A service boundary accepts valid traffic but mishandles duplicate, stale, or unauthorized records. The affected area is REST controller.
Repair the REST controller lifecycle transitions implementation so it accepts only declared state transitions and reports rejected requests.
Evidence
- Affected surface: Spring / REST controller.
- Observed failure family: validate state transitions.
- Scope policy: authorized must equal true.