Every residual risk here is accepted deliberately and either bounded by a stated number or escalated into a restatement — the one failure path the architecture is built to make routine rather than exceptional.
Ingestion fails closed and serving fails open: where durability cannot be guaranteed the event is rejected so the producer keeps it, and the product keeps serving regardless of the metering path's health.
Nothing here is handled by retry alone. Retry without idempotency is how a billing pipeline double-charges.
Bounded by a number
Duplicate past 7 days, late past 72 hours, outage past producer buffer depth — each residual risk is the far side of a stated assumption, and each is arguable because the number is written down.
Accuracy target of 1 in 10^6 events is what makes these residuals measurable rather than rhetorical.
The unbounded ones
Two residual risks have no number: both approvers wrong on a price change, and schema drift nobody reads. The first is a human control and the second is a monitoring discipline, and neither is engineered away by this design.
Skew beyond a sub-partition is the scale limit of the partitioning scheme and will arrive with the largest customer, not gradually.
