A county pipeline hits a poisoned schema and keeps restarting overnight. What restart policy change is needed?

A county pipeline that hits a poisoned schema and keeps restarting overnight needs a bounded automatic restart policy—a maximum retry/restart limit—so bad data or incompatible schemas do not loop forever. Automatic restarts remain valuable for transient faults, but unbounded retries on a poison pill burn compute budget, spam logs, and delay human intervention while the schema remains broken. Capping restarts forces the job into a terminal failed state that alerting can escalate to engineers.

Limiting the exponential backoff delay with a capped interval fails by concept because it only makes retries less often overnight; poisoned schemas still retry indefinitely without healing the root cause. Enforcing an active deadline with a maximum run timeout fails because it only terminates the run inside an overnight window; a fast-failing poisoned schema keeps restarting until the timeout with no restart ceiling to force terminal failure. Saving checkpointed progress with saved resume state fails because it only preserves progress for a clean restart; the job resumes and hits the same bad schema again, and saved state does not bound automatic restarts to a terminal failed state.

Exam caveat: restarts help transients; bounds contain poison. Exam answers that say "never restart" or "restart forever" are usually wrong—look for bounded resilience. After hitting the limit, fix the schema contract (evolution rules, expectations, quarantine) before raising the ceiling again.

Operational check: set a maximum restart/retry limit on the county pipeline or job, verify a deliberately bad schema in non-prod exhausts retries and lands in failed status with alerts, and confirm logs still capture the schema error rather than being suppressed.