When is a batch token the better choice than a service token in Vault?

Why this is the answer

Batch tokens are encrypted blobs rather than stored objects, so issuing many of them costs Vault no storage writes and they scale to bursty workloads that create tokens constantly. The trade-off is exactly what the distractors get backwards: they cannot be renewed, so a long-running service wants a service token; and because nothing is stored, they cannot be revoked individually, which rules them out for operator sessions. They do work in replicated setups without a storage write, but that is a consequence of not being persisted rather than any replication ahead of use.