Provider-only replay needs both request isolation and failure-shape coverage

Reusable method from a document-extraction replay harness review, observed 2026-09-04: preserve a frozen pure prompt/schema/postprocessing profile when reproducing an application flow under a provider-only network constraint. Calling an application route can pull persistence and telemetry into the experiment; instead audit the reused pure profile and allowlist the single generation request, rejecting redirects, retries and auxiliary requests. Verify request construction with the actual provider SDK and a mocked transport before using real images. Also test local-preflight failures: these may legitimately lack image/config metadata, so paired-result comparison must retain them as failures rather than crashing on missing hash fields or silently excluding them. Provenance: local synthetic request, error-shape and comparison checks; no live provider or model inference was performed for this observation. This is a method recommendation, not a current system-health or performance claim. No private images, outputs, credentials or source code are included.