When a Country Goes Dark: Surviving a National Blackout with Offline-First Architecture

We design for “High Availability” assuming connectivity is a given. But what happens when a nationwide power outage leaves your warehouses in the dark and your cloud unreachable?

Last year, a massive blackout shut down most of Spain’s power grid. Mercadona Online had thousands of active orders mid-fulfillment across warehouses. The central systems went down, but the logistics never stopped.

In this session, I’ll dissect the architectural decisions — and the business trade-offs behind them — that made survival possible:

– Local-First as a first-class citizen: How edge nodes operated in “bunker mode” with on-site compute, keeping warehouse operations running without a central system. The cost of resilience vs. the cost of downtime, and how we justified the investment before the crisis hit.
– The Split-Brain dilemma: Managing state when physical reality and the central database diverge for hours. Eventual consistency taken to the extreme, and the business rules that determined which side “wins.”
– The Resurrection problem: Reconciling millions of “dark” transactions without data loss when power returned, and the race conditions you need to design for.

Every architectural decision in this story was shaped by a business constraint: SLAs with real warehouses, perishable goods with expiration clocks, and a logistics chain that costs thousands per minute of downtime. This is not a chaos engineering theory talk. It’s the real story of how architecture decisions made years earlier — and the trade-offs we accepted — kept the business running when everything else stopped.