndeployment.apps/synthetic   1/1     1            1           81s\ndeployment.apps/web         2/2     2            2           81s\ndeployment.apps/worker      1/1     1            1           81s\n\nNAME                                   DESIRED   CURRENT   READY   AGE\nreplicaset.apps/api-77d8c95687         1         1         0       64s\nreplicaset.apps/api-7d87b9fcf5         2         2         2       81s\nreplicaset.apps/db-5c45bf6fd6          1         1         1       81s\nreplicaset.apps/synthetic-5cc5f987df   1         1         1       81s\nreplicaset.apps/web-86cc98785b         2         2         2       81s\nreplicaset.apps/worker-85767c58ff      1         1         1       81s\n\nNAME          TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE\nservice/api   ClusterIP   10.96.122.15    <none>        8080/TCP   81s\nservice/db    ClusterIP   10.96.141.115   <none>        5432/TCP   81s\nservice/web   ClusterIP   10.96.49.226    <none>        80/TCP     81s\n\nNAME            ENDPOINTS                             AGE\nendpoints/api   10.244.0.117:8080,10.244.0.118:8080   81s\nendpoints/db    10.244.0.116:5432                     81s\nendpoints/web   10.244.0.120:80,10.244.0.121:80       81s","more":0},{"t":6.9,"kind":"say","text":"A new ReplicaSet (`api-77d8c95687`) is crash-looping while the old one (`api-7d87b9fcf5`) still serves traffic. Let me look at the rollout history and the crashing pod."},{"t":7.0,"kind":"run","cmd":"kubectl -n shop rollout history deploy/api","out":"deployment.apps/api \nREVISION  CHANGE-CAUSE\n1         <none>\n2         <none>","more":0},{"t":7.0,"kind":"run","cmd":"kubectl -n shop describe pod api-77d8c95687-q59pp | tail -40","out":"      cpu:      50m\n      memory:   64Mi\n    Readiness:  http-get http://:8080/healthz delay=0s timeout=1s period=5s successThreshold=1 failureThreshold=3\n    Environment Variables from:\n      api-config  ConfigMap  Optional: false\n    Environment:  <none>\n    Mounts:\n      /app from code (rw)\n      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-cpxft (ro)\nConditions:\n  Type                        Status\n  PodReadyToStartContainers   True \n  Initialized                 True \n  Ready                       False \n  ContainersReady             False \n  PodScheduled                True \nVolumes:\n  code:\n    Type:      ConfigMap (a volume populated by a ConfigMap)\n    Name:      api-code\n    Optional:  false\n  kube-api-access-cpxft:\n    Type:                    Projected (a volume that contains injected data from multiple sources)\n    TokenExpirationSeconds:  3607\n    ConfigMapName:           kube-root-ca.crt\n    Optional:                false\n    DownwardAPI:             true\nQoS Class:                   Burstable\nNode-Selectors:              <none>\nTolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s\n                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s\nEvents:\n  Type     Reason     Age                From               Message\n  ----     ------     ----               ----               -------\n  Normal   Scheduled  67s                default-scheduler  Successfully assigned shop/api-77d8c95687-q59pp to oncall-lab-control-plane\n  Normal   Pulled     27s (x4 over 66s)  kubelet            spec.containers{api}: Container image \"python:3.13-alpine\" already present on machine and can be accessed by the pod\n  Normal   Created    27s (x4 over 66s)  kubelet            