A production rollout exposes a contract mismatch between the UI boundary and the owning service. The affected area is session boundary.
Repair the session boundary lifecycle transitions implementation so it accepts only declared state transitions and reports rejected requests.
Evidence
- Affected surface: Full-stack frontend focus / session boundary.
- Observed failure family: validate state transitions.
- Scope policy: authorized must equal true.