A service boundary accepts valid traffic but mishandles duplicate, stale, or unauthorized records. The affected area is metrics hook.
Repair the metrics hook access policy implementation so it returns only permitted actions and explicit denial reasons.
Evidence
- Affected surface: Fastify / metrics hook.
- Observed failure family: enforce permission rules.
- Scope policy: zoneState must equal healthy.