Every incident filed by the probe in the past 90 days, with start time, recovery time, and editorial annotation.
The full 90-day incident archive is on the homepage incidents panel. The log is generated from the probe history rather than written by hand, so what sits at the top depends on when you read it. Recent recovered incidents include a 4h12m vendor dashboard PGP queue backup, a zero-downtime mirror rotation, and a 26-minute layer-7 flood on the headline mirror.
Incident classification follows three states: investigating (state-change observed, root cause not identified), resolved (root cause identified, mitigation deployed, normal state restored), and maintenance (planned change with advance signed advisory). The incident log is reproducible from the public probe history.
Investigating means a change was observed and the cause is not yet identified. Resolved means a cause was identified and normal operation restored. Maintenance means a planned change announced in advance. Anything not in one of those three is not an incident.
A mirror flipping state for a few minutes and returning. Relays go offline and get restarted constantly, and treating each ripple as an event would fill the log with noise and make the real entries invisible.
A layer seven flood against one address, which is cheap to run and is the reason more than one address exists. These resolve within hours and the practical effect is that one mirror gets slow while the others carry on.
An address being retired and replaced is routine and gets announced in advance where possible. It is worth reading, because a saved bookmark eventually goes stale and the moment somebody goes hunting for a replacement is the moment a copied page gets them.
Component states, the 90 day uptime history and the incident log live on the status dashboard. This page covers one question in depth rather than repeating the board.