ARC LIGHT / INCIDENT 17 / SEV-1

17 minutes.

A silent configuration fallback disconnected 31 sites. The incident was short; the ambiguity that enabled it was not.

Fallback activates

A missing regional key resolves to an empty route instead of failing closed.

Operators see drift

Device health stays green while command acknowledgements stop.

Route restored

The previous configuration is promoted and acknowledgements recover.

REMOVE

Empty-route fallback.

ADD

Acknowledgement SLO.

PROVE

Regional failover drill.

Open the prevention check

The durable check is ownership: the recovery path now has a named owner, a tested alert, and a scheduled review.

Demonstration content