The framing that BGP is the protocol but routes are policy really landed for me, especially the contrast between vWAN association and propagation and the Transit Gateway equivalent. In practice I have seen the same failure mode you describe in section 4: a Pod CIDR gets advertised for convenience and suddenly becomes a second, largely unreviewed routing plane. One question: when you baseline effective routes for drift detection, do you treat Cloud Router custom advertisements and vWAN hub route tables in the same baseline, or keep them per cloud and reconcile them? I ask because a change that looks harmless in one control plane often only shows up as an unexpected propagation in another.