Availability gate
Infrastructure fault → transparent bypass, loudly, once per call. Warming, engine faults and unavailable inspection preserve original results and exceptions in every mode. Internal faults never become policy refusals. A bypass event is emitted once per call, not once per phase.
Policy is separate
Known policy rejection remains a rejection: blocked is distinct from bypassed. Reads with incomplete policy repair can be degraded; strict is an explicit policy escalation. An HTTP 5xx from an explicit remote guard invokes the documented fallback, subject to upstream-enforced idempotency for writes.
Uncertain or completed writes
Inspect a retained completed outcome before deciding what to do next. Do not blindly replay a write with an uncertain outcome. Local replay state is not durable or distributed. Use the same upstream-enforced idempotency key in a remote request and its fallback; never generate a fresh key to repeat an uncertain write.
Specification
Read the published modes guide and the guard loop.