Astra re-review r2: settings-3-console-settings

Verdict: ACCEPT

Reviewed df3def0f..d9164c9e read-only against the binding spec and R11. Inspected regression tests and reported RED/GREEN output; tests were not rerun. No files changed.

Round-1 findings

1. A missing registry lets the fleet gate pass without checking fleets

ADDRESSED.

• internal/console/apisystemgeoip.go:267 leaves fleetsListed false for unset, missing or unreadable registries; it becomes true only after successful fleet listing at line 287.
• internal/console/updatesgate.go:59 blocks whenever that evidence is absent. Both enabling doors use this gate (internal/console/apiupdates.go:241 and :547); clearing bypasses it.
• GeoIP’s existing completeness flags and verdict remain unchanged; only the settings gate consumes the new fields.
• internal/console/updatesgate_test.go:187 covers both doors refusing enables without writes and accepting clears across missing/unset registry, unhealthy fleet reports and incomplete heartbeat reads.

2. An unchanged off-stable major blocks a full-state clear

ADDRESSED.

• internal/console/apiupdates.go:178 distinguishes an unchanged major from a newly set or changed one. Lines 202–208 still refuse changed majors off stable and mask unchanged stale majors during validation.
• The separate enable calculation at line 238 still gates newly enabled manual mode, changed pins and changed majors. Resending an unchanged major cannot bypass it.
• internal/console/apiupdates_test.go:339 covers full-state clears with the fleet gate open and closed, preservation of the stale major, and refusal of a changed major.

3. The control socket loses the channel for default settings

ADDRESSED.

• internal/instanceupdates/control.go:89 fills a missing channel from the fetched route without modifying storage; an explicit settings channel retains precedence.
• The fallback uses the same reg.Get(host) result at line 74. Mount passes its fixed host at line 48, so request parameters cannot select another host’s channel.
• internal/instanceupdates/control_test.go:166 and :183 cover empty-column fallback, unchanged storage and explicit-channel precedence.

New findings in the fix diff

None.