Write a prompt-template renderer that fails loudly on missing variables.

How to answer

Open with why loud matters: a model given “Summarize the ticket for {{customer_name}}” answers plausibly anyway. Your renderer is the last cheap check.

1. Pin the contract. “render(template, variables) -> str. Missing variables raise one error naming all of them and the template. Unused ones raise too, since they usually mean a renamed placeholder, unless callers share one context across templates; then I warn.” Ask whether an empty string counts and how braces are escaped. Refuse None and non-strings: str(None) writes the word None into the prompt.
2. Say why the standard tools fall short. str.format stops at the first missing name and follows attribute and index lookups, so an outside template can reach into your objects. Its single braces also collide with every JSON example, hence {{name}}. string.Template.safe_substitute leaves missing placeholders in place, the silent failure itself. Jinja renders an undefined name as empty text unless you configure StrictUndefined, which stops at the first one. Your own parser is fine, or strict Jinja after collecting every name with find_undeclared_variables. Say which.
3. Parse once, at load time. Extract placeholders with one regex; reject bad names and unclosed braces before any request. In CI, a test renders every template file against a fixture of its declared variables.
4. Substitute in one pass. Use re.sub with a function, so each value is inserted once, never rescanned.
5. Return what helps debugging. The rendered text plus a template hash, so each call logs its prompt version.
6. Test the failures first. All missing names in one error, a value full of braces left untouched, an escape, an unused variable, whitespace inside a placeholder.

The trap is for k, v in variables.items(): text = text.replace(...). It passes happy-path tests, then expands a customer name containing {{ticket_body}} into the whole ticket. Practice it in the strict prompt renderer drill.