The five API conventions that stuck across 37 iterations (and three we let drift)

From one endpoint to 22 across 14 API iterations. The patterns that hardened by the third call: { ok } envelope, cursor pagination, cross-tenant 404, forgiving enums, idempotency keys. And what we deliberately let drift.