exactly-one-source-invariant-on-widget-requires-three-layer-enforcement

Widget data source exclusivity (semantic vs SQL, exactly one active) requires enforcement at three layers: Pydantic validator (API input rejection), Postgres CHECK constraint (DB-level enforcement), and service-layer domain error (business logic layer). Single-layer enforcement creates gaps — Pydantic is bypassed by direct DB writes, DB constraints don’t produce user-friendly errors, and service layer alone can be bypassed by migration scripts.