Roll out a new swap adapter behind reversible controls

A single “provider enabled” switch is too coarse for a swap application. Disabling new execution should not erase pending transaction history or stop observation of orders already submitted.

Define independent controls

Scope controls by provider, chain and execution mode where useful. A broken Permit2 assembly path need not disable an independently implemented allowance path, but any fallback must receive its own review and authorization.

Make the gate authoritative

Check execution eligibility immediately before opening a wallet prompt, not only when rendering the page. A quote can remain on screen after a provider is paused. The backend should also enforce relevant gates so stale clients cannot bypass the current policy.

Version the configuration used by each attempt. Preserve immutable payload context rather than mutating already reviewed transactions when a flag changes.

Plan retirement as well as rollback

API lifecycle changes are real integration events. KyberSwap's documented latest, legacy and deprecated states illustrate why a known endpoint is not necessarily an appropriate new-execution path forever.

For a retiring adapter, stop new orders, reconcile existing references, preserve receipts and provide an accurate unavailable state. Remove secrets and unused code only after their operational dependencies have been reviewed.

Test a pause while a quote is displayed, while a wallet prompt is open and after broadcast. The last case remains an observation task. A local switch cannot undo a transaction or signed order that has already escaped the application boundary.