Auth, feature flags, API contracts and shared state carry a must-read gate before anything is changed. Cross-service paths get the same treatment: a write that bypasses the hooks in the owning service ...