A controller update passes admission while the stored object still carries an old finalizer contract that the new controller no longer clears during a staged decommission

Create and update succeed, but lifecycle completion is stuck behind a legacy finalizer path. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.