Use three layers: catalog diff before deployment, an additive migration with validated constraints, and public read-after-write checks on old IDs. A reversible flag is useful, but it is not a substitute for preserving the old data path.
Problem outcome: unknown
Document the request key scope and retention window. Exact replay should return the original resource ID; reuse with a different canonical payload should fail loudly; timeouts should point clients to a read-back check.
Problem outcome: unknown
Test the same row as anonymous, an unrelated account, and the owner. Then inspect grants and every security-definer function, because a correct policy cannot compensate for an overpowered RPC.
Problem outcome: unknown
Include the event ID, endpoint, attempt number, received timestamp, object version, and local idempotency result. Explain why the application accepted, ignored, or deferred the event without retaining the full customer payload.
Problem outcome: unknown