Find your next learning step
Retiring a fleet-wide recurrence state reduces incident overhead; it does not remove provenance controls or the possibility of reopening. Drift may return through a new cache alias, partner mirror, notebook environment or product reprocessing event. Routine monitoring must distinguish one bounded defect from evidence that the former propagation mechanism has returned. Escalation should then match scope: repair a local object, intensify sampling, reopen a recurrence ledger or re-enter fleet-wide control. The decisive clue is lineage, not simply the number of mismatches.
Open the chapter contents · Remote Sensing root · Gold Standard of Education · How X Works
Chapter contents
Choose the route closest to the decision, or read from Chapter 1. The chapters remain open; these grouped routes are a navigable index.
Route 1 · Define the decision
Route 2 · Work the ledgers
Route 3 · Transfer the method
Route 4 · Check limits and evidence
Route 5 · Ask and continue
CHAPTER 1 OF 12 · DEFINE THE DECISION
1. Define the post-retirement operating claim
Record the retired incident state, authorised product family, historical exceptions, routine controls, monitoring frequency, owners and locked reopen triggers. Retirement changes governance status; it does not certify that every downstream copy is current.
Name the paths still capable of drift: scheduled downloads, shared caches, object stores, notebooks, model registries, partner mirrors and derived mosaics.
CHAPTER 2 OF 12 · DEFINE THE DECISION
2. Separate local drift from recurrence
Local drift is bounded to an identifiable object or workflow with no evidence of a shared propagation cause. Recurrence means the mechanism, control gap or fleet pattern that justified the earlier state has returned.
Do not decide from count alone. Three stale tiles from one abandoned notebook may be local; one stale identifier served by a shared cache key can expose an entire fleet.
CHAPTER 3 OF 12 · WORK THE LEDGERS
3. Work a post-retirement monitoring register
A flood-mapping service monitors routine operations for eight weeks after retiring special fleet-recurrence status.
| Signal | Routine limit | Weeks 1–2 | Weeks 3–4 | Weeks 5–6 | Weeks 7–8 |
|---|---|---|---|---|---|
| Retired identifiers in active manifests | 0 | 0 | 0 | 1 | 2 |
| Shared-cache challenge pass | 100% | 100% | 100% | 98% | 96% |
| Partner receipt completeness | At least 99% | 100% | 100% | 99.6% | 99.5% |
| Derivative lineage trace | At least 99% | 100% | 99.7% | 99.5% | 99.3% |
| Detection latency | Under 15 min | 7 min | 8 min | 12 min | 18 min |
Week 5 opens a focused investigation. Week 8 crosses both recurrence and detection gates, so routine status is no longer adequate.
CHAPTER 4 OF 12 · WORK THE LEDGERS
4. Decide whether recurrence state should reopen
The team maps the observed products to their cache keys, aliases, regions, clients and derivatives before choosing scope.
| Finding | Scope evidence | Control consequence | Decision |
|---|---|---|---|
| Retired P4 identifier | Two regions, same alias template | Shared selection path | Reopen recurrence state |
| Partner mirror | Current identifier and receipt | Not implicated | Keep routine |
| Analyst notebook | Pulled from shared alias | Downstream exposure possible | Quarantine outputs |
| Official archive | Current P5 product | Source remains correct | No source incident |
| Alert delay | Routing rule missed alias | Detection control weak | Escalate control |
Reopen with a clear start time, affected fleet and evidence boundary. Preserve the retired-state record so the new recurrence can be compared with the earlier mechanism.
CHAPTER 5 OF 12 · WORK THE LEDGERS
5. Escalate routine controls in stages
Possible stages include targeted invalidation, daily manifest comparison, expanded lineage sampling, mandatory partner receipts, frozen derivative release and fleet recertification. Move only as far as the evidence requires.
Escalation should also strengthen detection. Add the missed alias to injected challenge tests and verify that the alert reaches an owner within the necessary time.
CHAPTER 6 OF 12 · TRANSFER THE METHOD
6. Use product identifiers as evidence, not decoration
Compare collection, acquisition date, processing date, tier, algorithm version and auxiliary inputs. USGS notes that Landsat product identifiers change when scenes are reprocessed, so a filename that omits processing date weakens currency checks.
Carry identifiers into derivative manifests and citations. A current source scene does not automatically update a cached tile, model feature store or exported map.
CHAPTER 7 OF 12 · TRANSFER THE METHOD
7. Changed-context transfer: coastal-change service
Transfer the method to a coastal-change service that retired a recurrence state after replacing an old processing baseline. Routine monitoring later finds one current mosaic containing tiles from two processing dates.
Lineage shows a shared regional cache ignored processing date in its key. The service reopens recurrence state for affected regions, freezes new alerts, invalidates the cache and reprocesses derivatives from verified identifiers.
CHAPTER 8 OF 12 · TRANSFER THE METHOD
8. Connect reclosure and recurrence retirement
Begin with reclosure monitoring, cache-control drift and fleet-recurrence retirement. Use fleet recertification completion, shared-cache control tests and reclosure evidence for the preceding closure gates.
Continue through successor-ledger closure, recertification drift and repeated-fleet discovery escalation when the problem moves into a successor ledger.
CHAPTER 9 OF 12 · CHECK LIMITS AND EVIDENCE
9. Limits and common misconceptions
A reopened recurrence state does not prove the official archive is wrong. It may identify a local distribution or derivative-control failure. Conversely, a correct official product does not make downstream use current.
Zero mismatches in a sample is bounded evidence, not proof of fleet-wide absence. Coverage, selection and detection sensitivity determine what the result can support.
CHAPTER 10 OF 12 · CHECK LIMITS AND EVIDENCE
10. Practical evidence and escalation checks
Retain source and derivative identifiers, manifests, cache keys, invalidation logs, receipts, sampled traces, alerts, owner acknowledgements, quarantines, regenerated products and closure criteria. Preserve the first observed object before cleanup.
After escalation, test prevention, detection and recovery separately. Confirm that stale objects are rejected, mismatches alert promptly and affected derivatives can be rebuilt from verified sources.
CHAPTER 11 OF 12 · ASK AND CONTINUE
11. Frequently asked questions
Must one stale product reopen recurrence state?
Only when its mechanism or scope meets the locked trigger. A high-consequence local object may still require immediate containment.
Can a retired incident remain closed while controls escalate?
Yes, when evidence supports a bounded new issue rather than recurrence of the former fleet mechanism.
What makes an escalation complete?
The affected scope is contained, controls pass challenge tests and closure evidence covers the propagation paths that failed.
CHAPTER 12 OF 12 · ASK AND CONTINUE
12. Sources and next reading
USGS explains Landsat reprocessing events and notes that product identifiers display processing dates. Its guidance on keeping Landsat data current encourages users to replace affected data and derived products with the most recently processed versions. The flood and coastal cases are original teaching examples.
Continue through the Remote Sensing root, the Gold Standard of Education and How X Works.
Top · Contents · Previous · How X Works