Guard the model's inputs, not only its outputs

A fallback identifier was being treated downstream as authoritative. It was traced through three separate consumers — the rendered microsite, the CRM sync, and the LLM prompt — and each was fixed as its own tracked issue. Output verification is table stakes; keeping unverified data out of the model's context is the other half.