Every system has a boundary where it stops behaving as designed. The question is whether anybody can find that boundary before an incident finds it for them.
That is why the public case-study record includes failure conditions and current state. They are not confessions added to make a page sound honest. They are the parts of the system a future operator needs first.
Write the condition, not the adjective
“Robust” does not tell an operator what to do. A useful row has three parts:
- The condition: an unreadable document, a dropped frame, a replayed timestamp, a full disk.
- The detection: OCR confidence, a frame-rate watchdog, a monotonic timestamp window, filesystem alerts.
- The response: hold for review, emit a coverage gap, quarantine the stream, shed non-essential writes.
The engineering record treats production as part of development for the same reason. A system that cannot be operated, backed up, migrated, or recovered is not finished because its first deployment succeeded.
Failure writing is a way to make limits legible before the next change turns an implicit assumption into an incident.