A service boundary accepts valid traffic but mishandles duplicate, stale, or unauthorized records. The affected area is notification API.
Repair the notification API request stream implementation so it enforces a per-key sliding window and reports allowed and rejected requests.
Evidence
- Affected surface: Express / notification API.
- Observed failure family: apply a sliding rate window.
- Scope policy: contractVersion must equal 2.