A resolver incident can reopen after apparently passing closure because one cache path, redirect rule or landing-page deployment still serves the wrong remote-sensing identity. The second response must protect users without destroying the evidence needed to understand recurrence.
This guide defines reopened-incident containment, uses path quarantine as a controlled way to stop an affected route serving canonical evidence, and raises the bar for a second closure. It separates a persistent identifier from the delivery paths that can fail around it.
Examples are fictional. Repository operators must follow their registry, preservation, privacy, security and incident policies. Do not purge, block or alter third-party infrastructure without authority.
eduKateSG · The Gold Standard · Remote Sensing
Find your next learning step
Confirm the recurrence, preserve the request and response evidence, contain only the affected path, maintain a verified access route, then close again only after repeated and independent checks.
- ROUTE 1 · Reopen correctly — tie recurrence to the earlier incident
- ROUTE 2 · Contain the path — stop wrong identity while preserving evidence
- ROUTE 3 · Quarantine safely — define scope, alternatives and exit criteria
- ROUTE 4 · Close a second time — require stronger multi-path evidence
- ROUTE 5 · Transfer carefully — limits, questions and sources
Full chapter index · Remote Sensing root guide · Learning that transfers into life · How X Works hub
Chapter contents
Chapters 1–3
Chapters 4–5
Chapters 6–8
Chapters 9–10
CHAPTER 1 OF 12
1. Reopening is a new state in the same history
The immediate guide on resolver-incident recurrence monitoring defines a gate for reopening. Link the new observation to the prior incident, closure package, resolver path, product identity and first time the recurrence could have appeared.
Do not overwrite the first closure as if it never happened. It remains evidence about the tests then performed. Reopening records that later evidence changed the incident state and helps reveal which earlier assumption or path coverage was insufficient.
CHAPTER 2 OF 12
2. Prove the observation before taking broad action
Capture the request method, time, network or region, redirect chain, response headers, cache fields, validators, final URL and landing-page identity. Repeat from a controlled path where possible. A screenshot alone rarely distinguishes a resolver, intermediary, browser cache or page-deployment failure.
HTTP 200 is not identity evidence. Compare collection identifier, product version, sensor, processing level, temporal coverage and access route. A healthy page for the wrong collection is still a resolver incident.
CHAPTER 3 OF 12
3. Preserve evidence before invalidation or purge
Containment can erase transient clues. Save durable summaries or raw observations allowed by policy before a cache purge, redirect rollback or configuration replacement. Record who authorised the action, its scope and the configuration versions before and after.
Preservation is not a reason to leave users exposed. Use a short evidence checklist and act at the speed required by harm. If evidence cannot safely be collected, record that limitation and the reason.
CHAPTER 4 OF 12
4. Worked example: only a shared office path recurs
A fictional DOI resolves correctly on mobile and two external monitors but the office network reaches an older product version. The office response carries Age: 2,900 and a shared-cache freshness lifetime of 3,600 seconds. The registry record and independent path both show the approved target.
The evidence supports a path-specific cached representation, not a global registry reversal. Containment can bypass or invalidate the authorised office cache path and publish a verified alternate route while preserving the identifier. Repeating the registry update would add activity without addressing the observed layer.
| Path | Observation | Immediate interpretation | Containment |
|---|---|---|---|
| Registry API | Approved target | Registry stable | No repeat update |
| Mobile network | Correct identity | Independent path healthy | Keep as verified route |
| Office shared cache | Old identity; Age 2900 | Path-specific fresh cache possible | Quarantine/bypass path |
| Office after expiry | Retest required | Not yet closure evidence | Observe and repeat |
CHAPTER 5 OF 12
5. Choose the narrowest effective containment
Possible controls include disabling a faulty redirect rule, bypassing an authorised shared cache, serving a temporary interstitial, withdrawing a broken mirror or directing users to a verified landing page. The control should stop the wrong identity while preserving as much normal persistent resolution as possible.
Avoid calling the whole identifier invalid when only one delivery path is wrong. Conversely, do not keep a narrow containment after evidence shows a registry-wide or origin-wide failure. Scope follows observed and plausible impact.
