Follow up Check without saving compatibility and user-facing evidence #1946

Follow-up to #1943; implementation waits for its accepted merge and dependency plan.

Track the reviewed P3s: the installed Flow pin must support the new mode before the feature can run; dry runs currently appear in history as halted replays; and “Nothing was saved” is based on blocked input, without an application read-back establishing absence of writes.

Keep the fail-closed compatibility refusal and distinguish observed checks from inferred absence of effects. Do not weaken safety tests, claim qualification, or change a production pin/release without the required approval.