Built a RAG system that gives incident response actual memory — here's what worked