Voidly
LB 🇱🇧 / country record

Lebanon sat above Sentinel’s alert threshold for the week before the April 24 outage — one honest case

On 2026-04-17 the Voidly Sentinel forecast for Lebanon crossed its 0.05 alert threshold (p ≈ 0.07) and stayed above it; a week later, on 2026-04-24, IODA flagged a critical BGP connectivity drop in North Lebanon. We publish this as an illustrative worked example of the alert mechanism — forecast → threshold cross → citable evidence — NOT as proof of lead-time skill, which the model’s own within-country timing validation puts near chance for a chronically-unstable network like Lebanon.

#sentinel#forecast#shutdown#lebanon#ioda#early-warning
First threshold crossing17 Apr 2026
Incident observation24 Apr 2026
Elapsed time between timestamps7.43 daysAn interval in this case, not measured forecasting skill.
Incident IDLB-2026-0098 ↗
Historical 7-day forecastLebanon / 2026
0%10%20%2026-04-17: forecast 0.075, threshold 0.052026-04-18: forecast 0.069, threshold 0.052026-04-19: forecast 0.064, threshold 0.052026-04-20: forecast 0.071, threshold 0.052026-04-21: forecast 0.068, threshold 0.052026-04-22: forecast 0.07, threshold 0.052026-04-23: forecast 0.069, threshold 0.052026-04-24: forecast 0.077, threshold 0.052026-04-25: forecast 0.073, threshold 0.052026-04-26: forecast 0.081, threshold 0.052026-04-27: forecast 0.088, threshold 0.052026-04-28: forecast 0.08, threshold 0.052026-04-29: forecast 0.069, threshold 0.052026-04-30: forecast 0.099, threshold 0.052026-05-01: forecast 0.095, threshold 0.052026-05-02: forecast 0.087, threshold 0.052026-05-03: forecast 0.086, threshold 0.052026-05-04: forecast 0.1, threshold 0.052026-05-05: forecast 0.118, threshold 0.05Incident date2026-04-172026-04-262026-05-05
Published forecastThreshold in the published rows

Bundled case-study data, published 2026-05-21. This trajectory is historical; it does not show a current forecast or prove shutdown-onset skill.

Exact daily values & chart source

The published case attributes these rows to sentinel.db.sentinel_forecasts, issued at 02:00 UTC. Values below come from the published case; this page makes no trajectory request. The incident marker uses its calendar date; the exact incident time is 2026-04-24T12:25:00Z.

Complete published trajectory
DateForecast probabilityAlert threshold
2026-04-170.0750.05
2026-04-180.0690.05
2026-04-190.0640.05
2026-04-200.0710.05
2026-04-210.0680.05
2026-04-220.070.05
2026-04-230.0690.05
2026-04-240.0770.05
2026-04-250.0730.05
2026-04-260.0810.05
2026-04-270.0880.05
2026-04-280.080.05
2026-04-290.0690.05
2026-04-300.0990.05
2026-05-010.0950.05
2026-05-020.0870.05
2026-05-030.0860.05
2026-05-040.10.05
2026-05-050.1180.05
Cite this case study

Use the permanent published URL and retain the case’s limitations.

Citation help

Published 2026-05-21

The complete account.

The original narrative below describes the study’s historical run and evaluation window. References to “live,” schedules or current model behavior belong to that publication, not a new operational check.

On 2026-04-17 at 02:00 UTC, the Voidly Sentinel forecast for Lebanon crossed its alert threshold for the first time in this run: the calibrated next-7-day shutdown probability sat at 0.075, against a threshold of 0.05. Sentinel runs every morning at 02:00 UTC on the production Vultr server. From that morning forward, Lebanon stayed above threshold every single day for the next 28 days — even climbing as high as 0.118 by May 5.

On 2026-04-24 at 12:25 UTC — six and a half days after the second forecast row in the run (2026-04-18) — IODA flagged a critical BGP-level connectivity drop on the North Lebanon regional entity. The drop persisted long enough to publish as incident LB-2026-0098. Voidly Atlas captured the IODA evidence at 18:00 UTC the same day and minted the permanent incident ID. The forecast had been elevated for the whole week prior.

The pattern repeated. The model stayed above threshold; IODA fired again on 2026-04-25 (incident LB-2026-0100), 2026-04-30 (LB-2026-0105), and 2026-05-03 (LB-2026-0108). The forecast was elevated for every one of those events. The model started to come back down to baseline around 2026-05-16 once the recent-shutdown signal aged out of the 30-day window.

What this case does — and does not — show

What it does show is the alert mechanism working end-to-end: a threshold cross on a specific morning, sustained elevation, a real citable IODA event inside the window, and a permanent incident ID anyone can verify. That is the pipeline — forecast → threshold cross → evidence — working as designed.

What it does not show is predictive skill. Lebanon’s internet has been chronically unstable since 2019 and IODA reports outages there several times a month, so a forecast that sits just above a low (0.05) threshold will — by base rate alone — often be “above threshold” when an outage happens to land. The shutdown-risk model’s own validation is blunt about this: its within-country timing (the “when”, as opposed to the cross-country “which country”) is near chance. So treat this as a worked example of how an alert flows to citable evidence — not as a claim that Voidly can time Lebanon’s outages. We would be overclaiming if we did, and the model’s published metrics would catch us.

The honest caveat

Sentinel is not always right. On the same 30-day window that produced this case, the model’s per-country precision in Lebanon was 0.54 (15 true positives / 13 false positives) at recall 1.00. In other words: when the model was elevated for Lebanon, an outage followed roughly half the time — barely better than a coin flip for a country that is near-constantly elevated. Across all 30 watched countries, the rolling-window precision is 0.70 at recall 0.36. We publish the full reliability data at /sentinel/backtest and the live calibration curve at /sentinel/calibration. This case study is one event, not a guarantee — and a single favorable anecdote is exactly the kind of evidence our own honest evals tell you to distrust.

Historical model drivers

What moved the score.

SHAP contributions from this published run. Positive raises the score; negative lowers it. A feature contribution is not a causal explanation of the outage.

  • recent_shutdown+0.0900

    Whether the country has had a confirmed shutdown in the trailing 30 days. Lebanon’s January 2026 BGP outage cluster (48 critical alerts on 2026-02-12, 46 on 2026-02-11) was the dominant signal.

  • block_rate_roll14_mean−0.0714

    Rolling 14-day mean of country-wide measurement block rate. Low values (this contributed negatively at -0.0714) tell the model the disruption is structural / infrastructure rather than content censorship.

  • block_rate_roll7_mean−0.0607

    7-day rolling block rate, same intuition as above on a shorter window (contributed -0.0607). The Sentinel scorer is also reading the absence of a content-blocking spike to disambiguate shutdown-risk from filtering-risk.

These bundled feature values are historical. The forecast endpoint provides separate current output; its top_features field may differ from this case.

Follow the sources

The incident & the record.

LB-2026-0098 ↗

IODA detected a critical-level BGP outage on the North Lebanon regional entity (value 79 vs. history 83) on 2026-04-24 at 12:25 UTC. Published as incident LB-2026-0098.

Inspect incident JSON ↗

Sources cited by the study

External measurement evidence and Voidly’s own incident/evaluation links have different roles. Listing them together does not make each an independent confirmation.

This case is published under CC BY 4.0 in its original article metadata. Preserve attribution; upstream source material retains its own terms.