Teaching validation rules as contracts, not spells

We draw tables on paper before touching code: field, type, nullable, who cares if it drifts. Only then do we open Laravel validation arrays. That order keeps people from copying giant rule blocks they cannot defend in review.

The middle section covers partial updates. Patch endpoints get exercises about optional keys, default confusion, and how to document breaking changes without shouting at mobile clients.

We end with observability: validation failures should log enough to debug without storing sensitive payloads. Learners tune sampling and redaction together so future them does not regret today's convenience.