Serialization & DTOs
Turning runtime objects into bytes and back, what that costs in CPU and allocation, and why the database row is the wrong thing to hand a client.
A response is bytes on a socket. The encoder decides which of your runtime's types survive the trip and which quietly change shape.
Parsing untrusted bytes produces data of a known shape, not data you may trust — and the gap between those two is where mass assignment lives.
CPU proportional to the nodes you visit and garbage proportional to the bytes you produce — paid on every request, amortised by nothing.
The database row, the domain object and the API response answer to different owners and change for different reasons. Collapsing them is a decision, not a default.
Returning the row is publishing the schema. It is a contract you did not write, cannot see, and will be held to.