A service boundary accepts valid traffic but mishandles duplicate, stale, or unauthorized records. The affected area is webhook receiver.
Repair the webhook receiver runtime configuration implementation so it applies documented precedence and reports unsupported keys.
Evidence
- Affected surface: Express / webhook receiver.
- Observed failure family: merge layered configuration.
- Scope policy: authorized must equal true.