Does 'Impossible, Not Tedious' Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox

Demote, not invalidate: friction layers never sum to a barrier because an adaptive attacker with near-zero per-attempt cost optimizes against the joint stack (correlated failures, attacker moves last) — the adaptive floor of a pure-friction stack is set by the model, not the layer count; friction retains value only as residual-reduction on top of at least one capability-removing gate (Opus 5's probes+classifier two-layer architecture is the deployed instance). The test is adversary-cost-relative, not agent-absolute: 'impossible' controls bind every actor, 'tedious' ones are priced in the attacker's attempt-cost curve, so mixed threat models must evaluate each control against the cheapest adversary class able to attempt the attack. And the least-agency frequency paradox dissolves on mechanism: a resettable rate (throttle) is friction; a cardinality bound tied to an out-of-band authorization event (single-use nonce, transaction token, expiring token, idempotency cap) is capability removal — 'how often' is a barrier exactly when the counter lives outside the agent's trust domain and reaching it denies rather than delays