This is a composite of three real outdoor-festival incidents from 2024–2025, with the timeline normalized to a single scenario. The venue, names, and exact times are changed. Everything else — the signals, the order they arrived in, the calls the ops team made — is real.
The reason it's worth walking through minute-by-minute is that the headline version ("they evacuated, nobody got hit by the lightning") hides the part that actually matters: the decision was made on signal that started accumulating ninety minutes before the visible weather. By the time the sky looked threatening, the call was already forty-five minutes old.
The setup
Outdoor festival. ~22,000 capacity. Two main stages, two side stages. Gates opened at 14:00. Headliner at 21:00. The ops team had a SignalGuard scan running on the venue from 06:00 that morning, refreshing every 30 minutes against all 50+ signals.
The 06:00 brief came back Low. The 12:00 brief came back Low. The 14:30 brief — half an hour after gates — came back Medium, and that's where this timeline starts.
14:32 — first chatter signal
A scan refresh picked up a Reddit thread in r/[the regional sub] with 14 comments, 90 minutes old. Top comment quoted the National Weather Service mesoscale discussion for the region: "isolated severe thunderstorm potential 17:00–22:00 with damaging wind and large hail."
In isolation, that's a Low. It's a mesoscale discussion, not a watch or a warning. SignalGuard's chatter-pillar score moved from 22 to 31. The composite stayed at Low.
The ops manager flagged the scan as one to watch and set the refresh cadence to 15 minutes.
15:01 — environment pillar moves
The NWS feed (free, wired by default) hit a Severe Thunderstorm Watch for the county. AccuWeather MinuteCast — which the venue had BYOK'd at $25/mo — showed clear conditions for the next 120 minutes, but the venue catchment was at the western edge of the watch box.
Environment pillar score: 28 → 54. Composite: Low → Medium.
The MinuteCast clearance was the interesting part. The system was 120 miles west and approaching at 35 mph, which math'd to roughly 3.4 hours away. The headliner was scheduled for 21:00. The math said the storm hit the venue around the encore — assuming it didn't decelerate, which storms in that region often do.
15:38 — Ticketmaster context
The Ticketmaster Discovery API (free, wired by default) flagged a sold-out 12,000-capacity arena event 2.4 miles from the festival, with a 20:30 start time. That's a context signal: 12,000 additional people on the local road network and the local cell network at exactly the time the festival would also be at peak.
Context score: 14 → 38. Composite stayed at Medium but the dashboard's Movement pillar was now flagged for elevated post-event traffic risk in the 22:00–23:30 window.
15:52 — lightning, ahead of schedule
AccuWeather Lightning API — the venue had BYOK'd this one too — pinged the first cloud-to-ground strikes within a 60-mile radius. Forty minutes ahead of the NWS mesoscale guidance. The storm was moving faster than forecast.
Environment score: 54 → 71. Composite: Medium → High.
The ops manager called the meteorological consultant the festival had on retainer (every festival above 15,000 capacity should have one — a separate post on that later). The consultant ran a fresh nowcast and put the lead edge at the venue around 18:30. Two and a half hours earlier than the original forecast.
16:07 — service-health signal
This is the one that surprises people. The Downdetector Enterprise API — $500/mo BYOK on the venue's contract — showed a 340% spike in outage reports for the local carrier in the venue's ZIP code. Not the kind of spike that means the carrier is down. The kind that means everyone in the catchment is on a phone at once.
Movement pillar: 31 → 58. Composite: High, holding.
Why does that matter? Because crowd density and cell saturation correlate roughly 30 minutes ahead of peak. If the cell network is saturating at 16:07, peak attendance is hitting around 16:37. Which meant the venue was already near operational capacity ninety minutes before the headliner — and three hours before the now-revised storm arrival.
16:18 — the call
The ops manager pulled up the composite brief. The synthesis on the page (we use Claude Haiku 4.5 for the reasoning layer — more on that in the severity scoring post) read, in part:
Compounding signal across three pillars. Environment trajectory: storm leading edge revised to 18:30 ± 20m. Movement: cell saturation indicates crowd at or near operational capacity. Context: 12K-capacity event 2.4mi at 20:30 will degrade egress routes 21:30–23:00. Recommend: pre-position evacuation, halt incoming gate ingress at 17:00, cue weather-hold protocol at 18:00. Critical pathway: lightning + saturated egress.
That's a brief. Not a decision. The ops manager — with the meteorologist on speaker, the head of safety in the room, and the comms director on Teams — made the call at 16:24 to begin a phased weather hold starting 17:30 and a full evacuation at 18:00.
The storm hit the venue at 18:34, with the lead edge of the gust front producing two reported cloud-to-ground strikes inside the festival footprint. By 18:34 the footprint was empty.
What the timeline shows
The visible weather window was the last 30 minutes. The decision window was 90 minutes wide. The signals that bought those ninety minutes were:
- Reddit chatter pointing to the mesoscale discussion (free public)
- NWS Severe Thunderstorm Watch (free public)
- AccuWeather MinuteCast clearance — useful for ruling out, not just ruling in ($25/mo BYOK)
- Ticketmaster nearby event flag (free public)
- AccuWeather Lightning early strikes ($25/mo BYOK)
- Downdetector cell-saturation spike ($500/mo BYOK)
Total BYOK cost to the venue: roughly $550/mo. The synthesis layer — fusing six signals across three pillars into one brief with a defensible reasoning trace — is what SignalGuard does.
You can run the same kind of scan on a venue you operate at /scan. It won't have the BYOK signals unless you wire them, but it'll show the structure: four pillars, severity per pillar, composite score, reasoning trace.