The clicker's goal ('the page, now, and tell me if it is a trap') is the whole justification for both the 40 ms p99 and the abuse interstitial.
The campaign owner's goal ('the code goes on 10,000 printed cards') is where code immutability comes from — it is not a technical preference.
The analyst's goal ('stop it within a minute, and show why') is where the separate revocation channel comes from.
The machines are actors
Unfurlers and scanners are an assumed 18% of traffic. They are served normally, tagged, excluded from customer counts, and never charged against a tenant's quota.
A reputation feed is an actor because it changes a verdict on a destination the platform already approved — the failure class that makes screening periodic rather than one-off.
Assumptions
18% bot share of total traffic (assumption; the figure drives both cost reporting and the credibility of every customer-facing count).
Three reputation feeds, so a single provider's outage or false-positive run does not decide the platform's behaviour.