CHAPTER 6 OF 12
6. Define resolver-path quarantine operationally
Quarantine means an affected path is not accepted as a source of canonical evidence until it passes exit tests. It may be bypassed, marked unhealthy or removed from a routing pool under authorised controls. It is not an instruction to attack, block or manipulate infrastructure the operator does not control.
The quarantine record should name the path, reason, start time, owner, user alternative, monitoring, data preserved and exit criteria. Keep the persistent identifier and provenance visible so users understand that delivery, not identity stewardship itself, is under repair.
CHAPTER 7 OF 12
7. Maintain a verified access route during containment
A remote-sensing product may be operationally important. Provide a verified alternate landing or repository route when policy allows, and state its version and validity window. Do not invent a sibling URL or point users to an unverified mirror merely to avoid downtime.
Check that the alternate route preserves product identity and citation guidance. If content negotiation and browser resolution use different paths, test both; a metadata representation can be healthy while the human landing page is wrong.
CHAPTER 8 OF 12
8. Trace the resolver path without claiming false independence
Map registry target, public resolver, CDN or proxy, origin redirect and landing deployment. Two test tools can share the same resolver or network, so document the path rather than labelling it independent by brand.
RFC 9111 distinguishes freshness, age, validation and invalidation. Expiry makes a stored response stale; it does not necessarily delete it. Capture cache-control fields and validators, then interpret them with the actual request conditions and shared versus private cache behaviour.
| Layer | Evidence | Required distinction |
|---|---|---|
| Registry | Target and provenance activity | Intent versus public delivery |
| Resolver | Full redirect chain | Global versus path-specific |
| Cache | Age, freshness, validators | Expiry versus validation/invalidation |
| Landing page | Identity fields | Availability versus correct product |
CHAPTER 9 OF 12
9. Raise the standard for second closure
Second closure should explain the recurrence mechanism or clearly bound the remaining uncertainty. Require persistent registry agreement, affected path beyond the relevant freshness event, correct identity on that path, a genuinely different path, and repeated observations across a declared window.
Include the quarantine exit test, user-impact review, monitoring change and sign-off. A single green retest after a purge is weak evidence because it does not show that the underlying path remains correct after ordinary cache behaviour resumes.
CHAPTER 10 OF 12
10. Test reintegration before removing quarantine
Return the repaired path in a controlled way. Verify redirect chain, cache headers, landing identity and content negotiation where relevant. Observe long enough to cover the condition that triggered recurrence, such as a cache refresh, deployment cycle or regional propagation.
If the path fails, keep the same incident open and update the evidence. Do not manufacture a third incident merely because a repair attempt failed. Preserve each attempt and configuration version.
CHAPTER 11 OF 12
11. Limits, misconceptions and changed-context transfer
A correct registry readback cannot prove every path is correct, and a clean browser test cannot prove provenance is intact. Quarantine is a reversible containment state, not proof of malicious behaviour or permission to interfere with third-party systems.
Transfer check: move from DOI browser resolution to an API metadata endpoint behind a CDN. The layers remain useful, but cache keys, authentication, content negotiation and stale-serving rules change. Rebuild the evidence matrix rather than copying one TTL.
Should the DOI or persistent identifier be changed when one path recurs?
Usually the incident concerns delivery around the identifier, not a need to mint a replacement. Preserve the identifier and repair or quarantine the affected path unless the responsible authority determines otherwise.
What is stronger about a second closure?
It covers the recurrence mechanism or uncertainty, passes the affected and an independent path over time, proves landing-page identity, exits quarantine safely and updates monitoring so the same blind spot is less likely.
CHAPTER 12 OF 12
12. Evidence route and connected reading
RFC 9111 defines HTTP cache freshness, age, validation and invalidation. DataCite’s metadata-provenance guide explains record activities, timestamps, responsible accounts and changes—useful for separating registry history from resolver behaviour.
Continue through post-rollback reconciliation and closure tests, then the immediate recurrence-monitoring guide. The Remote Sensing root connects the wider subject.
Contents · Previous chapter · Return to the Remote Sensing root