A service boundary accepts valid traffic but mishandles duplicate, stale, or unauthorized records. The affected area is batch worker.
Repair the batch worker cache lifecycle implementation so it separates purge, refresh, and escalation actions by staleness and risk.
Evidence
- Affected surface: Express / batch worker.
- Observed failure family: plan cache invalidation.
- Scope policy: retained must equal true.