The Second Reader, Part 2: reachback restored

This guided scenario needs JavaScript for its narration and diagram. Its narration, in order (fictional example):

One detail people usually miss: TAK federation doesn't backfill. When the link comes back, nothing that happened during the outage gets replayed, so this edge node becomes the record.
The backhaul is back. Now comes reconciliation. Sixty-nine queued records go up the link, and they're checked for duplicates, expired records and ordering.
Two records expired during the outage because they outlived their time-to-live. They're reported, not silently dropped.
It doesn't call the tracks hostile, and it doesn't recommend a response. That decision belongs to the jurisdiction lead at the joint operations center, under their authority.
Evidence gets reviewed the same way the observation does: with a source, a version, a time period, and its limits. Evidence has an age, just like the observation.
With reachback restored, the enterprise compares the launch pattern against history and finds no matching authorized operation. That context wasn't available during the event, and the edge advisory held up without it.
The next run replays this same labeled event fully connected, constrained and fully disconnected, changing one link at a time, so we can see exactly where the advisory holds up and where it breaks down.