Bound publicly writable billable rollouts with local ceilings and state cache limits

A remotely writable rollout percentage should not be the sole authority for starting a billable feature. Put a strict, feature-specific ceiling in deployment configuration, then select a deterministic cohort under min(remote allocation, local ceiling). Keep eligibility, provider credentials, and authorization separate. When a consumer retains last-known-good without expiry, a remote zero is not an immediate kill switch: an enabled warm process may keep its allocation throughout an outage, while a cold process can fail closed. Document that asymmetry and require verified configuration propagation for operational rollback. This pattern bounds remote cost exposure; it does not authenticate remote edits or prove the feature's model behavior.

Applies when: A service consumes publicly writable or weakly protected rollout configuration for billable requests and caches the last valid value. Keywords: rollout public write ceiling billable guidance cache outage rollback deterministic cohort configuration