LalaLive's lights went out for three seconds, returned on emergency power, and left seventeen red dots on the incident board.
`CITY NETWORK OUTAGE`
`17 ACTIVE PODS`
`CENTRAL EXIT SERVICE UNREACHABLE`
Amina joined the incident bridge from her car after leaving the clinic. Three sites were affected: the Westlands theatre, an Upper Hill wellness center, and LalaLive's beta bay. Kato led control, Joel was at the theatre, and Marwa was on a call with the network provider.
“Local hard stops?” Amina asked.
“Available,” Kato said. “But offline safe-exit keys are blocked unless cloud authorizes them.”
“Why?”
“Anti-piracy. Local keys can be abused to copy a pack if they do not expire correctly.”
One Upper Hill pod switched to orientation alarm.
Marwa joined. “Provider estimates restoration within ninety minutes. Keep sessions stable. No mass local-key release.”
Amina remembered Pod 6. “What about the emergency path we used for Kendi?”
“One pod. Not citywide policy.”
Joel cut in from the theatre. “I have six users on clean-pack sessions. Their wallets show signed offline safe-exit tokens.”
The new portable model did not expose the sensory payload. It carried session rights, revocation history, and an expiring key.
“Can it release them without content access?” Amina asked.
“Yes.”
Marwa objected. “We do not open local exit architecture during a commercial outage. That creates leakage risk.”
“Resilience is not piracy if the key is signed, user-specific, and expires.”
Ruth joined as regulator observer. “Who can authorize an emergency exception under your written policy?”
Kato checked. “Quality lead plus site safety lead, with executive notification. Executive approval is practice, not a written requirement.”
Marwa said, “Practice is part of control.”
“Not if your own policy says otherwise,” Ruth replied.
Amina refused a blanket release. She identified only sessions with compatible signed local paths. Each key would expire after two hours. Site safety staff would co-sign. No content export. Every event would be auditable and later synchronized to cloud.
The orientation alarm turned red.
Amina issued the narrow exception.
“Executing six clean sessions,” Joel said.
Six dots changed from red to amber, then green. Users exited without hard stops.
At Upper Hill, one older pooled session had no portable path. Guided grounding failed to calm the user. Clinical threshold was reached and a hard stop was used. The user emerged disoriented but stable.
Amina recorded the distinction. Portability had not magically solved every outage, but it had reduced the need for abrupt intervention where it existed.
Marwa stayed silent for several seconds.
“Expand the exception to all compatible sessions,” she said at last. “Named signatures only.”
Amina agreed.
Over the next hour, eleven users exited through local keys. Four others waited safely for partial service restoration. Two required clinical intervention.
Ninety-seven minutes after the outage began, central connectivity returned.
The system synchronized revocation logs. No duplicate active token remained. No pack payload had been exported by the emergency keys.
Before closing the incident, Kato produced a table separating every exit type. Ruth demanded raw timestamps so the hearing would not be reduced to a slogan claiming “portability solved the outage.” Marwa added a security review of key-expiry logic. Joel agreed; user-controlled exit still required real controls.
Amina checked every two-hour token. All had expired and reported deletion from local access stores.
The incident had exposed something larger than a technical convenience. A user-controlled local exit path had reduced clinical shock and a single central point of failure.
Marwa looked at the results. “Making every session compatible will cost money.”
“Yes,” Amina said. “Now we know it is also a safety control, not just a consumer feature.”
The incident board had barely settled when a new notice replaced the outage banner:
`DIGITAL WELLNESS LICENSING REVIEW`
`TOMORROW 08:00 — LALALIVE LICENSE UNDER REVIEW.`