Steps
- List containers and confirm the exact name or ID.
- Collect logs for main-process output.
- Inspect metadata for configuration and state.
- Open a terminal only for a deliberate, documented command.
Verify and recover
Evidence names the inspected container and timestamp. If identity is ambiguous, do not run a command; list again and preserve the workload.