A service boundary accepts valid traffic but mishandles duplicate, stale, or unauthorized records. The affected area is admin API.
Repair the admin API runtime configuration implementation so it applies documented precedence and reports unsupported keys.
Evidence
- Affected surface: Flask / admin API.
- Observed failure family: merge layered configuration.
- Scope policy: authorized must equal true.