Intervention commands

The sixteen commands that change the world, what each one does, and what it costs.

Last updated: 2026-09-12

Interventions change the world. Most are free, five move money, and several take time to take effect. This page describes what each one does — matching them to incidents is the part of the game worth keeping.

The table

Command	Effect	Cost
`kill <pid>`	Terminate a process by PID	—
`kill_query <id>`	Terminate a database query by id	—
`restart <host\|service>`	Restart a host or service; 10–30s of downtime	—
`block_ip <ip\|cidr>`	Drop traffic from an address or CIDR block at the firewall	—
`unblock_ip <ip>`	Lift a firewall block	—
`enable_ratelimit`	Turn rate limiting on; trims 10% of legitimate traffic too	—
`disable_ratelimit`	Turn rate limiting back off	—
`scale_up <role>`	Add a server to a role; ready in 30s	$100
`scale_down <role>`	Remove a server from a role	+$40
`drain <host>`	Move traffic off a host without stopping it	—
`undrain <host>`	Put a drained host back in the pool	—
`clean_logs <host>`	Free disk space by rotating and deleting old logs	—
`expand_disk <host>`	Grow a host's disk permanently	$50
`fix_cooling <host>`	Repair the cooling on a host	$75
`renew_cert`	Renew the TLS certificate; takes 10s	$20
`disable_cron <name>`	Disable a scheduled job so it stops firing	—

Reversible versus structural

The free commands are mostly reversible, and the paid ones are mostly permanent. That is the shape of the economy: you can experiment cheaply with things you can undo, and you pay for changes that raise a ceiling.

unblock_ip exists specifically so a false positive is recoverable — blocking the wrong address is a mistake you can walk back. Rate limiting can be turned off again, and a drained host can be returned to the pool. Growing a disk or repairing cooling cannot be undone, and should not need to be.

Things that do not happen instantly

Command	Delay
`scale_up`	30 seconds before the new server serves traffic
`restart`	10–30 seconds of downtime on the target
`renew_cert`	10 seconds before the certificate is live

Costs that are not money

enable_ratelimit trims 10% of legitimate traffic along with the rest, so it is never free even though it costs nothing. restart buys a clean state with guaranteed downtime. drain moves load somewhere else, which means somewhere else now carries it.

A wrong intervention costs 10 score points, and any money it spent is gone whether it helped or not. The two penalties compound quietly across a night — which is the argument for running a diagnostic first, every time.