What happened
At 09:12 on a Tuesday, a transformation spell meant for a single test account was cast with a scope of every account in the region. Within eleven minutes, 42,000 customers had been turned into frogs. Most of them took it well.
The spell itself was correct. The scope was not: a wildcard rune in the target selector matched far more than its author intended, and the change went straight to production without a canary. Our validation checked the incantation's syntax, but not how many beings it would reach.
Every customer was restored within the hour, and nobody was harmed beyond a lingering fondness for ponds. Since then, scope is validated before casting, every transformation spell rolls out to one village first, and anything that touches more than a thousand beings needs a second wizard's approval.