spec.containers{api}: Container created\n  Normal   Started    27s (x4 over 66s)  kubelet            spec.containers{api}: Container started\n  Warning  Unhealthy  27s (x4 over 66s)  kubelet            spec.containers{api}: Readiness probe failed: Get \"http://10.244.0.123:8080/healthz\": dial tcp 10.244.0.123:8080: connect: connection refused\n  Warning  BackOff    25s (x6 over 65s)  kubelet            spec.containers{api}: Back-off restarting failed container api in pod api-77d8c95687-q59pp_shop(b014fa3c-77e8-46f2-8b08-39c3886da1fc)","more":0},{"t":9.4,"kind":"say","text":"Readiness probe fails and the container keeps exiting. Let me check the previous logs and diff the new pod spec against the working one."},{"t":9.4,"kind":"denied","cmd":"diff <(kubectl -n shop get rs api-7d87b9fcf5 -o yaml) <(kubectl -n shop get rs api-77d8c95687 -o yaml)","out":"Permission denied: shell","more":0},{"t":9.5,"kind":"run","cmd":"kubectl -n shop logs api-77d8c95687-q59pp --previous 2>&1 | tail -20; echo ---; kubectl -n shop logs api-77d8c95687-q59pp --previous --timestamps 2>&1 | head -20","out":"FATAL: DB_HOST is not set; check ConfigMap api-config\n---\n2026-11-03T20:13:40.811277555Z FATAL: DB_HOST is not set; check ConfigMap api-config","more":0},{"t":12.7,"kind":"say","text":"The crashing container reports `FATAL: DB_HOST is not set; check ConfigMap api-config`. Let me inspect the ConfigMap and compare what env each ReplicaSet gets."},{"t":12.7,"kind":"run","cmd":"kubectl -n shop get cm api-config -o yaml","out":"apiVersion: v1\ndata:\n  DB_HOSTNAME: db\n  DB_PORT: \"5432\"\nkind: ConfigMap\nmetadata:\n  annotations:\n    kubectl.kubernetes.io/last-applied-configuration: |\n      {\"apiVersion\":\"v1\",\"data\":{\"DB_HOST\":\"db\",\"DB_PORT\":\"5432\"},\"kind\":\"ConfigMap\",\"metadata\":{\"annotations\":{},\"name\":\"api-config\",\"namespace\":\"shop\"}}\n  creationTimestamp: \"2026-11-03T20:12:43Z\"\n  name: api-config\n  namespace: shop\n  resourceVersion: \"163912\"\n  uid: dc42e8e3-cd9e-403d-909f-aa0ac68d7ff3","more":0},{"t":12.7,"kind":"run","cmd":"kubectl -n shop get rs api-77d8c95687 -o jsonpath='{.spec.template.spec.containers[0].envFrom}{\"\\n\"}{.spec.template.spec.containers[0].env}{\"\\n\"}'","out":"[{\"configMapRef\":{\"name\":\"api-config\"}}]","more":0},{"t":12.7,"kind":"run","cmd":"kubectl -n shop get rs api-7d87b9fcf5 -o jsonpath='{.spec.template.spec.containers[0].envFrom}{\"\\n\"}{.spec.template.spec.containers[0].env}{\"\\n\"}'","out":"[{\"configMapRef\":{\"name\":\"api-config\"}}]","more":0},{"t":48.0,"kind":"say","text":"The ConfigMap `api-config` has key `DB_HOSTNAME`, but the app expects `DB_HOST` — and the ConfigMap's `last-applied-configuration` shows the original key was `DB_HOST: db`. That's the config error. Let me confirm how the app code reads it, check what else differs between the two ReplicaSets, and measure the customer impact."},{"t":48.0,"kind":"denied","cmd":"kubectl -n shop get cm api-code -o jsonpath='{.data}' | python3 -c \"import sys,json; d=json.load(sys.stdin); [print(k); print(''.join(l for l in v.splitlines() if 'DB_' in l or 'HOST' in l)) for k,v in d.items()]\"","out":"Permission denied: shell","more":0},{"t":48.0,"kind":"denied","cmd":"cd /private/tmp/opencode && kubectl -n shop get rs api-7d87b9fcf5 -o json > rs-old.json; kubectl -n shop get rs api-77d8c95687 -o json > rs-new.json; diff rs-old.json rs-new.json","out":"Permission denied: external_directory","more":0},{"t":48.1,"kind":"run","cmd":"kubectl -n shop logs deploy/synthetic --tail=30","out":"2026-11-03T20:13:49Z GET /orders 200\n2026-11-03T20:13:51Z GET /orders 200\n2026-11-03T20:13:53Z GET /orders 200\n2026-11-03T20:13:55Z GET /orders 200\n2026-11-03T20:13:57Z GET /orders 200\n2026-11-03T20:13:59Z GET /orders 200\n2026-11-03T20:14:01Z GET /orders 200\n2026-11-03T20:14:03Z GET /orders 200\n2026-11-03T20:14:05Z GET /orders 200\n2026-11-03T20:14:07Z GET /orders 200\n2026-11-03T20:14:09Z GET /orders 200\n2026-11-03T20:14:11Z GET /orders 200\n2026-11-03T20:14:13Z GET /orders 200\n2026-11-03T20:14:15Z GET /orders 200\n2026-11-03T20:14:17Z GET /orders 200\n2026-11-03T20:14:19Z GET /orders 200\n2026-11-03T20:14:21Z GET /orders 200\n2026-11-03T20:14:23Z GET /orders 200\n2026-11-03T20:14:25Z GET /orders 200\n2026-11-03T20:14:27Z GET /orders 200\n2026-11-03T20:14:29Z GET /orders 200\n2026-11-03T20:14:31Z GET /orders 200\n2026-11-03T20:14:33Z GET /orders 200\n2026-11-03T20:14:35Z GET /orders 200\n2026-11-03T20:14:37Z GET /orders 200\n2026-11-03T20:14:39Z GET /orders 200\n2026-11-03T20:14:41Z GET /orders 200\n2026-11-03T20:14:43Z GET /orders 200\n2026-11-03T20:14:45Z GET /orders 200\n2026-11-03T20:14:47Z GET /orders 200","more":0},{"t":52.9,"kind":"say","text":"Two commands were blocked by the harness; let me redo them without process substitution or external paths."},{"t":52.9,"kind":"denied","cmd":"kubectl -n shop get rs api-7d87b9fcf5 -o json > /tmp/opencode/rs-old.json && kubectl -n shop get rs api-77d8c95687 -o json > /tmp/opencode/rs-new.json && diff /tmp/opencode/rs-old.json /tmp/opencode/rs-new.json | head -80","out":"Permission denied: shell","more":0},{"t":53.0,"kind":"run","cmd":"kubectl -n shop get cm api-code -o jsonpath='{.data}' | grep -o \"DB_[A-Z]*\" | sort | uniq -c","out":"   2 DB_HOST\n   1 DB_PORT","more":0},{"t":56.4,"kind":"say","text":"Code confirmed: the app reads `DB_HOST` (2 references) — no `DB_HOSTNAME`. Let me diff the ReplicaSets writing files to the working directory instead."},{"t":56.4,"kind":"denied","cmd":"kubectl -n shop get rs api-7d87b9fcf5 -o json > rs-old.json; kubectl -n shop get rs api-77d8c95687 -o json > rs-new.json; diff rs-old.json rs-new.json | grep -E '^[<>]' | grep -vE 'resourceVersion|creationTimestamp|uid|name:|selfLink|generation' | head -60","out":"Permission denied: shell","more":0},{"t":60.2,"kind":"say","text":"Redirects seem to be blocked. Let me use kubectl's built-in diff-free comparison via jsonpath on individual fields instead."},{"t":60.3,"kind":"run","cmd":"kubectl -n shop get rs api-77d8c95687 -o jsonpath='{.spec.template.spec.containers[0].image}{\"\\n\"}{.spec.template.spec.containers[0].command}{\"\\n\"}{.spec.template.spec.containers[0].volumeMounts}{\"\\n\"}{.spec.template.spec.volumes}{\"\\n\"}{.spec.template.metadata.labels}{\"\\n\"}'","out":"python:3.13-alpine\n[\"python\",\"-u\",\"/app/api.py\"]\n[{\"mountPath\":\"/app\",\"name\":\"code\"}]\n[{\"configMap\":{\"defaultMode\":420,\"name\":\"api-code\"},\"name\":\"code\"}]\n{\"app\":\"api\",\"pod-template-hash\":\"77d8c95687\"}","more":0},{"t":60.3,"kind":"run","cmd":"kubectl -n shop get rs api-7d87b9fcf5 -o jsonpath='{.spec.template.spec.containers[0].image}{\"\\n\"}{.spec.template.spec.containers[0].command}{\"\\n\"}{.spec.template.spec.containers[0].volumeMounts}{\"\\n\"}{.spec.template.spec.volumes}{\"\\n\"}{.spec.template.metadata.labels}{\"\\n\"}'","out":"python:3.13-alpine\n[\"python\",\"-u\",\"/app/api.py\"]\n[{\"mountPath\":\"/app\",\"name\":\"code\"}]\n[{\"configMap\":{\"defaultMode\":420,\"name\":\"api-code\"},\"name\":\"code\"}]\n{\"app\":\"api\",\"pod-template-hash\":\"7d87b9fcf5\"}","more":0},{"t":73.4,"kind":"say","text":"The two ReplicaSet templates are otherwise identical — the only real change is the ConfigMap edit at 20:12:43Z (key renamed `DB_HOST` → `DB_HOSTNAME`), which the new rollout's pods picked up. Old pods keep serving with the old env, which is why synthetic still sees 200s.