- the payload is a JSON string, so the dict-only guard skipped filtering and future-dated reports leaked into historical runs, breaking the #475 guarantee - parse before filtering; non-JSON bodies and an unset curr_date pass through #1115