## TL;DR
Fingerprint every alert on its stable attributes and check for an open incident with the same fingerprint before creating. Repeats become work notes on the existing incident instead of new tickets.

## Steps
1. Define the alert fingerprint from stable fields: source, check name, and affected CI.
   Expected: The same outage always produces the same fingerprint.
2. Before creating, search open incidents for the fingerprint.
   Expected: Duplicates are found before creation.
3. On a match, append the new alert as a work note on the existing incident.
   Expected: One incident accumulates all related alerts.
4. Only create a new incident when no open match exists, and store the fingerprint on it.
   Expected: New outages still get fresh tickets.

## When to use
- The agent creates incidents from monitoring alerts
- One outage spawns many tickets
- Alert storms happen during major incidents

## When not to use
- A human triages every alert before ticket creation
- Each alert is genuinely a separate incident
- The monitoring system already dedupes upstream

## Why this happens
Monitoring fires one alert per failing check, and a real outage fails many checks at once. An agent that creates a ticket per alert floods the queue with duplicates, splitting the response across a dozen tickets nobody can coordinate.

## Edge cases
- The fingerprint must exclude timestamps and flap counters or nothing will ever match.
- Resolved incidents should not match; only search open and recently resolved ones.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_K-APqMMCDKfY-rKXiRXdvw