When to escalate beyond log grepping
Most defects yield to patient internal work. A smaller set consumes weeks because the failure crosses team boundaries or only appears under load. Recognising the second category early saves calendar time and customer trust.
Hypotheses recycle without new evidence
If your stand-up hears the same three theories on Tuesday and Friday without new traces or experiments, you are looping. External investigators are useful because they arrive without ownership of prior decisions.
More than two subsystems are implicated
When API, worker, and mobile teams each have partial logs, coordination cost dominates. A neutral party who can read all three stacks shortens the relay race.
Reproduction requires production traffic shape
Some bugs need concurrency or dataset size you cannot mimic locally. If staging has been empty for months, internal reproduction may be blocked until someone designs a load scenario—work we often do in the failure lab.
Leadership needs a written account
Board or regulator questions are not satisfied by “we fixed it.” Incident reviews and root-cause reports give you quotable timelines and contributing factors.
Prepare before you call
Gather deploy notes, sample failing requests, and a named technical owner. We do not need a clean narrative—just honesty about what is unknown. That preparation shortens the briefing and keeps sprint fees predictable.