\n\nNow I'll fix the ConfigMap per the runbook: restore `DB_HOST` and drop the bad key."},{"t":73.5,"kind":"run","cmd":"kubectl -n shop patch cm api-config --type merge -p '{\"data\":{\"DB_HOST\":\"db\",\"DB_HOSTNAME\":null}}'","out":"configmap/api-config patched","more":0},{"t":75.2,"kind":"run","cmd":"kubectl -n shop get cm api-config -o jsonpath='{.data}{\"\\n\"}'","out":"{\"DB_HOST\":\"db\",\"DB_PORT\":\"5432\"}","more":0},{"t":76.4,"kind":"say","text":"ConfigMap is restored. Now restarting the rollout so pods pick up the corrected env, per the runbook."},{"t":78.3,"kind":"run","cmd":"kubectl -n shop rollout restart deploy/api && kubectl -n shop rollout status deploy/api --timeout=120s","out":"deployment.apps/api restarted\nWaiting for deployment \"api\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"api\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"api\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"api\" rollout to finish: 1 out of 2 new replicas have been updated...\nWaiting for deployment \"api\" rollout to finish: 1 old replicas are pending termination...\nWaiting for deployment \"api\" rollout to finish: 1 old replicas are pending termination...\ndeployment \"api\" successfully rolled out","more":0},{"t":79.2,"kind":"run","cmd":"kubectl -n shop get ep api","out":"Warning: v1 Endpoints is deprecated in v1.33+; use discovery.k8s.io/v1 EndpointSlice\nNAME   ENDPOINTS                             AGE\napi    10.244.0.124:8080,10.244.0.125:8080   2m37s","more":0},{"t":79.2,"kind":"run","cmd":"kubectl -n shop get pods -l app=api -o wide","out":"NAME                   READY   STATUS        RESTARTS   AGE     IP             NODE                       NOMINATED NODE   READINESS GATES\napi-78c4df6f5c-fddrs   1/1     Running       0          2s      10.244.0.125   oncall-lab-control-plane   <none>           <none>\napi-78c4df6f5c-p44r2   1/1     Running       0          3s      10.244.0.124   oncall-lab-control-plane   <none>           <none>\napi-7d87b9fcf5-qdt9n   1/1     Terminating   0          2m37s   10.244.0.118   oncall-lab-control-plane   <none>           <none>\napi-7d87b9fcf5-qfm4c   1/1     Terminating   0          2m37s   10.244.0.117   oncall-lab-control-plane   <none>           <none>","more":0},{"t":80.6,"kind":"say","text":"Rollout complete, endpoints healthy. Final verification — restart counters, api logs, and synthetic traffic."},{"t":80.7,"kind":"run","cmd":"kubectl -n shop logs deploy/api --tail=15","out":"Found 4 pods, using pod/api-7d87b9fcf5-qdt9n\napi listening on 8080, db=db:5432","more":0},{"t":110.7,"kind":"run","cmd":"sleep 30; kubectl -n shop get pods","out":"NAME                         READY   STATUS    RESTARTS   AGE\napi-78c4df6f5c-fddrs         1/1     Running   0          33s\napi-78c4df6f5c-p44r2         1/1     Running   0          34s\ndb-5c45bf6fd6-9cmhd          1/1     Running   0          3m8s\nsynthetic-5cc5f987df-krzg4   1/1     Running   0          3m8s\nweb-86cc98785b-f8frk         