When a closed alert reopens (condition still present, no active cooldown), keep firstSeen and comments intact. The alert is the same incident continuing — closing and reopening should not erase history. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>