A runbook answers “what do I do now?” during an incident: which command to run, what to check, who to call. It changes whenever the operation changes.