SEV-2 Protocols: Incident Response for the Self

Treat spirals like outages and you stop shipping chaos.

You already know “incident response” for servers: detect, triage, contain, recover, postmortem. Cool. Do the same thing for your nervous system. Because when life DDoS’s you at 2:17 AM, you don’t need “vibes”—you need a runbook.

This is not therapy cosplay. It’s an operational ritual for humans who ship.

The Model (keep it stupid-simple)

SEV levels

SEV-1: “I might torch something important.” (relationships, job, health)

SEV-2: “Spiraling, can’t focus, making weird choices.”

SEV-3: “I’m off baseline, but functional.”

SLOs for a human

MTTA (Mean Time to Acknowledge): < 5 minutes from trigger to paging yourself.

MTTR (Mean Time to Regulate): back to safe operating range in ≤ 60 minutes.

Error budget: 0 tweets while SEV-1/2. No decisions that change your next 90 days.

Change freeze: During an incident, stop adding new “fixes.” No new supplements, no new frameworks, no revenge emails. Contain first.

The Pager (how you detect)

Pick 3 alarm types you can’t ignore:

Physio: heart rate > baseline +20 for 5+ minutes, shallow breathing, clenched jaw.

Behavioral: tab-surfing, DM drafting, doom-scrolling, snack-spiral.

Cognitive: replay loop, catastrophizing, “Everyone is wrong and I must correct them.”

When any two fire, you’re paged. Don’t negotiate with yourself. SEV-1/2? Page.

The Runbook (what you actually do)

0) Page → Acknowledge (MTTA < 5 min)

Out loud: “SEV-2. I’m the adult on call. We’re safe; it just feels bad.”
Start a 60-minute timer. Put your phone into Airplane + Wi-Fi ON (music allowed, internet not).

1) Triage (3 minutes, no heroics)

Am I safe? If not, get to safe. Done.

What’s the blast radius if I do nothing for 60 minutes? If “massive,” truncate this runbook to 10 minutes then call a human.

2) Contain (10–15 minutes)

The goal is boring: reduce inputs.

Box breathing 4-4-6-2 × 6 cycles (takes ~2 minutes).

Temperature reset: cold water on wrists/face 60 seconds.

Floor the vagus: hum a stupid song for one full minute. (Yes, really. Vibration cheats.)

Move: 7-minute walk; eyes on horizon; no phone.

This is not spiritual. It’s a firmware patch.

3) Stabilize (15–30 minutes)

Pick one:

Write-dump: 1 page: “What happened / What I fear / What I can do in 24h.”

Single-task: 20-minute easy win (dishes, inbox to zero, tiny PR).

Body fuel: water + salt + protein. Half your meltdowns are electrolytes in cosplay.

4) Communicate (under-share, over-signal)

Status: “I’m handling a SEV.”

Ask: “Need 90 minutes; I’ll update at :45 past.”

Do not explain. Explanations breed tickets.

5) Recover & Close

When you’re back inside the rails: close the incident in one sentence:

“Cause: sleep deficit + confrontation. Fixed: offloaded decision, food, walk.”

If you can’t summarize, you’re not done.

The Forensics (when you’re calm)

Five Whys without self-hate. Keep asking “why” until you hit something you can change next time: environment, timing, diet, boundaries, the meeting you keep attending that steals your soul.

Artifacts to capture:

Trigger stack: last 24h inputs (people, foods, headlines, caffeine, deadlines).

First dumb impulse: what Future-You would veto. (This is gold for prevention.)

One constraint: what you’ll remove from your surface area tomorrow.

This becomes your playbook catalog.

Drills (so the system works under load)

10-minute SEV-2 rehearsal once a week: start the timer, run the steps, close it.

Cold-start drill: try it half asleep at 7 AM Sunday. Reality hates warm-ups.

Buddy page: exchange “SEV” emojis with one trusted person; they ping “Status?”; you reply with the timer screenshot. Not therapy. Just SRE-style guardrails.

Tooling (you already have it)

SIEM for humans: calendar + notes. Your “logs” are time blocks and one-line journal entries.

Status page: a pinned note with “I’m handling a SEV. Back by :45.”

Change management: a literal sticky note: “No new fixes during incident.”

Receipt stamp: when you write the postmortem, proof-stamp it (yes, publicly). Accountability beats memory.

The Pocket Card (print or paste)

INCIDENT RESPONSE – SELF (V1)
SEV: 1 [ ]  2 [ ]  3 [ ]     Start: ____  ETA: :45 past

0 ACK: “I’m the adult on call. We’re safe.”
1 TRIAGE: Safe? [ ]  Blast radius if I do nothing for 60m:  low / med / high
2 CONTAIN:
   - breathe 4-4-6-2 x6 [ ]  - cold water 60s [ ]
   - hum 60s [ ]            - walk 7m [ ]
3 STABILIZE (pick one):
   - write 1 page [ ]  - one 20m task [ ]  - water+salt+protein [ ]
4 COMMUNICATE: “Handling a SEV. Update at ____.” [ ]
5 CLOSE (one line):
   Cause: __________________  Fix: __________________  Next: _____________

Tape it to your monitor. The best runbook is the one your future feral self can follow without thinking.

FAQ nobody asked but you’re thinking

“Isn’t this overkill?”
Not compared to the damage a live, uncontained SEV does in 20 minutes.

“What if I don’t have 60 minutes?”
Run Contain 5 minutes, Stabilize 10 minutes, then go. 15 beats 0.

“What if the cause is ‘life is bad’?”
Then stop doing incidents alone. The playbook includes “call a human.” Use it.

Do this today (not tomorrow)

Put the pocket card somewhere you’ll actually look.

Decide your pager (which two alarms mean SEV).

Run one drill tonight. Don’t wait for a “real” incident to learn your tool.

You’re not a monk. You’re a production system with a personality. Treat yourself like one, and you’ll stop shipping outages to people you care about.