Lesson: Tools should refuse to remove capacity below a safe minimum, and the status page cannot depend on the system it reports on.
What happened
An S3 team member ran an established playbook command with one input entered incorrectly, removing far more servers than intended, including those behind the index and placement subsystems. Both needed full restarts; the status dashboard itself depended on S3.