The two architectural decisions everything else depends on: isolation model and runtime-version contract