If the system addon fails to connect to Normandy, it should fall back to the previous day's recipes and re-run them. This way, if something disables or blocks connections to Normandy, critical self-repair fixes like detecting search hijacking will still run. We need to be aware of how this might mess with our stats for things like surveys. In the special case that the action for that day is no longer available from the server (if the cache for it has expired and the server has a newer version of the action), the client should fall back to the cached action, and if it has no cached action, it should abort running the recipe completely.

I don't think we want this. From an implementation point of view, it is annoyingly complicated. I also think that if a user can't contact the Normandy server, they likely can't reliably report data. There is also the risk of users getting surveys that have ended. Overall it makes the system more complicated and harder to reason about, and I don't think we gain much for it.