What broke

The station runs its agents under one supervisor, and every agent step is a call to a rented model provider. On 2026-10-17 at 06:00:58 UTC that provider began refusing every call, so every agent on the station stopped working. The failure surfaced as a credential error, which sent the operator looking at the wrong thing for hours.

A monitoring script was already in place for the credential. It reads the provider's session record and the station's telemetry sink, and when it finds a sign-in failure inside its look-back window it calls the operator's phone and files a work item on the station's queue, so the page survives as a durable record even if the message does not arrive.

That script fired. At 08:04:31 local time, three minutes and thirty-three seconds after the first refusal, it wrote a line naming the failure it had found in the sink, and sent a message. The same run filed a queue item at 06:04:32 UTC, which was claimed four hours later.

The incident report published after the outage said the probe "did not fire", and that the station "told nobody". Both were read off the phone's message history, which held nothing. The station could not contradict that, because the script's send function discarded the messaging service's answer. A page that was accepted and a page that was refused left the same trace: a log line about the failure, and silence about the outcome.

The same report quoted a second time wrongly, in the opposite direction. The monitoring script stops paging when no configured session still uses that provider, and prints one line every five minutes while it is quiet. The first such line is stamped 12:14:54+0200, which is 10:14:54 UTC. The report printed the local wall-clock as if it were UTC, then converted it to local again, and said the quiet had begun at 14:15. The log carried the offset; the prose dropped it.

How it showed

The evidence that the probe fired was in the record the whole time, in two places, and neither was the phone:

2026-10-17T08:04:31+0200 authentication_failed telemetry seen (received=1792216811) 2026-10-17T08:09:32+0200 authentication_failed telemetry seen (received=1792216811)

The log names the failure and the timestamp of the record it read. The queue item filed by the same run carries the key check-hyper-auth-1792217071, was created at 06:04:32Z and claimed at 10:13, and names the message that was sent: "harness hyper OAuth refresh failed". Whether the messaging service delivered it is absent from both, because the send call's answer was written to a discarded stream.

The clock error is visible in the same file, one line apart from the evidence:

2026-10-17T12:14:54+0200 hyper OAuth access token lapsed 2295s ago and no configured session selects hyper; not paging

Read as UTC, that line is the 14:15 the report quoted. Read as written, it is 10:15 UTC, two hours earlier. The lapsed-seconds figure in the same line, 2295, agrees with the written stamp and not with the misreading.

What was watching

The monitoring script was present, fired, and was the only thing on the path that did. Its two log lines are the record that survives.

Nothing watched the page. The send function called the messaging service, discarded the response and ignored the exit status, so no branch of the probe could tell an accepted message from a refused one. The queue item filed in the same run is durable and is not a delivery receipt: it proves the script reached its page branch, not that a phone received anything.

Nothing watched the report's arithmetic. The log's stamps carry an explicit offset, and no step between the log and the published sentence preserved it. The person writing the report was the sensor for that error, ten hours later, while assembling the correction.

Observability events were present on the detection path and absent from the delivery path: the probe can say what it saw, and cannot say what it did.

Where it sits

This is a comprehension failure over a runtime gap.

The family is runtime because the defect is in the path an alert takes out of the station, which ends in a call whose result is thrown away. It is comprehension because the published account of that path was built from the one record that is not authoritative, the phone, when the station's own records contradicted it.

Synthetic monitoring was present and did its work; this case is not about a monitor that failed to notice. Decision provenance was absent: the station recorded that it decided to page and not what came of it. That is the gap that let a correct page be written up as no page.

No sensor in the framework covers a quoted timestamp losing its offset between a log line and a sentence. The only thing that catches it is a reader who carries the offset through, which is what happened, late.

What we did

The incident report was corrected where it was wrong, with the measurement and the queue item named, and the corrected quiet window stated in UTC with its local time beside it.

The probe now keeps the answer. Its send function captures the response body and writes one line either way: accepted, with the message id the service returned, or not delivered, with the service's own refusal text. A missing credential file is logged as "page NOT sent: no bot token" rather than vanishing.

This is a file on the station, not a repository change, so it is not reviewed by anyone: the station's probes are launchd jobs read at each run, and there is no history of what a probe could say last month.

What now fails loudly

The receipt, and it was watched on both branches before it was left in place. Against a local stand-in for the messaging service, an accepted message logged page delivered, telegram accepted it (message_id=<the id the service returned>); a refusal logged page NOT delivered: {"ok": false, "description": "chat not found"}; and with no credential file, page NOT sent: no bot token. The probe was then run with its dry-run flag set and exits clean, touching neither the page nor the cooldown.

What is not guarded is the reading. A future report that quotes a log line can drop the offset again, and nothing fails when it does. The correction changed a sentence; it did not give the station a way to tell whether a published claim still matches its logs.