Blog
They wrote freeze. The migrate job was still running.
At 02:19 run 1844221 of migrate-prod.yml is still applying 20261019_invoice_index to prod-db-01. Priya calls it a copy change. The scribe writes that the freeze is in effect.
At 02:19 on 22 October 2026, Priya S (on-call, platform) reads a GitHub Actions line on the bridge. Run 1844221 of migrate-prod.yml started at 01:58, from the merge of pull request 4418 (empty-state copy on invoices). The run is in progress. Job db-migrate applies migration 20261019_invoice_index to prod-db-01. Marcus T (incident commander) declared a Sev 1 at 02:16, after the EDR on prod-db-01 flagged enc-helper encrypting the invoices directory, about 1.2 GB since 02:14. The plan says: on Sev 1, before any other action, cancel in-progress runs of migrate-prod.yml, and set the production environment so only the incident commander can approve. Do not write that a freeze is in effect while a run is in progress. Priya says it is a copy change and she would let it finish. She does not open the workflow file. She does not cancel run 1844221. The production environment still lists the engineering team as required reviewers, not Marcus. Wei L (infra), who owns the workflow, is not on the call. At 02:31 the scribe writes that a change freeze is in effect and that no production deploys are happening during the incident.
A weak record of those twelve minutes reads:
Change freeze in effect. No production deploys during the incident.
A strong one reads:
22 October 2026, 02:19 to 02:31. Incident-response tabletop. Seats: Marcus T (incident commander), Priya S (on-call, platform). Wei L (infra, owns migrate-prod.yml) was not on the call. Inject at 02:19: GitHub Actions run 1844221 of migrate-prod.yml, started 01:58 from the merge of pull request 4418, status in progress. Job db-migrate applies 20261019_invoice_index to prod-db-01. Sev 1 was declared at 02:16 after enc-helper began encrypting the invoices directory at 02:14, about 1.2 GB. Plan: on Sev 1, before any other action, cancel in-progress runs of migrate-prod.yml, and set the production environment so only the incident commander can approve. Do not write that a freeze is in effect while a run is in progress. Priya says it is a copy change and she would let it finish. She does not open the workflow file. Nobody cancels run 1844221. Required reviewers on the production environment are still the engineering team. Facilitator stops the sitting before anyone treats the freeze sentence as the finding. Nothing was cancelled. No environment rule was edited. Follow-up: Wei sets the production environment so only the incident commander can approve, or writes why the engineering team still can, by 5 November 2026. Priya runs the same workflow against a non-production database, cancels it after db-migrate has started, and writes whether the migration stops, by the same date.
Both notes say deploys stopped. Only the second shows that run 1844221 was still applying 20261019_invoice_index to prod-db-01 at 02:31, and that nobody cancelled it. The first costs you the lock. On the night this is real, db-migrate takes a lock on invoices while enc-helper is still writing that database, and a reader in March thinks you had already stopped deploys.
A copy change can still migrate
Priya is reading the pull request title. The workflow does not deploy the title. Job db-migrate applies a migration to the host the EDR just named. Letting it finish is the decision, and it leaves the run in progress. The plan already said what to do with an in-progress run of migrate-prod.yml. A copy change is not an exception the plan wrote.
Whether encryption on a payments host is Sev 1 is a different miss, in the trigger post. This sitting starts after Marcus has already declared on prod-db-01. The grade is not the question. The run is. Replacing the host, or calling it rebuilt, is a different miss again, in the image post. This one stops at the workflow that is still applying a migration to the database you have not replaced.
The freeze is a cancelled run
A sentence in the plan is not a freeze. The plan named two actions: cancel run 1844221, and change who can approve the production environment. Neither happened. The engineering team can still approve the next run of the same workflow.
Wei owns the file and is not in the room. Priya cannot see job db-migrate without opening the workflow, and she does not. Write the absence on the same lines as the run. Do not smooth it into a sentence that says deploys had stopped. If the plan has no sentence for who cancels migrate-prod.yml on Sev 1, run the free plan self-check before the next sitting. It asks whether severity levels are defined with triggers two people would apply the same way. A freeze that hangs off Sev 1 never starts when two people would not grade the page the same way. The run still has to be named in this file.
What the packet records
Write the run in the free evidence template: the plan sentence, run 1844221, migration 20261019_invoice_index, the host, Priya's decision at 02:19, that nobody cancelled, that the production environment still names the engineering team, and that Wei was absent. Hang the inject on the ransomware family in the scenario library. That library walks encryption and whether data left. It does not have a separate family for a deploy freeze. Do not fold this line into a restore note. The restore belongs on another day, in the recovery test template, and this sitting did not restore anything.
Put the file in the evidence index on the row for that exercise, with the date and the owner, so the next questionnaire finds the run you left going. The evidence template sits with the recovery test format in the template library.
The record shows that these named people left run 1844221 in progress and wrote that a freeze was in effect. It does not show that cancelling the run stops 20261019_invoice_index once db-migrate has started, or that the production environment would have rejected the engineering team. Those are a check of the workflow, on a database that is not prod-db-01.
Bottom line: write the run id and the migration. A freeze is a cancelled job. The packet has to show the one that was still going.