widget-exactly-one-source-triple-enforcement-pattern

The exactly-one-source invariant on Widget (either Cube semantic query OR SQL cache path, never both, never neither) is enforced at three layers simultaneously: Pydantic validator (request-time), Postgres CHECK constraint (DB-time), and service-layer domain error (business logic). This triple-layer pattern prevents the invariant from being bypassed at any entry point.