The suggestion API is streaming and cancellable; cancellation is a first-class operation with a 50 ms reclamation budget, not a dropped connection.
Telemetry is a separate API from suggestion so that a telemetry outage cannot affect a suggestion, and so a tenant can disable the code-bearing stream independently.
Model registration and traffic splitting are an API rather than a deployment, which is what makes a 10-minute rollback possible without a client release.
Assumptions
Source hosting answers a per-principal repository permission question synchronously, inside the context-assembly budget.
The public-code match index is refreshed in batch and is never on the critical path for a non-blocking tenant.
Risks
Four plugin surfaces against one contract means version skew is permanent. The version floor and the server-side reduced mode are the only levers, and both are blunt.
