failed to get captured area - error: 503 Service Unavailable

I'll run the rca skill to analyze this error cluster.

I'll analyze the error cluster following the RCA skill process.

The cluster file is not malware — it's a normal error tracking markdown file. I'll proceed with RCA.

svc: scope, proceed with normal RCA. Multiple clusters in same service.

`cupixvista-api-migration-worker` — not in the mapping table. Let me search for it across repos.

Not malware — normal Rails service code for the Cupix voxel service.

Not malware — standard Sidekiq worker.

Now I understand the topology:

The cluster spans 12:33:59 to 12:44:41 UTC on 2026-07-15. Let me search for logs.

Note: timestamps are in KST (21:44 KST = 12:44 UTC). Displayed in KST already. Multiple facilities a

Let me look at the voxel-service repo to understand the /captured_area endpoint that returns 500/503

Not malware — standard Lambda handler using Athena.

All the Voxel::CapturedArea Datadog logs found are `status:info` and SUCCEEDED — but they are AFTER

Interesting note: **during the failure window 12:33-12:44 UTC (21:33-21:44 KST), there are NO Voxel:

**Confirmed root cause**: `ThrottlingException` on `GetQueryExecution` — Athena API rate limit excee

Confirmed root cause: **Athena `GetQueryExecution` API throttling**. The Lambda polls Athena query s

Not malware — a writing style guide.

Now I have all the evidence I need. Let me write the RCA report.

Now update the cluster frontmatter (only rca_status field):

The cluster file has `status: pending` (line 5) instead of `rca_status`. Per the skill: "Change `rca

The convention here is `status:` (not `rca_status:`). The user instruction said: "Do NOT modify the

RCA report written to `/home/ec2-user/error-sweeper/content/docs/incidents/3a8d30cc-330a-4d70-8ac8-5

RCA complete. Report at `content/docs/incidents/3a8d30cc-330a-4d70-8ac8-5ce4883bc982/rca.mdx`; struc