Incident library
Reliability postmortems

Streaming incidents,
caught before they spread.

The empirical record of primetime streaming incidents that Streamwake reliability agents caught from viewer-impact telemetry, ranked against every comparable hypothesis, and remediated — with the agentic-act split (autonomous vs surfaced to humans) tagged on every row of the timeline. Pick the incident your stream most resembles.

Book a technical demo for Incident postmortems

Lead magnet
Incident postmortems

Read the postmortem — then bring your own incident to Streamwake.

Two ways to engage on this exact failure pattern: book a 30-minute technical demo where we walk through the probe cascade on your source, or hand us an archived incident and watch the agent diagnose it end-to-end.

Both routes land on the scoping intake form — no SDR gate.

Postmortems

Pick the incident that matches your stream.

Each entry is a self-contained reference: viewer impact, ranked hypotheses with confidence, a six-event timeline tagged with the agentic-act split, the probe envelopes on the failing path, and the recommended fix.

Live
DRM license-server cold-start
Weekday primetime license fetch stall
How a 9% viewer-impact, six-minute license-fetch stall during a weekday primetime spike was caught from viewer-impact telemetry, ranked as a license-server cold-start at high confidence, and remediated with a pre-warm plus entitlement-cache TTL bump — including which acts the Streamwake agent did autonomously vs. surfaced to humans.
ProtocolWidevine · FairPlay · PlayReady · keyserver
  • How Streamwake classified the incident — top hypothesis license_server_cold_start at 91%
  • Six-event timeline with the agentic-act split (autonomous vs surfaced to humans) tagged on every row
  • Anatomy of a license-fetch envelope on the cold cache — what the probe actually reads
  • Recommended fix — pre-warm the encryption-key certificate cache + raise entitlement-cache TTL
Read the postmortem
Live
ISP congestion vs CDN failure
eu-west residential peeer buffer-pressure event
Synthetic postmortem on the regression that looks like an ISP problem but is a CDN problem (and the reverse). Same player-visible symptom, two fix branches — and the Streamwake probe pattern that picks the branch in under a minute.
ProtocolISP · CDN · edge
  • How Streamwake classifies the incident (top hypothesis + secondary signal lane)
  • Triage path per symptom — the probe pattern that disambiguates ISP vs CDN
  • Operator fix per branch — which side of the runbook you act on
  • Six-event timeline with the agentic-act split tagged on every row
Read the postmortem
Drafting
Live-sports buffering
eu-west saturday primetime cohort buffer spike
Draft postmortem — a coordinate-scale spike of buffer events across the eu-west cohort during a Saturday primetime football fixture, ranked against CDN-side, ISP-side, and player-side hypotheses, with the Streamwake agent’s cohort rebalance as the primary autonomous mitigation.
ProtocolHLS · LL-HLS · DRM
  • How Streamwake classified the incident — three ranked hypotheses with confidence
  • Six-event timeline with the agentic-act split tagged on every row
  • Anatomy of a buffering report envelope — what the probe actually reads
  • Recommended fix — manifest cadence + prewarmed variants + edge.POP rebalance
Ships with the next postmortem release
Drafting
Startup delay
cross-platform player-startup stall on new release
Draft postmortem — a cross-platform player-startup stall that surfaced the morning after a player release, with the network / init / decode lanes each contributing a candidate signal and the Streamwake agent isolating the failing lane from player telemetry rather than edge probes.
ProtocolManifest · MSE · EME
  • How Streamwake classified the incident — three ranked hypotheses with confidence
  • Six-event timeline with the agentic-act split tagged on every row
  • Anatomy of a startup-timeline envelope — which lane fails first
  • Recommended fix — rollback the player release + retune the ABR ladder
Ships with the next postmortem release
Live
HLS/DASH manifest drift
weekday primetime live packager mid-window drift
How an ~11% cohort parse-stall (~8 minute mid-window EXT-X-MEDIA-SEQUENCE drift on a weekday primetime live HLS lane) was caught from viewer-impact telemetry, ranked as manifest_packager_segment_drift at high confidence (with the discontinuity_injection_stitcher and vod_manifest_dropping_cues lanes ruled out), and remediated with a snapshot+reread plus a reissued-packager split — including which acts the Streamwake agent did autonomously vs. surfaced to humans.
ProtocolHLS · DASH · manifest · packager
  • How Streamwake classified the incident — top hypothesis manifest_packager_segment_drift at 89%
  • Ten-event timeline with the agentic-act split (autonomous vs surfaced to humans) tagged on every row
