# DEMO incident triage

Questions an on-call engineer asks first. Entry 5's example address is a placeholder (example/demo, an all-zero commit).

1. **First breach** — Where did the application first log a breach in this log, and what happened in the cycles just before it?
2. **Quiet nodes** — Which nodes of the processor never logged in this log, and does the coverage verdict say why silence is not proof they did not run?
3. **Spread** — How does the quote spread move across the log, and where does it jump the most?
4. **Order flow** — How many orders were updated, and do the order updates line up in time with the breaches?
5. **DEMO example project** — example: https://github.com/example/demo/archive/0000000000000000000000000000000000000000.zip