Can FailSafe keep serving stale entries beyond StaleWhileRevalidateDuration when the factory consistently throws?

FusionCache v2.x implements a stale‑while‑revalidate strategy that returns immediately stale data while an asynchronous refresh runs. The StaleWhileRevalidateDuration controls how long the stale entry remains valid after expiration. When the factory delegate throws during a background refresh, the library logs the error and preserves the stale entry until the duration lapses. If the factory keeps failing, the FailSafe feature extends the window by FailSafeMaxDuration, after which the entry is evicted and subsequent requests propagate the exception. This raises several design questions:

• Does FailSafe allow stale data to be served beyond StaleWhileRevalidateDuration when the factory consistently throws?
• How does the distributed lock used for the L2 background refresh influence stale serving across multiple nodes?
• Is there a circuit‑breaker or throttling mechanism that prevents a hammering pattern during the FailSafe window?