checkout-worker restarts again. Then again. It rises to the top of the 24-hour event ranking, but no monitor is firing and the graph does not identify a root cause. That combination is still useful incident evidence.

Annie Graph can move from the hotspot to an interactive inspection, a bounded timeline, an evidence-backed triage result, and a handoff for the next responder. Each command reports what the graph observed and keeps absent or unresolved evidence visible.

Move from the hotspot to the resource

Start with current activity rather than guessing a target:

$ annie graph top --by resource --since 24h
Top resource hotspots (last 24h)
RANK  NAME                                EVENTS
1     checkout-worker (commerce)          412
2     checkout-api (commerce)             137
3     ledger-consumer (payments)           84

Open the explorer, press /, resolve checkout-worker in the commerce namespace, then inspect its brief or timeline:

$ annie graph explore

graph top identifies where activity is concentrated. The explorer lets the responder decide whether that activity deserves attention after verifying the resource type and namespace.

See the restart sequence

Once the target is stable, request a bounded timeline:

$ annie graph timeline checkout-worker --since 7d
Operational timeline for checkout-worker (last 7d)
Evidence: complete (4 sources)

TIME                  TYPE                          SUMMARY
2026-07-18T06:42:00Z  pod_crash_looping             Container entered a crash loop
2026-07-18T06:43:00Z  pod_restart_count_increased   Restart count increased
2026-07-18T06:45:00Z  pod_restart_count_increased   Restart count increased
... 24 more restart events ...

Evidence summaries
- incident: Correlated incident contains restart and crash-loop events.
- cascade: One bounded propagation step was found.
- deployImpact: No deployment fallout found for the selected target.

timeline combines the event feed with incident, cascade, and deployment-impact evidence. It is assembled at read time from independent queries, so event order and correlation are evidence rather than proof of causation.

Keep observed, absent, and unknown separate

Now build the triage view:

$ annie graph triage checkout-worker --since 7d --namespace commerce
Incident triage for checkout-worker (last 7d)
Evidence: complete (7 sources)
- [symptom/observed] Recent failure events (29)
- [symptom/none] Active Alert/Warn monitors
- [impact/none] Transitive blast radius: 0 workloads and 0 services
- [impact/unknown] Downstream service footprint could not be established
Incident evidence view for checkout-worker separating observed restart and crash-loop signals from absent active alerts and an unknown downstream service footprint.

The result supports four precise statements:

  • Observed: the restart storm and crash-loop signal exist.
  • Absent: no active monitor or correlated deployment fallout was found.
  • Unknown: the selected target did not resolve to a downstream service footprint.
  • Unclaimed: Annie Graph did not identify a confirmed root cause.

A zero graph-resolved blast radius records only that this query did not establish transitive impact from the selected resource; user impact remains unresolved. When a namespace-scoped common-cause query returns shared nodes, workloads, datastores, or external dependencies, Annie labels them suspect/evidence, never “root cause.”

Build the handoff

The next responder needs a smaller view than the complete evidence payload:

$ annie graph brief checkout-worker --since 7d
Operational brief for checkout-worker
Evidence: complete (14 sources)

Now: 0 active alerts; 29 recent events in 7d.
Impact: 0 affected pods; 0 downstream services.
Posture: 4 explicit gaps or risks.

Evidence summaries
- connections: Current graph connections were resolved.
- gitopsOwner: No GitOps application found for the selected workload.
- deployImpact: No deployment fallout found in the selected window.
- serviceTree: No downstream service tree found for this target.

With --output json, the same brief can feed an incident channel, ticket, or handoff script without scraping terminal prose.

Ownership remains deliberately narrow. annie graph owners <hashed-id> follows an observed Argo CD application-to-workload path. An empty result means that path was not present; human or team ownership may still exist elsewhere.

Preserve partial evidence

Composite workflows print evidence completeness and source count before the result. They can still return useful sections when an optional source fails:

{
  "completeness": "partial",
  "sources": ["failures", "alerts", "blastRadius", "serviceTree"],
  "warnings": [
    {
      "section": "commonCause",
      "code": "GRAPH_UNAVAILABLE",
      "message": "The graph source was unavailable"
    }
  ]
}

Required-source failures still return a non-zero CLI error. Optional failures stay beside the evidence that succeeded, so the handoff does not quietly become more confident than the graph.

Use top and explore to select the target, timeline to order the signals, triage to separate fact from inference, and brief to hand off the current picture.

Next in the series: move from hotspot to guardrail with Annie Graph. See the Annie CLI documentation for setup and command details.