Client names withheld by agreement. Figures are from the handover reports.
A team was running four generations of proxy configuration in parallel. Nobody could say which nodes were current, and onboarding a region took two days.
We inventoried the live listeners, matched them to client profiles, and removed the drift. Then we instrumented handshake timing per node, which immediately explained the "slow whenever I reconnect" complaints: two camouflage targets were hosted on the far side of the planet from the nodes using them.
173ms of per-connection handshake cost removed. Node count down from 19 to 11.
The same measurement applied as a standalone engagement. Establish a baseline with a direct TLS connection, then compare each camouflage relay against it. Anything above a few milliseconds is a configuration mistake, not a network limitation.
p99 connect time 403ms → 51ms. No change to bandwidth, no change to node geography.
A storage team believed their failover worked because the runbook said so. It did not: the promotion path depended on a DNS record that a previous provider had silently stopped serving authoritatively.
We ran the drill in production during their quiet window, found four more assumptions of the same shape, and rewrote the runbook around what actually had to be true.
Recovery objective met on the first attempt after remediation, 9m 40s against a 15m target.