Casting null to string caused PATCH to fire against /api/notifications/null/read when the field was absent. Added an early-return fail(400) and a test that submitting an empty form returns 400 without calling the API. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>