What constitutes ADF pipeline failure?

(Edit: Question now asked on MSQA).

I have this pipeline:

OK, it's a simplification of a real pipeline =). Execution goes like this:

  1. The Fail activity fails (I'm casting a non-numeric string to an int, just btw)

  2. The OnFailure activity executes and succeeds

  3. The pipeline is reported to have succeeded.

I modify it by adding an OnSuccess activity like this:

Nothing else has changed, so I expect the same behavior as last time. But:

  1. The Fail activity fails as before

  2. The OnFailure activity executes and succeeds as before

  3. The pipeline is reported to have failed.

Is this by design? Is there information somewhere about how pipeline success/failure is determined?