Two endpoints share a wire format. The spec gives them different permissions. The implementation writes one parser and calls it from both sides. The parser implements the union of the two grammars, because nothing in its signature distinguishes which side is calling. The endpoint the spec narrows inherits the looser endpoint's permissions for free, and the inputs the spec did not authorize from that direction arrive anyway. The fix is the missing qualifier on the function name and the call-site update that hands each side its own grammar.
Direction Blind Parser
A protocol specifies different permissions for two endpoints sharing a wire format. The implementation writes one parser and calls it from both sides. The shared parser implements the union of the two roles' grammars; the endpoint whose role the spec narrows inherits the looser endpoint's permissions and admits inputs the spec did not authorize from that direction. The fix is the qualifier on the function name and the call-site update that pins each side to its own grammar.