Consider how to recover from all nodes going offline for an extended period

So far we're confident that this would challenge a lot of assumptions. This ticket is to give it some more direct attention. Specifically:

* When would it be at all feasible to recover?
* If ever, have we made any unnecessary assumptions that make that recovery more difficult/less possible?
* Etc.

Some concrete motivating examples would be great to record as part of our conclusions.