Thanks, that makes sense. Treating "can't tell" as an explicit outcome seems important, rather than counting an unconfirmed write as success.

Does that state get returned to the calling agent as structured output, or does it stay inside your repair workflow?

If it's exposed, trace-based diagnostics could distinguish verified writes, failed writes, and uncertain writes without assuming HTTP 200 means success.