A service boundary accepts valid traffic but mishandles duplicate, stale, or unauthorized records. The affected area is admin API.
Repair the admin API lifecycle transitions implementation so it accepts only declared state transitions and reports rejected requests.
Evidence
- Affected surface: Flask / admin API.
- Observed failure family: validate state transitions.
- Scope policy: authorized must equal true.