A team restores service after an incident but has not identified the root cause or improved controls. What should follow recovery?

1. Treat recovery time as proof that the same incident cannot recur.
2. Delete all evidence immediately because the application is healthy.
3. Conduct a blameless review, identify control gaps, assign corrective actions, and update runbooks.
4. Disable the detector that generated the incident to reduce future alerts.