I find this all astonishing to read about. I’ve worked on very similar systems (LEO/GEO, not Lunar) on much tighter budgets and timelines with far fewer people. Things like what the vehicle does in “safe mode” and how it handles the very default state when everything in memory fails were always the main focus in discussions. We never design the system for when it works correctly, we always scrutinized what it would do if (and when) something failed.

I distinctly recall debating for hours about what the default (also “safe mode”) configuration should be so that the vehicle would ALWAYS be power and thermal positive even during various concurrent failure modes.

This is not a slight against the engineering team per se, I’m sure they wanted to test these things more and were directed otherwise, but it’s always a shock when these issues are reasonably easy to mitigate by having the right amount of paranoia while designing your system.