Describe a situation where you had to investigate a production incident impacting many users. How did you lead the response, communicate status, and prevent recurrence?