Validate the correct target

Before choosing a tool or writing more code, make the requirement concrete. Bookmark creation validates JSON, search validates query values, and the id parameter becomes a bounded identifier.

Hono validation is target-specific, and content type determines whether body data is parsed as expected. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

A common failure is to read raw values after validation or validate one target while trusting the same name from another. The happy path may still work, which makes the mistake easy to miss. define one authoritative input location, validate it, and use only the validated result downstream. Keep the first version small enough that every important input and output remains visible.

This supports the module goal: Reject malformed or unauthorized requests at the boundary and keep domain code independent of raw request parsing. Capture the request, command, trace, screenshot, test result, or other evidence that proves the result.

Send the same field in query, JSON, and a header and prove only the contract location affects the operation. Change one condition on purpose, predict the result, and compare the prediction with what actually happened.