Stealth blackout detector: 458 candidate days where BGP held but the data plane didn't

Aryapour 2025 (arXiv 2507.14183) showed Iran can run a "stealth blackout" — keep BGP routes UP while throttling DNS/HTTP/HTTPS. Invisible to BGP-based IODA. We built a heuristic detector: ping-slash24 critical alerts ≥ 5 AND BGP relatively stable AND OONI blocking/interference corroboration. Found 458 candidate country-days (149 strong) — all already in our incidents table but with empty mechanism fields. The detector lets us back-classify opaque "Internet disruption" incidents as stealth-blackout-flavored.