What was broken
In Apache Stateful Functions, the routable Kafka ingress had no policy for malformed records. A record with a null key (there's no function instance to route to) threw inside the deserializer. A tombstone (null value, normal on compacted topics) blew up as a bare NullPointerException from deep inside protobuf - no topic, no offset, no hint which record did it.
Either way the whole Flink job died - every ingress, every topic, every function, not just the pipeline that read the record. And it looped: the poison record's offset is never committed, so each restart re-reads it and dies again until the job parks at terminal FAILED.
A Flink job runs many pipelines together and fails as a unit, so one producer bug on one topic takes down all of them - order tracking, notifications, billing - not just the pipeline that read the record.
What ships in 3.4.0-KZM-3.5