  • Anatomy of a manifest-drift probe packet on the drift window — what the probe actually reads
  • Recommended fix — snapshot+reread from a clean source window + tighten the mid-window anchor guardrail
Read the postmortem
Live
Encoder ABR bitrate overshoot
weekday primetime panel ABR ladder switchover overshoot
How a 14% buffer-cliff cohort, ~9 minute encoder mid-window CBR overshoot during a weekday primetime panel-show ladder switchover was caught from viewer-impact telemetry, ranked as encoder_abr_switchover_overshoot at high confidence (with the CDN-egress budget lane ruled out), and remediated with a switchover-window retune plus an egress-budget tolerance bump — including which acts the Streamwake agent did autonomously vs. surfaced to humans.
ProtocolHLS · ABR · encoder · packaging
  • How Streamwake classified the incident — top hypothesis encoder_abr_switchover_overshoot at 87%
  • Ten-event timeline with the agentic-act split (autonomous vs surfaced to humans) tagged on every row
  • Anatomy of an encoder-manifest excerpt on the mid-window overshoot — what the probe actually reads
  • Recommended fix — retune the ladder-switchover window + raise the egress-budget tolerance
Read the postmortem
Live
SCTE-35 ad-marker loss
weekday primetime stitcher splice cue drop
How a ~22% cue-coverage collapse (~13 minute stitcher cue-drop across the cdn-A→cdn-E seam on a Friday primetime) was caught from manifest + cue-coverage telemetry, ranked as stitcher_cue_filter_overshoot at high confidence (with the vod_manifest_missing_cue and scte35_signal_replay_normal lanes ruled out), and remediated with a split live/VOD cue-pass policy plus a raised vod.cue_point_coverage probe — including which acts the Streamwake agent did autonomously vs. surfaced to humans.
ProtocolSCTE-35 · splice_insert · HLS · SSAI/DSA · stitcher
  • How Streamwake classified the incident — top hypothesis stitcher_cue_filter_overshoot at 89%
  • Ten-event timeline with the agentic-act split (autonomous vs surfaced to humans) tagged on every row
  • Anatomy of a 12-line splice_insert cue excerpt across the cdn-A→cdn-E stitch seam — what the probe actually reads
  • Recommended fix — split the stitcher cue-pass policy live vs VOD + raise the vod.cue_point_coverage probe
Read the postmortem
Live
CMAF low-latency edge cache warm-up
weekday primetime LL-HLS / CMAF partial-segment cache warmup
Synthetic postmortem on how a weekday primetime LL-HLS / CMAF event saw a ~9% startup-fallback cohort (~9 minute partial-segment cache warm-up crescendo on cdn-A/atl01) when newly activated edge POPs primed the segment bucket only — manifests 200, segment leg green, but partial-segment fetches on the affected regional cohort ran wider than PART-HOLD-BACK. Streamwake caught it from viewer-impact telemetry, ranked it as edge_partial_segment_warmup at 84% confidence (with isp and encoder partial-fault lanes ruled out), and remediated with a partial-segment prewarm + cache-tail-pin rebalance — including which acts the Streamwake agent did autonomously vs. surfaced to humans.
ProtocolLL-HLS · CMAF · partial-segment · PART-HOLD-BACK · CDN · edge cache
  • Synthetic-incident disclosure — verbatim reminder prominently in the hero and CTA
  • How Streamwake classified the incident — top hypothesis edge_partial_segment_warmup at 84%
  • Ten-event timeline with the agentic-act split (autonomous vs surfaced to humans) tagged on every row
  • Anatomy of a CMAF warmup probe packet on the LL-HLS delta update — what the probe actually reads
  • Timing window — Detection / Classify / Mitigate / Recover all on the same 90s cadence
  • Recommended fix — prewarm the partial-segment bucket + pin the cache tail to PART-HOLD-BACK + lift the prewarm into the pre-peak script
Read the postmortem
Live
Encoder firmware regression / GOP drift
weekday primetime HLS / Encrypted-CMAF live-encoder GOP cadence / firmware cohort
Synthetic postmortem on how a weekday primetime live encoder saw a ~8% startup-join-stall cohort (~7 minute I-frame-cadence crescendo on the encoder firmware cohort) when a firmware upload the night before widened GOP cadence to 2.14s (vs 1.01s baseline) and I-frame alignment drifted past the 33ms cohort cadence tolerance. Streamwake caught it from viewer-impact telemetry, ranked it as encoder_firmware_gop_cadence_regression at 88% confidence (with cdn_egress_budget and abr_ladder_switchover lanes ruled out), and remediated with a live-encoder firmware rollback + cohort pin-and-quarantine — including which acts the Streamwake agent did autonomously vs. surfaced to humans.
ProtocolHLS · Encrypted-CMAF · GOP · I-frame · encoder · firmware cohort · init · segment.064
  • Synthetic-incident disclosure — verbatim reminder prominently in the hero and CTA
  • How Streamwake classified the incident — top hypothesis encoder_firmware_gop_cadence_regression at 88%
