My initial validator enforced “exactly one root span” per trace. That worked locally, but completely broke when continuing traces from another service via traceparent.
Fixing that required changing the invariant to allow:
One root span (local trace), OR
One span whose parent is external (distributed continuation)
That was the moment I realized how subtle distributed tracing actually is.