Fund lineage out of the on-call budget, not the governance backlog

The number the post does not print is the length of the dark window. A connector fails at 19:04 and the first human-visible signal arrives at 06:30, which leaves eleven hours and twenty-six minutes of a warehouse serving yesterday's data as though it were today's ^[4]. The 02:00 transformation job is the part worth staring at: it ran against stale source data and it succeeded, because stale data is still data ^[4]. Nothing in that chain is broken in a way a job exit code can see. So the first thing a human learns is thirty or forty freshness alerts, every one of them true, not one of them naming the connector ^[5].

Then the arithmetic, using the author's own inputs of 15 minutes per multi-table incident, twice a month, loaded at $80 to $150 an hour ^[7]. That is six hours a year ^[1], or $480 to $900 ^[2]. The $600 he quotes implies a flat $100 an hour ^[3], and he tells you not to carry it into a meeting: rounding error against a salary, and padding if a vendor waves it at you ^[8].

What survives is a sequencing argument. Without a blast radius you learn your numbers were wrong when a stakeholder tells you; with one, you tell the stakeholder first ^[9]. That does not appear in a spreadsheet, and it is the only part of this that a data team's credibility actually turns on.

Two things bound the build. Granularity first: column-level lineage is better for impact analysis before a change ^[11], but when a table stops updating every column in it is stale, so table-level lineage answers the two questions an incident actually poses, which is what to tell people and which pipeline to fix first ^[12][13]. Table-level is also much cheaper to obtain, and if you run dbt you already have it, sitting in the manifest.json that `dbt parse` writes without compiling, carrying every model, source, seed and snapshot plus the parent and child relationships between them ^[14][15].

The second bound is where that graph stops. The manifest's node types are models, sources, seeds and snapshots ^[15], so a manifest-derived graph walks you back to the raw table and terminates one hop short of the Fivetran connector that actually broke ^[5]. Forty alerts collapse to one table, which is most of the win during an on-call window, but the last hop is still a human opening the ingestion tool and reading a failure at 19:04 ^[4]. The post ends where posts like this end, at an upload button in AnomalyArmor's lineage tab, where nodes come back as tables and edges as dbt dependencies ^[16]. The upload is cheap. The reason to do it is that the graph is a triage tool that happens to look like documentation, and teams keep funding it as the second thing ^[3].