One incident, not forty

Every failure produces a signature — what broke, on which machine, in what way. That signature is fingerprinted, and a second failure with the same fingerprint attaches to the existing incident instead of opening a new one. This is why a rack losing power produces one incident rather than one per service.

Flap suppression handles the opposite problem. A machine that recovers and fails repeatedly would otherwise generate an incident per cycle. Inside a five-minute window, repeated flips are held rather than paged — and if the flapping continues, that itself becomes the incident, because a service bouncing every thirty seconds is broken even though it is technically up half the time.

Nothing is discarded to achieve this. Every occurrence is recorded against the incident with its own timestamp. You are woken once, and you still get all forty pieces of evidence when you look.