Symptom

GET /incidents?status=open returns ALL incidents instead of only open ones. The InMemoryIncidentRepository alone works correctly, so the bug is in the layer on top.

Context

The API uses the Decorator pattern: AuditedRepository wraps InMemoryIncidentRepository to add audit logging. It logs every read operation and delegates to the inner repository.