Excellent post, thanks for taking the time to dive deep and start the conversation 
Have you thought about how the new Proposal: Composite Queries feature might improve or hinder this protocol? How might applications and user owned data “canisters” or services handle cross subnet limitations and the latency involved?
Also I’d assume that for safety against malicious canisters, this use protocol might use a series of one-way calls as mentioned by @nomeata in Zero-downtime upgrades of Internet Computer canisters – Blog – Joachim Breitner's Homepage.