For the moment a ticket goes red
The preceding chapters derive the gates. This chapter is what an on-call operator reads when a ticket is red and a desk head is waiting, and its structure is deliberate: symptom, the exact arithmetic to quote, the owning card, the correct remedy, and — just as important — the wrong remedy, named explicitly, so an operator under deadline pressure recognises it for what it is before reaching for it. Agents still only propose here. Nothing in this manual authorises an agent to clear a refuse, no matter how fluently it can recite the playbook back.
Playbook A — DUAL_MARK_MIDPOINT
Symptom. A report, ticket, or dashboard asks for one mark. Someone pastes 1.80, or an ensemble mean lands near it.
Arithmetic to quote. Gap 0.60. Band separation 0.43. The midpoint z-scores 7.50 under the spread frame and -5.71 under the curve frame. The equal-weight average of P(mark > 1.80) under the two frames is 0.5000, even though each frame is individually nearly certain. A crowd interval like [1.61, 1.99] covers neither honest cloud.
Owner. Frame card, Layer 0/1.
Remedy. Emit the pair, or require a named human to choose one frame and record the choice on the ticket. Preserve the gap.
Wrong remedy. "Average for the committee and keep dual marks in the appendix." That trains the organisation to treat the honest output as decoration.
Playbook B — SOFT_LEAKAGE (aggregate room)
Symptom. Timestamp dashboards are green. A feature's z-score looks calmer than last week. Ablation later shows the calm days are exactly the loud days.
Arithmetic to quote. Legal scaler 0.42; full-week scaler including a co-break day, 0.8400 — exactly double. A deviation that reads z=2.50 legally reads z=1.25 once the leaked window enters. The feature was halved.
Owner. As-of contract, aggregate-window policy, Layer 0.
Remedy. Refit scalers on windows whose maximum knowledge time is at or before the decision clock; freeze the scaler with the pack hash; add a CI fixture that pins both z-scores so the drift can't recur silently.
Wrong remedy. "The timestamps were fine, so ship." Soft rooms are refuses, not banners. Every individual row can be perfectly honest while the aggregate built from those rows leaks, because the leak lives in the fitting window, not in any single timestamp.
Playbook C — LEAKAGE_FUTURE_PRINT
Symptom. Exam error collapses toward zero right after a join change. On some paths the mark comes out to exactly 1.80.
Arithmetic to quote. In the book's own Y = 1.50 + A + B toy, the legally-informed model's RMS error is 0.10; the leaked model's RMS error is 0. One of four leaked paths prints the denied midpoint exactly.
Owner. As-of contract, feature job, Layer 0.
Remedy. Drop the future column; rebuild the as-of hash; invalidate every exam that used the poisoned pack, not just the ticket that surfaced the problem.
Wrong remedy. Celebrate the accuracy and widen size. This is the most dangerous wrong remedy in the manual, because the evidence genuinely is better — the model really did score lower error. The error is faithfully describing a model that occupied a room it had no right to occupy, and no amount of confidence in the number changes that.
Playbook D — BOOK_COUPLING
Symptom. Each name individually shows yellow or green on its own monitor. Book-level volatility screams anyway.
Arithmetic to quote. Exception counts of 8, 7, and 9 across three names, all landing on the same shared dates. Pairwise correlation roughly 0.71, 0.66, 0.74 against a carded limit of 0.35. Effective independent bets across the three: about 1.25, not 3. Realised volatility comes in around 1.55× the naive target that assumed independence.
Owner. Family permit / coupling monitor, Layer 2.
Remedy. Retire the family; freeze retraining on the shared cue; require a joint exam, not three separate ones, before any member returns.
Wrong remedy. Add capital name by name and carry on, because each individual monitor still reads green. This is the failure this playbook exists specifically to catch: no single-name dashboard can see it, because the finding lives entirely in the dates where the exceptions align, not in any one name's own history.
Why a manual, not a Slack thread
Every entry ends the same way on purpose: the correct fix, and the tempting wrong fix named in the same breath. That naming is the entire value a field manual has over institutional memory or a search through old incident channels. The wrong answer was anticipated and blocked months before the night someone was tempted to type it, by someone who was not under deadline pressure when they wrote the playbook down.
Book: Chapter 33 in Rulers Before Models.