How incidents open

The desk watches live items — degraded airports, diversions, cancellations, scored headlines, forecast cones, SIGMETs. When one of the rules below fires at severity 5 or above, the desk opens an incident at once, graded by severity and by the legs of a trip it affects (air, hotel, rail, ground). A person closes a false positive from the alert email or on the incident page; a story closed once is never re-opened by the same rule.

Ruleset desk_rules v2 · 10 rules · read live from desk-api

1. diversion hub v1
   A flight diverted to or from a tier-1/2 airport (story board, latest 3 h) → incident, one per flight per day.
2. mass cancellations v1
   ≥ 25 cancellations on a tier-1/2 airport's latest story board, or ≥ 30 % of ≥ 20 departures cancelled on the sweep → incident, one per airport per day.
3. airport closure v1
   Tier-1/2 airport with sweep status stopped (FAA ground stop) or closed, or ≥ 80 % of ≥ 10 departures cancelled, or a layer-1 headline (sev ≥ 7) reporting an airport/airspace closure.
4. airport attack v1
   Layer-1 story (sev ≥ 7) whose headline reports an attack, strike, blast or drone/missile on an airport, airfield, terminal or airspace.
5. security incident v1
   Layer-1 story (sev ≥ 7) reporting an attack, bombing, shooting, hostage-taking, riot or coup at a traveller location — hotel, resort, train/metro/bus station, city centre, old town, tourist district, embassy, shopping centre (airport attacks have their own rule; a bare "capital" or "downtown" does not count) → incident, domain geopolitical.
6. cyclone cone v1
   An NHC/CPHC forecast cone covers a tier-1/2 airport and a forecast position within 72 h lies within 250 km of it → incident, one per storm per airport (source: hub /api/gev-weather?layer=cyclones; Atlantic + East/Central Pacific only).
7. sigmet hub v2
   A SIGMET for volcanic ash (VA) or a tropical cyclone (TC) whose polygon covers a tier-1/2 airport → incident; any other SIGMET marked SEV (severe turbulence/icing) only where flights show it (misery ≥ 20 or ≥ 25 % of flights ±1 h late or cancelled). One per hazard per airport per day (source: hub /api/gev-weather?layer=hazards).
8. hazard near hub v1
   A layer-1 hazard story (seismic, disaster, weather) at severity ≥ 6 whose coordinates lie within 150 km of a tier-1/2 airport → incident, one per story. Coordinates come from the signal's metadata (desk_items v4).
9. rail disruption v1
   European rail: an unplanned operator notice (not a recovery or crowding advisory) at severity ≥ 6 on the hub's rail layer (SNCB/NMBS via iRail today; other operators not wired), or a layer-1 headline in Europe at severity ≥ 6 about a strike, derailment, suspension, closure or collision on rail, metro or tram.
10. airspace closure v1
    A country or FIR airspace zone whose operational_state is 'closed' on the hub's aviation layer (safeairspace + FAA) → incident, one per zone per day. Standing advisories (do_not_fly, avoid) are postures, not incidents, and do not propose.

Closures outside the US are inferred from flights and news — there is no NOTAM feed behind this. Severity follows the canonical scale (SEV1 ≥ 9, SEV2 ≥ 7, SEV3 ≥ 5). Every incident the desk opens records which rule fired and on what facts.