The gateway does not live alone: the JWT that does not validate the audience, the user who never reaches the trace, and the seams you have to write by handSep 12, 2026