WP-HARDEN-001 · Slice B · Increment 4

External API Malformed JSON Boundary

Acceptance baseline

Malformed authenticated JSON must be rejected as a client input error before canonical intake authority.

Runtime acceptance tokenExternal API token

Malformed JSON proof

A controlled malformed body is sent once. It must stop at HTTP 400 with a stable public code and zero commerce mutation.