Reconsidered Q4: instead of one global degrade-and-warn, the posture now inherits from effective classification (Q1): - confidential + audit-sink-down -> hard-refuse (no buffer; removes the buffer-integrity question for confidential data) - internal/public + audit-sink-down -> degrade-and-warn + durable local buffer + ntfy + reconcile-on-recovery - floor (all tiers): refuse if nothing can record the audit Updated the I5 Gherkin scenarios + obligations row to match. Couples Q4 to the Q1 classification spine -> one coherent sensitivity model.