why not change that so that a “host down” followed by “downtime start” also cancels the incident creation :)?