The book_comments collection has a custom 'id' field (type: text, required: true) distinct from PocketBase's system record ID. Every comment POST was returning 400 validation_required because the id field was never sent. Fix: generate a 15-char hex ID via crypto.randomUUID() and include it in the payload, matching PocketBase's own ID alphabet.