ad9ee4f057
Replace bare assert (stripped under python -O) with an explicit isinstance check that returns HTTP 400 when routines is missing or not a list. JSON-decode errors still caught by the outer try.