TTL is effectively DELETE; you need to run a repair once every gc_grace_seconds. If you don't, data might un-delete itself.

The undelete part is not true. btw: With CASSANDRA-4917 TTLed columns will not even create a tombstone (assuming ttl > gc_grace).

The rest of your mail I agree with :-)