voidly
LB 🇱🇧6.5d lead time

Lebanon sat above Sentinel’s alert threshold for the week before the April 24 outage — one honest case

On 2026-04-17 the Voidly Sentinel forecast for Lebanon crossed its 0.05 alert threshold (p ≈ 0.07) and stayed above it; 6.5 days later IODA flagged a critical BGP connectivity drop in North Lebanon. We publish this as an illustrative worked example of the alert mechanism — forecast → threshold cross → citable evidence — NOT as proof of lead-time skill, which the model’s own within-country timing validation puts near chance for a chronically-unstable network like Lebanon.

#sentinel#forecast#shutdown#lebanon#ioda#early-warning
Lead time
6.5d
First crossed
2026-04-17
Incident landed
2026-04-24
Incident ID
LB-2026-0098

The forecast trajectory

0.000.100.20alert threshold 0.05incident2026-04-172026-04-262026-05-05
Source: sentinel.db.sentinel_forecasts — every row is the calibrated 7-day shutdown probability the model emitted at 02:00 UTC that morning. Dashed red line is the live alert threshold; the black vertical line marks the first_seen of the confirmed incident.

On 2026-04-17 at 02:00 UTC, the Voidly Sentinel forecast for Lebanon crossed its alert threshold for the first time in this run: the calibrated next-7-day shutdown probability sat at 0.075, against a threshold of 0.05. Sentinel runs every morning at 02:00 UTC on the production Vultr server. From that morning forward, Lebanon stayed above threshold every single day for the next 28 days — even climbing as high as 0.118 by May 5.

On 2026-04-24 at 12:25 UTC — six and a half days after the second forecast row in the run (2026-04-18) — IODA flagged a critical BGP-level connectivity drop on the North Lebanon regional entity. The drop persisted long enough to publish as incident LB-2026-0098. Voidly Atlas captured the IODA evidence at 18:00 UTC the same day and minted the permanent incident ID. The forecast had been elevated for the whole week prior.

The pattern repeated. The model stayed above threshold; IODA fired again on 2026-04-25 (incident LB-2026-0100), 2026-04-30 (LB-2026-0105), and 2026-05-03 (LB-2026-0108). The forecast was elevated for every one of those events. The model started to come back down to baseline around 2026-05-16 once the recent-shutdown signal aged out of the 30-day window.

What this case does — and does not — show

What it does show is the alert mechanism working end-to-end: a threshold cross on a specific morning, sustained elevation, a real citable IODA event inside the window, and a permanent incident ID anyone can verify. That is the pipeline — forecast → threshold cross → evidence — working as designed.

What it does not show is predictive skill. Lebanon’s internet has been chronically unstable since 2019 and IODA reports outages there several times a month, so a forecast that sits just above a low (0.05) threshold will — by base rate alone — often be “above threshold” when an outage happens to land. The shutdown-risk model’s own validation is blunt about this: its within-country timing (the “when”, as opposed to the cross-country “which country”) is near chance. So treat this as a worked example of how an alert flows to citable evidence — not as a claim that Voidly can time Lebanon’s outages. We would be overclaiming if we did, and the model’s published metrics would catch us.

The honest caveat

Sentinel is not always right. On the same 30-day window that produced this case, the model’s per-country precision in Lebanon was 0.54 (15 true positives / 13 false positives) at recall 1.00. In other words: when the model was elevated for Lebanon, an outage followed roughly half the time — barely better than a coin flip for a country that is near-constantly elevated. Across all 30 watched countries, the rolling-window precision is 0.70 at recall 0.36. We publish the full reliability data at /sentinel/backtest and the live calibration curve at /sentinel/calibration. This case study is one event, not a guarantee — and a single favorable anecdote is exactly the kind of evidence our own honest evals tell you to distrust.

What the model saw (SHAP top features)

These are the three features that pushed the prediction the hardest on this run, ranked by absolute SHAP contribution. Up means the feature raised the predicted probability; down means it pulled it down.

  • recent_shutdown 0.0900

    Whether the country has had a confirmed shutdown in the trailing 30 days. Lebanon’s January 2026 BGP outage cluster (48 critical alerts on 2026-02-12, 46 on 2026-02-11) was the dominant signal.

  • block_rate_roll14_mean 0.0714

    Rolling 14-day mean of country-wide measurement block rate. Low values (this contributed negatively at -0.0714) tell the model the disruption is structural / infrastructure rather than content censorship.

  • block_rate_roll7_mean 0.0607

    7-day rolling block rate, same intuition as above on a shorter window (contributed -0.0607). The Sentinel scorer is also reading the absence of a content-blocking spike to disambiguate shutdown-risk from filtering-risk.

Pulled live from /v1/forecast/LB/7day · field top_features.

Independent corroboration

The confirmed incident

LB-2026-0098

IODA detected a critical-level BGP outage on the North Lebanon regional entity (value 79 vs. history 83) on 2026-04-24 at 12:25 UTC. Published as incident LB-2026-0098.

Raw JSON: /data/incidents/LB-2026-0098