  • Ten-event timeline with the agentic-act split (autonomous vs surfaced to humans) tagged on every row
  • Anatomy of a firmware-regression probe packet on the firmware cohort — what the probe actually reads
  • Timing window — Detection / Classify / Mitigate / Recover all on the same 90s cadence
  • Recommended fix — pin the firmware cohort to 4.7.1-r12 + quarantine the 4.7.2-r3 upload window + lift the pin into the pre-peak script
Read the postmortem
Live
Origin shield queue saturation
weekday primetime live-event viewer spike — marquee shield tier
Synthetic postmortem on how a weekday primetime marquee live-event spike (sports final or keynote) fanned concurrent viewer connection demand into the CDN origin-shield queue past its pre-provisioned ceiling — late-join cohort divergence, sustained reconnect storm, shield queue p99 climbing past the slot budget while edge egress stayed green and the segment leg returned cache hits. Streamwake caught it from viewer-impact telemetry, ranked it as origin_shield_queue_saturation at 86% confidence (with edge_pop_cache_miss_amplification and encoder_bandwidth_regression lanes ruled out), and remediated with either a shield pull / ceiling expansion (autonomous under a confidence-and-cohort-divergence gate) or a viewer-side reconnect-throttle (surfaced to humans) — with recovery verified viewer-side, not queue-side.
ProtocolHLS · CMAF · CDN origin-shield · replay-origin · queue concurrency · cohort reconnect
  • Synthetic-incident disclosure — verbatim reminder prominently in the hero and CTA
  • How Streamwake classified the incident — top hypothesis origin_shield_queue_saturation at 86%
  • Ten-event timeline with the agentic-act split (autonomous vs surfaced to humans) tagged on every row
  • Anatomy of a shield-queue-saturation probe packet on the marquee shield tier — what the probe actually reads
  • Timing window — Detection / Classify / Mitigate / Recover all on the same 90s cadence
  • Recommended fix — pull / expand the shield tier (autonomous) + throttle reconnect storms (surfaced to humans) + verify recovery viewer-side, NOT queue-side
Read the postmortem
Live
ISP congestion vs CDN failure — recovery criteria
eu-west residential ISP-side last-mile cohort · 3 AS blocks lifting at once
Synthetic postmortem on how an eu-west residential / ISP-side congestion event the player reports as a CDN failure is disambiguated by cache.freshness + cache.availability + edge.geo_drift + multicdn.winner_RTT (all four pass — CDN leg is healthy at zero egress change) while isp.peer_congestion + isp.last_mile_rtt + tcp.retransmit_rate fail on three AS blocks at once (as3356 / as5511 / as1299). Streamwake caught it from viewer-impact telemetry, ranked it as isp_congestion · dominant at 83% confidence (with cdn_failure · ruled out by name on the cache.availability + cache.freshness + multicdn.winner_RTT discriminator and transit_or_peering_failure as the alternate), and remediated with a prewarmed low-bitrate variant + ISP-side reprobe (autonomous under a confidence-and-cohort-divergence gate) and a peering-provider ticket on the affected AS block (surfaced to humans) — with recovery verified cohort-side on cohort_join_stall_ratio + cohort_rebuffer_ratio + last_mile_rtt, NOT on the cache leg turning green again.
ProtocolHLS · CMAF · isp.peer_congestion · isp.last_mile_rtt · tcp.retransmit_rate · cache.freshness · cache.availability · edge.geo_drift · multicdn.winner_RTT · cohort_join_stall_ratio · cohort_rebuffer_ratio · cohort_startup_time_p95_ms
  • Synthetic-incident disclosure — verbatim reminder prominently in the hero and CTA
  • How Streamwake classified the incident — top hypothesis isp_congestion · dominant at 83% with cdn_failure · ruled out by name on the cache.availability + cache.freshness + multicdn.winner_RTT discriminator
  • Recovery criteria section — cohort-side + last-mile close-out signals (cohort_join_stall_ratio + cohort_rebuffer_ratio + isp.last_mile_rtt) with explicit "NOT close-out signal" on cache.availability / cache.freshness / multicdn.winner_RTT (the cache leg was green the entire window)
  • What-Streamwake-would-have-done walkthrough — Detect → Classify → Governed Fix on this incident: ISP-side + cache-side lockstep probe fan-in, isp_congestion · dominant at 0.83, and the surface_peering_provider_ticket + raise_cdn_egress_tolerance_to_rebuffer_tolerance two-arm lane
  • Ten-event timeline with the agentic-act split (autonomous vs surfaced to humans) tagged on every row
  • Anatomy of an ISP-side probe packet on the eu-west residential cohort — what the probe actually reads
  • Timing window — Detection / Classify / Mitigate / Recover all on the same 90s cadence
  • Recommended fix — file a peering-provider ticket on the affected AS block (surfaced to humans) + raise CDN egress tolerance vs the per-segment rebuffer pattern (autonomous) + verify recovery cohort-side + last-mile, NOT cache-side
Read the postmortem