"No immediate disruption" was true for TLS certs and app secrets but not for the SSH certificate refresh, which has no static-key fallback and eventually locks the automation identity out entirely during a sustained Vault outage. The "always talks through a local agent" law also had an unstated exception worth naming rather than leaving implicit.