Function validate_bytes 

pub fn validate_bytes(
    bytes: &[u8],
    mode: Mode,
) -> Result<Vec<ValidationIssue>, String>

Validate an ATIF trajectory from its RAW BYTES. This is the correct entry point for every path that receives operator/attacker-supplied ATIF content (CLI avctl atif-validate, reconciler recovery + promotion). Unlike serde_json::from_slice::<Trajectory>() + validate_trajectory, the bytes path:

1. Refuses duplicate JSON keys anywhere in the payload (parallel to av_receipts::Receipt::from_json_slice’s strict pre-scan), so the auditor cannot be shown a document whose “last wins” reading differs from the “first wins” reading.
2. Runs validate_value on the parsed serde_json::Value — the untyped path exercises check_unknown_fields, which the typed Trajectory (no deny_unknown_fields) silently drops.

Returns Err(reason) on duplicate-key or parse failure; returns Ok(issues) on successful parse (issues may be empty).