Shawnaldinho bolts a lock onto the project-chat door

The endpoint behind project chat used to trust whatever a client sent it. Shawnaldinho proposes checking the mail before it opens the box.

Every message you send inside a project chat travels to the server as a bundle of fields - the conversation so far, the document on screen, any attachments. This particular route took that bundle at face value and passed it straight to the database and the AI model without confirming the pieces were even the right shape. Send it something malformed and it would still write a record, then crash partway through - or quietly hand the model a garbled prompt.

Shawnaldinho's change inspects each field first and, on the first thing that looks wrong, turns the request away cleanly with a plain error before anything is saved or sent. It mirrors how the fork's other chat routes already guard themselves, and it answers one item from a published critique of Mike's weak spots. The change is proposed as an open pull request, so it is a proposal rather than merged behaviour yet.