A recommendation platform trains continuously from a streaming feature pipeline, in the manner ByteDance documented for Monolith (2022) - a model updated online from fresh interaction data rather than retrained nightly. One filter stage silently drops about 2% of click events for 40 minutes, then recovers. Every stage reports healthy throughout. What happens over the following days?

Minute by minute, then day by day

During the 40 minutes: nothing visible. Throughput on every stage is within normal variance, because 2% is inside the diurnal noise band. No stage errors, no queue grows, no alert fires.

Immediately after: the model has absorbed 40 minutes of data in which certain items appear less engaging than they were. Because training is online, the parameters have already moved. There is no batch to re-run and no checkpoint boundary to discard.

Hours later: the effect compounds through the serving loop. The items whose click signal was under-counted are ranked lower, so they are shown less, so they accumulate less engagement, so the next training window confirms the demotion. A transient data defect becomes a self-reinforcing preference, and the feedback loop is the amplifier.

Days later: engagement metrics are down by a small amount nobody can attribute. The code has not changed. Rolling back the pipeline fix would not help, because the damage is in learned state rather than in code.

Where it amplifies

Two places, and both are properties of this architecture rather than bugs.

The serving-to-training loop. The model's output determines what data it next sees. Any error in the training signal is re-entered as a true observation of reduced engagement. A nightly batch retrain from a durable event store has the same vulnerability, but the loop runs once a day and the window is auditable; online training closes the loop in minutes.

Embedding tables keyed per item. Monolith's documented design uses collisionless embeddings, so each item has its own parameters rather than sharing a hashed bucket. That avoids one class of interference and means the damage is precisely localised to the affected items and does not wash out across the population. Precision cuts both ways.

What the user sees

Slightly worse recommendations, with no error and no latency change. Creators whose items were demoted see a traffic drop they will report as a platform problem, and the platform will have no evidence of one.

What stops it

• Counts as a contract, not a side effect. Each stage emits input and output counts per window, and the pipeline asserts the ratio against a learned band. A 2% drop is not detectable as throughput and is obvious as a stage-to-stage ratio.
• A durable event log before the filters. With the raw events retained, the window can be replayed after the fix, which is the only way to repair the training signal.
• Model state checkpoints and a rollback path. Snapshots at a cadence short enough to lose little — minutes to an hour for an online system — and a tested procedure to restore parameters. Rolling back code does not roll back learned state, and the second mechanism almost never exists until the first incident.
• Freshness and quality gates on the training input, which can halt training without halting serving. Serving a slightly stale model is far cheaper than training on a corrupted one.

What would have to be true for it to self-heal

Only if the demotion is small enough that the affected items still receive exploration traffic. An online system with no exploration cannot recover from a signal error, because the mechanism that would gather contradicting evidence has been switched off by the error itself. A bandit-style exploration floor — a guaranteed minimum share of impressions for items with uncertain estimates — is what makes self-healing possible at all, and it is the cheapest insurance in this architecture.

When this architecture is the wrong choice

When freshness is not worth the recovery cost. A catalogue where preferences shift over weeks does not need minute-level model updates, and a nightly batch retrain from a durable store is dramatically easier to reason about, audit and repair: there is a known input set, a known output model, and a rollback that is a file copy. Online training is justified by genuinely fast-moving content — short video, live events, breaking news — where a day-old model is measurably worse.