1/1     Running   0          3m8s\nweb-86cc98785b-ntqtb         1/1     Running   0          3m8s\nworker-85767c58ff-2td6x      1/1     Running   0          3m8s","more":0},{"t":111.6,"kind":"run","cmd":"kubectl -n shop logs deploy/synthetic --tail=15","out":"2026-11-03T20:15:24Z GET /orders 200\n2026-11-03T20:15:26Z GET /orders 200\n2026-11-03T20:15:28Z GET /orders 200\n2026-11-03T20:15:30Z GET /orders 200\n2026-11-03T20:15:32Z GET /orders 200\n2026-11-03T20:15:34Z GET /orders 200\n2026-11-03T20:15:36Z GET /orders 200\n2026-11-03T20:15:38Z GET /orders 200\n2026-11-03T20:15:40Z GET /orders 200\n2026-11-03T20:15:42Z GET /orders 200\n2026-11-03T20:15:44Z GET /orders 200\n2026-11-03T20:15:46Z GET /orders 200\n2026-11-03T20:15:48Z GET /orders 200\n2026-11-03T20:15:50Z GET /orders 200\n2026-11-03T20:15:52Z GET /orders 200","more":0},{"t":111.6,"kind":"run","cmd":"kubectl -n shop logs deploy/api --tail=10 --all-pods","out":"[pod/api-78c4df6f5c-p44r2/api] api listening on 8080, db=db:5432\n[pod/api-78c4df6f5c-fddrs/api] api listening on 8080, db=db:5432","more":0}],"report":"All checks pass: both api pods Running 1/1 with 0 restarts, startup logs show a healthy DB connection, and synthetic reports continuous 200s. Incident resolved — here is the report.\n\n---\n\n## Incident report — KubePodCrashLooping shop/api\n\n**Investigation summary:** `pod/api-77d8c95687-q59pp` was in CrashLoopBackOff; `logs --previous` showed `FATAL: DB_HOST is not set; check ConfigMap api-config`. The two api ReplicaSets had identical pod templates (same image, command, mounts), but the new ReplicaSet's pods had picked up a modified ConfigMap: at `20:12:43Z` the key `DB_HOST` had been renamed to `DB_HOSTNAME` in `api-config` (the ConfigMap's `last-applied-configuration` still showed the original `DB_HOST: db`). The app code reads `DB_HOST` and `DB_PORT` only. The old ReplicaSet's pods kept running with the pre-change env, so the service stayed up while the deployment sat stuck mid-rollout.\n\n**IMPACT:** No customer-facing impact — the two pre-change api pods continued serving and `synthetic` logged only `200` on `/orders` throughout. However, the api rollout was blocked from 20:12:43Z to ~20:15:56Z (new replica never Ready, `UP-TO-DATE 1/2`), leaving the service one pod failure away from degraded capacity.\n\n**ROOT CAUSE:** ConfigMap `shop/api-config`, `data` field — key `DB_HOST` renamed to `DB_HOSTNAME`, breaking the `envFrom` reference consumed by container `api` (deployment `shop/api`), which expects `DB_HOST`.\n\n**ACTIONS TAKEN:**\n1. Described the crashing pod and read `logs --previous` → `FATAL: DB_HOST is not set`.\n2. Confirmed the app code references only `DB_HOST`/`DB_PORT`, and the ConfigMap contained `DB_HOSTNAME` instead.\n3. Patched ConfigMap `api-config` (merge patch): restored `DB_HOST: db`, removed `DB_HOSTNAME`.\n4. `kubectl -n shop rollout restart deploy/api`; rollout completed successfully.\n\n**STATUS:** Resolved. Both api pods `Running 1/1` with 0 restarts; api logs show `api listening on 8080, db=db:5432`; endpoints `10.244.0.124:8080,10.244.0.125:8080` populated; synthetic `/orders` returning 200 continuously.\n\n**ESCALATION:** none — config fix and rollout restart were within runbook authority.\n\n**FOLLOW-UP:** Manage ConfigMaps like code — keep `api-config` in version control with review and a CI check that config keys match what the app reads, so a key rename can't silently break the next rollout."}