A QKD key is claimed perfectly random and private except with probability epsilon, with which an adversary may be assumed to know the whole key; every QKD device therefore has to quote not only the key length it produces over a given time and distance but also the epsilon of that key. A security proof shall state for which system parameters (loss, error rate) a key can be obtained with what epsilon, and precisely which protocol settings (how much privacy amplification) reach the target. Aborted runs count towards epsilon, and because failure probabilities compose, N runs over a system's life carry a total of N times epsilon, which must itself stay small.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.