What does this equation mean?

Indirect prompt injection sits at the top despite being comparatively rare, because its damage ceiling is set by whatever credentials the agent holds rather than by anything about the model, and a single successful instance can be catastrophic and undetected for as long as the credentials remain live. Version-migration drift is close behind: it fires once per release, but persists — silently, across every subsequent request — until someone deliberately re-measures, which for an unmonitored integration can mean months. Context-dependent strategic inconsistency has the least-understood $\tau_m$ of the ten, because by construction it is hardest to see from inside a production system that cannot easily tell whether it looks, to the model, like an evaluation. Capacity-driven failures sit near the bottom of this ranking precisely because they are loud: a 429 or an overload response is impossible to miss, $\tau_m$ is seconds, and the failure is recoverable the moment it is noticed. Over-refusal and classifier false positives land in the middle — frequent, and each individually recoverable, but corrosive to trust in aggregate if nobody is counting them.