One API, Three Clients, and the Validation Rule That Only One of Them Obeyed

The validation logic had been solid for months. Pydantic schema on the request, a service-layer check...