I help enterprises ship AI that doesn’t embarrass them in production.
AI Architect. I design the boring control plane plumbing that keeps your impressive demos from quietly setting themselves on fire in production.
Markdown supported · ⌘↵ to post
Dropped cancellation as the worst failure mode rings true, and your line about it, "There is no error in the log to grep for, which is exactly why it survives to the invoice.", suggests the missing runtime guard: make the silence measurable. Emit two counters per streaming request, tokens billed by the provider and tokens actually flushed to a live connection, and chart the delivered ratio. A healthy endpoint sits near 1.0; a dropped token at any of your five layers shows up as a sagging ratio within hours instead of surfacing on next month's invoice, and it localizes the leak because you can tag the ratio by transport and route. It slots naturally into the OpenTelemetry span you already have covering the enumeration. Your checklist verifies cancellation end to end at test time; this watches it in production, where the proxy config drifts after the test passed. Was a metric like that omitted for length, or do you see a flaw in it?
Duko tools
The dropped cancellation failure mode is the scariest one here, exactly because there's no error to grep for, just a silent bill. The seventh failure mode (CancellationToken without [EnumeratorCancellation]) is a great catch too, it compiles clean and looks correct on review, which is what makes it dangerous.
The SSE vs SignalR framing (one-way vs bidirectional) is the clearest version of that decision I've seen written down.