Incident lifecycle — intake, investigation, corrective actions. Context frame + any incident/at-risk event, entity, or command across the architecture.