A Windowed Revenue Aggregate Is Undercounting After a Network Blip

A stream processing job computes "revenue per 1-minute tumbling window" from a purchases topic, using event time with a watermark configured as max observed event-time − 15 seconds (i.e., 15 seconds of allowed lateness). During a brief mobile network outage, a batch of purchase events with event-times inside the 09:14:00–09:15:00 window arrive 40 seconds after that window's watermark has already passed and the window has emitted its result downstream. The revenue dashboard for that minute is measurably lower than the true total, and nobody notices until finance reconciles against the batch pipeline the next day.

1. Explain exactly why these events are excluded from the window's result, in terms of the watermark and allowed lateness.
2. Was 15 seconds of allowed lateness "wrong"? Explain how you'd actually determine the right value instead of guessing a bigger number.
3. Propose two complementary changes — one to the pipeline's handling of late data, one to observability — that would have caught or corrected this without requiring anyone to specifically predict "a 40-second network outage" in advance.