Flaw in the security definition of *Stateful* Authenticated Encryption?
Answering my own question since there haven't been any response. 

In fact there is no flaw in the definition. Nor in my attack per se! 

However, the entire point of this definition is to rule out non-stateful schemes (and stateful schemes that doesn't incorporate the state in a sufficient manner) as being secure. In particular, when the adversary asks for the decryption of $C_2$, the decryption algorithm is in state "1", not "2", i.e., expecting to receive a ciphertext created by an encryptor who was in the "1" state when he created it. Thus, if the stateful scheme is worth its salt, the decryption of $C_2$ better result in failure, i.e., $\perp$. Hence, it's no problem to return the "decryption" in $\mathsf{phase} = 1$ anymore, since it will not give the attacker any distinguishing advantage. 

I mistakenly thought that this attack applied generically to all encryption schemes, but forgot that non-stateful schemes should fail this definition.