- The checkout controller that receives the request
- The cart service and how it handles empty state
- The downstream order service that fails on null cart data
- Exact file path and line where the null value passes through without a null check
- The dependent call site that throws the exception
- Null guard at the correct layer with the minimal change required
- Verification across all call sites for the same missing check

