Skip to main content
Gateway’s design does not try to make every request succeed at any cost. It chooses a controlled, explainable execution over shortcuts that can hide extra work, uncertain outcomes or unauthorized changes. The trade-offs below are the ones supported by the selected source design. They are not measured performance results or newly adopted alternatives.

​
Evidence before effects

What it protects: the execution record exists before provider work can create remote cost, and the output boundary is recorded before meaningful content may be exposed. What it costs: protected storage, permission and confirmation become part of the execution path. A healthy provider is not enough if the required evidence boundary cannot be established. Logging only after a response returns looks simpler, but it loses the hard cases: a process can die after dispatch, or the provider can complete while its reply disappears.

​
A shared retry policy instead of layered retry loops

What it protects: each real send stays inside one call-wide plan and budget. Provider changes cannot silently multiply the permitted work. What it costs: adapters, client libraries and caller wrappers must coordinate rather than retry independently. A request may stop even though some other provider could probably answer it. The selected baseline retains six physical dispatches with narrower sublimits, not a universal replacement rule of “try twice.” A restrictive qualified policy can allow fewer; the editor cannot choose a new blanket policy.

​
No replacement after answer exposure

What it protects: the reader is not shown one answer assembled from separate hidden model generations. What it costs: a broken stream can end with an explicit partial failure. Gateway cannot promise seamless completion by switching models after output may already be visible. An explicitly new caller request remains possible under its own authority and identity. It must not pretend to be the old stream continuing.

​
A qualified catalogue instead of optimistic discovery

What it protects: mandatory capabilities, accounting rules and data-handling constraints are supported by applicable approved evidence. What it costs: qualification, review, publication and freshness have to be maintained. A newly available model name is not instantly eligible for every request. Runtime health can narrow selection. It cannot manufacture a missing capability or publish a new policy.

​
Content-free records instead of a hidden answer archive

What it protects: Gateway’s durable execution history does not become another store of prompts, answers or private reasoning. What it costs: applications that promise exact answer replay must store the answer themselves. A content-free final cannot reconstruct bytes that nobody retained.

​
Atomic capacity and evidence instead of separate commits

What it protects: a rollback cannot leave a dispatchable attempt without its required capacity association, or settle capacity without the matching terminal record. What it costs: the applicable changes must use one admitted connection and transaction. Independent convenience helpers are not interchangeable with that boundary.

​
Qualified settlement instead of trusting a success flag

What it protects: Gateway does not invent wallet, journal or whole-payment truth from a message or hash. What it costs: actual financial producers, witnesses and a current receiving boundary are required. The outbox may remain pending while those facts are unresolved. The same discipline applies to disaster objectives: a simpler topology or a local smoke test cannot replace a retained durability requirement without an owning design decision. These costs should be evaluated against actual deployed evidence, not hidden. Read What has actually been demonstrated and How the design evolved.