01Enforced, not promised
A gate test I wrote walks the AST of every Python file under backend/ and contracts/ and fails the build if a live mutate is called outside the apply engine; only the port implementations that define it are otherwise allowed. At runtime the same gate forges an apply with no approval row and asserts it is rejected. Each staged action carries its reverse — a create undone by the resource name the mutate response returns, an update by the values captured before staging — and the reversibility gate asserts byte-for-byte account equality after apply-then-undo against the fixture port.
02Protected keywords
After it recommended pausing robocafe and coffee robot, the core terms are read out of the business context and removed from the dead-keyword and negative detectors entirely. An underperforming core keyword now produces an optimise insight instead: relaunch the paused campaign, fix the landing page or tracking, clean the junk traffic, tighten the match type. Insights aggregate by keyword text, so one core term produces one recommendation rather than one per ad group.
03The guardian layer
A separate audit found the eight-day blackout, not the product. The only consumer of the hourly cost series fired on overspend, so zero delivery was invisible to it. A delivery deadman now builds a per-weekday, per-hour expectation of cumulative spend from the account's own archived hourly costs using median and MAD, excludes already-dark days so an outage never becomes the new normal, and alarms on absence without asserting a cause the API cannot observe; a sync sentinel treats no successful sync on record as blindness rather than a default pass, and a version canary probes the pinned Ads API version and the two above it.
04A version sunset
"Refresh dies at 6%" was the report I got. Google was progressively rejecting Ads API v21, about 7% of requests at random measured on the live account, and a full sync makes eighteen sequential GAQL calls, so it survived roughly a quarter of the time and died at whichever query drew the short straw. Two things had hidden it from me: Google buries errorCode several hundred characters into its JSON and my caller truncated at 400, and a read timeout escapes urlopen as a bare socket.timeout rather than a URLError, so it bypassed the handler entirely.
05The undo window
An adversarial review found the undo window was seven days while the measurement window was fourteen, so the system could prove a change harmful a week after losing the ability to reverse it. I now dry-run the reverse before it commits and moved the contract default to twenty-one days, but every action class still stages its own seven-day window, so the gap is only half closed. The same review found a paired budget move could half-apply through the batch path, turning a flat reallocation into a spend increase; those actions now carry an atomic flag.
