marshmallow 4

Apply the Python 3 prompt first. Use these rules for the marshmallow 4 line on Python 3.10–3.14; they were checked against 4.3.1. Review framework, ORM, and custom-field integrations for marshmallow 4 compatibility, including the removed schema context API and changed hook signatures.

Schema authority and unknown input

• Declare narrow Schema input and output fields for each operation. Keep Schema.from_dict, fields.Nested schema references, fields.Method names, and any polymorphic discriminator-to-schema mapping in trusted code.
• Omit server-controlled owner, tenant, role, approval, and lifecycle fields from input schemas, or use dump_only=True with unknown-field rejection. Use load_only=True for accepted credentials that must not be dumped; omit internal secrets that belong in neither direction.
• Preserve the default unknown=RAISE at untrusted boundaries. Audit load(..., unknown=...) overrides, which take precedence over instance settings and Meta.unknown; use EXCLUDE only for a deliberate compatibility policy.
• Set unknown=RAISE on each relevant fields.Nested or child schema. A parent's load(..., unknown=RAISE) does not override the child policy; audit children inside lists and recursive schemas too.
• Avoid INCLUDE for data that will become constructor arguments or assigned attributes. It copies unknown values without field validation, accepts supplied dump_only values, and can overwrite a validated output key: input under a field's internal name can replace the value loaded through its data_key.
• Keep data_key, attribute,