docs: record error boundary safeguards

AGENTS.md

@@ -75,6 +75,8 @@ Usage notes:
 - Before implementing an external protocol, authentication flow, structured-response validator, retry policy, rate limiter, or service client, evaluate the provider's official SDK and mature maintained high-level libraries. Prefer a thin adapter over duplicating wire formats or reusable infrastructure. If a custom implementation is necessary, document the dependency, privacy, observability, or compatibility reason in `docs/notes.md`. Do not replace small domain-specific adapters or suitable standard-library code merely to reduce line count.
 - Prefer timezone-aware Pendulum values in Python. Reject ambiguous timestamps, keep timezone assumptions at provider boundaries, and centralize unavoidable provider-specific fallback rules instead of spreading guesses through business logic.
 - Do not retain compatibility paths for abandoned internal formats unless the current requirements explicitly require them.
+- Treat persistence, counters, telemetry, and alert bookkeeping performed while handling an error as secondary operations. Their failure must not replace the original business exception, and logic must not rely on state that was not recorded successfully.
+- Validate configuration at its input boundary without coercing invalid scalar types into strings or other superficially valid values. Reject unknown values for application-owned fixed choices early, while leaving third-party dynamic provider namespaces to their owning SDK instead of duplicating a whitelist.
 - Do not use `typing.cast()` in application or test code. Model type boundaries with protocols, typed test doubles, or runtime narrowing instead of suppressing type mismatches.
 - Keep code comments concise and in English.
 - Preserve compatibility between build and runtime environments rather than assuming copied artifacts are portable across distributions or interpreter builds.