SAMPLE EVIDENCE for EL-01 (made-up app Tidyhaus; not a real review)

POST /functions/v1/create-booking with {} -> HTTP 400 {"error":"Missing service"}
GET /bookings/999999 -> 'We couldn't find that booking.' No stack traces or SQL in any response.