widget-exactly-one-source-invariant-enforced-at-three-layers

R-Dash Widget model enforces the exactly-one-source invariant (either Cube semantic query OR raw SQL, never both/neither) at three independent layers: Pydantic validator (request-time), Postgres CHECK constraint (DB-time), and service-layer domain error (application-time). This triple enforcement ensures correctness even when layers are bypassed independently.