in which case your API layer should validate the data at runtime so that it only actually returns type T as it claims. then you are back to soundness