# Operations and troubleshooting

## Monitoring

Probe `/up` for process liveness and `/ready` for database/cache/private-storage
readiness. Alert on HTTP 5xx, latency, queue age/depth, failed jobs, scheduler silence,
database saturation, disk/bucket growth, payment webhook errors, and email failures.
Logs must be centralized, access-controlled, retained, and scrubbed of secrets.

## Common commands

```bash
php artisan about
php artisan migrate:status
php artisan queue:monitor default:100
php artisan queue:failed
php artisan schedule:list
php artisan config:cache
php artisan route:cache
php artisan view:cache
php artisan optimize:clear
```

## Incident response

For a security incident: preserve logs, revoke sessions/credentials, disable affected
integrations, scope affected tenants/records, notify the response owner, and follow
legal notification requirements. Never delete audit or ledger records to conceal an
incident.

For queue failure: fix the underlying dependency, inspect a failed payload without
exposing personal data, then retry selected jobs. For payment mismatch: stop automated
allocation, reconcile provider evidence, and use reversal/refund workflows. For a
stuck CBT attempt: retain events and use the scheduled expiry finalizer.

## Maintenance

Patch monthly or immediately for critical advisories. Rebuild assets and caches after
dependency/config changes. Rotate gateway, SMTP, database, Redis, and storage
credentials on schedule; retain old `APP_KEY` values through `APP_PREVIOUS_KEYS`
during controlled key rotation.