A project is three sprints from launch and no non-functional requirements were ever written down. What do you do?

Do not write a full NFR matrix now

There is no time, and most of the design decisions those numbers would have constrained have already been made. Writing twelve targets you cannot influence produces a document, not a design input.

Get the four that still change something

Availability. What is the business's actual tolerance for downtime? The gap between 99.9% and 99.99% is roughly one region versus three, and if the answer is the second, launch date is affected — which is worth knowing now rather than after.

Peak load, with a multiplier. Not average. What is the busiest expected hour, and what happens at three times that? This is testable in the time remaining.

Recovery. RTO and RPO. If the answer is "we assumed backups", that is a finding to escalate before launch, not after.

Data sensitivity. What is being stored, and what obligations follow. This one can block a launch outright, so it goes first.

Then verify what you can

Run a load test at the stated peak. Perform one failover exercise. Confirm the backup restores. Three days of work, and each produces either confidence or a finding that leadership needs before they accept the launch.

What to escalate

State plainly what is unverified and what the exposure is. "We have not tested recovery; if the primary region is lost, our restore time is unknown" is a sentence a sponsor can make a decision about. Absorbing it silently is the failure mode.

Afterwards

The real fix is process. NFRs belong in discovery, before design work that the answers would invalidate — and a project that reached its last sprint without them will do so again unless someone makes them a gate.