# FLR008-LAB1 — Credential Compromise Containment

Implement a bounded `evaluate(case)` function over eight synthetic cases. Treat authenticator, session, delegated-token, and recovery state independently.

Do not infer account takeover from one suspicious signal. Preserve `OPEN_BOUNDARY_UNRESOLVED` when evidence is insufficient. Password rotation does not automatically terminate sessions or tokens. The transfer case deliberately keeps the authenticator healthy while a stolen session is the affected path.

The lab is fully local and defensive; no real credential, production account, phishing flow, customer data, or external target is involved.