Every row trades availability for revocation correctness, in that direction, and the fourth column states what that costs rather than hiding it.
The hardest row is the revocation channel: failing closed at 120 s refuses writes platform-wide during an outage the customer did not cause. It is still the right side of the trade, and it is the row most likely to be argued about in review.
The rows that surprise
Store exfiltration is a pepper rotation, not a mass re-issuance — the single largest practical benefit of keeping the pepper outside the database.
A false leak positive is listed as a failure mode with a cost, because an over-eager containment is a real outage and pretending otherwise is how anomaly detection ends up on by default.
Not on this page
Ordinary node and zone loss, which is handled by the deployment topology in view 16 and needs no distinct response.
