Identify the operation before wrapping
A write creates or changes vendor state. Explicitly use operation: write in Node or operation="write" in Python; use unknown if the callable’s effect is uncertain. Generic callables default to read and cannot infer your business semantics. Start with fixture evaluation in observe mode, which preserves writes and does not enforce policy blocks.
Separate a proposal from an applied repair
Detection identifies a difference. A proposed patch suggests a change. A verified repair additionally passes independent gates before application. Selective repair is off by default. The Node and Python SDKs accept reviewed rename rules and an independent verifier as explicit construction options. Enable selectiveRepair/selective_repair with reviewed rules and independent verification; repair or strict permits applying accepted patches. Mode alone does not supply a rule. Repair integrations require a trusted migration source, verification and sufficient confidence; matching field names or accepting a schema is insufficient.
Distinguish the two halt phases
A request-phase halt refuses dispatch. A response-phase halt follows upstream completion and retains an outcome where available. Inspect AgindowDriftError.phase, verdict, outcome and hint. Do not turn every policy error into a retry. A review receipt does not execute a write or release a previously used idempotency key.
Reconcile uncertain outcomes
After a timeout, transport error or missing outcome, determine whether the vendor accepted the original operation before sending another write. For remote fallback, require vendor-enforced idempotency and preserve the same key for the same logical operation. Never generate a fresh key merely to retry an uncertain write. Process-local replay caches and audit records cannot provide distributed exactly-once execution.
Verification checklist
Use a controlled fixture to verify operation labels, request refusal, response outcome inspection and internal-fault bypass independently. Bypass preserves the original call even in strict mode; strict is not an infrastructure availability guarantee. No currently published detection example proves persisted write correctness or production protection.