Chaos Engineering Platform · View 13 of 21 · Runtime
Decisions
- There is no path on this page where uncertainty keeps a fault alive. Losing the control plane, losing the link, and losing telemetry all converge on the same expiry.
- An unconfirmed revert is an incident, not a metric: the out-of-band reverter is invoked, on-call is paged, and that fault class is suspended fleet-wide pending review.
- Telemetry blindness produces INCONCLUSIVE. Absence of a signal is never recorded as health.
Assumptions
- Lease TTL 15 s is the worst-case time an unattended fault survives, and the global kill switch halts injection fleet-wide within 30 s.
- One unconfirmed revert per ~900 injected faults.
Accepted clutter
- One route-check warning remains: two trigger labels converging on the same decision box sit close. Cutting either label would remove the reason the path exists.