Every row's right-hand cell is the failure the design makes impossible, not one it accepts. Read the matrix right-to-left to see what the architecture is actually for.
'Flake' is not a root cause. A job is re-run only to confirm a failure that names a service the change does not touch, or one that died before any work began.
No failure class is handled by skipping, disabling or quietly defaulting a feature. Absence is always a value with a reason code.
Assumptions
Staleness detected within 60 s of exceeding 2× the freshness SLO; owner alerted within 5 min.
Serving continues from cached compiled plans for at least 60 minutes without the registry.
Risks
Three of the eight classes recover by replay from a 7-day stream log. A failure lasting longer than the retention window has no recovery path except re-derivation from the source systems, which the platform does not control.
