A branch keeps calling desk to desk on its own, and emergency calls have a way out.
Internet goes out. It happens, especially on an island.
A branch on its own
When the main office has been out of reach for two seconds, the box stops waiting and looks after its phones itself. People at the branch can still call each other, desk to desk. The audio stays on the branch's own network and never needed the internet anyway.
Hold and transfer between those phones still work.
What stops
Honesty first: calls to and from the outside world, voicemail, menus and ring groups all live at the main office. While the link is down the branch does not have them. A call to something that is unreachable fails at once with a clear signal, so nothing rings into silence.
How the box knows who is who
The box holds no passwords. Instead the main office gives it, for each phone at that branch, a one-way fingerprint that works only at that branch. With it the box can check that a phone is genuine. It cannot be used to sign in to the main system, and it cannot be turned back into a password.
When the link returns
The box reports what happened: when it was cut off, and each call it connected in the meantime. Those calls go into the main call log with their real times, and the outage is noted in the system log. Nothing that happened in the dark is lost.
Emergency calls
These get special care. A branch can be given its own way out for emergency numbers: a small device with a phone line or a mobile connection. With one, an emergency call always leaves through it, link or no link. That way the call comes from the branch's own line and says where the people actually are, not where the main office is.
A branch without one cannot call out for help while its link is down. The setup says so in capital letters, the box warns of it every time it starts, and the site's page shows which kind of branch it is. Please give every branch one.
Mele Kalikimaka, and may your links stay up.