The design has two passive cooling systems. The first uses natural circulation through the heat exchangers to the normal primary cold sink. The second uses radiative heat to the membrane to a pond intended specifically for decay heat. Either one alone is sufficient - so if something (like a tsunami) takes out the primary cold sink we can still cool the core. If despite this the core overheats then it drains to the fuel drain tank. There we have passive cooling using the membrane.
If the drain between the core and the drain tank fails AND the both other passive cooling methods fail to keep the core cool enough then yes eventually the core vessel will fail. In that case, the fuel escapes the first containment (the primary loop) into the can. The can drains to the fuel drain tank so we still provide cooling.
If the drain between the core and the drain tank fails AND the both other passive cooling methods fail to keep the core cool enough then yes eventually the core vessel will fail. In that case, the fuel escapes the first containment (the primary loop) into the can. The can drains to the fuel drain tank so we still provide cooling.