Rank by risk (external boundary types first). For each: model the real shape

with a discriminated union / schema validation (zod/pydantic) at the boundary; internal code stays pure types. Replace assertions with narrowing/guards.