# Astra re-review r2: settings-3-console-settings

Verdict: ACCEPT

Reviewed `df3def0f..d9164c9e` read-only against the binding spec and R11. Inspected regression tests and reported RED/GREEN output; tests were not rerun. No files changed.

## Round-1 findings

### 1. A missing registry lets the fleet gate pass without checking fleets

ADDRESSED.

- `internal/console/apisystemgeoip.go:267` leaves `fleetsListed` false for unset, missing or unreadable registries; it becomes true only after successful fleet listing at line 287.
- `internal/console/updatesgate.go:59` blocks whenever that evidence is absent. Both enabling doors use this gate (`internal/console/apiupdates.go:241` and `:547`); clearing bypasses it.
- GeoIP’s existing completeness flags and verdict remain unchanged; only the settings gate consumes the new fields.
- `internal/console/updatesgate_test.go:187` covers both doors refusing enables without writes and accepting clears across missing/unset registry, unhealthy fleet reports and incomplete heartbeat reads.

### 2. An unchanged off-stable major blocks a full-state clear

ADDRESSED.

- `internal/console/apiupdates.go:178` distinguishes an unchanged major from a newly set or changed one. Lines 202–208 still refuse changed majors off stable and mask unchanged stale majors during validation.
- The separate enable calculation at line 238 still gates newly enabled manual mode, changed pins and changed majors. Resending an unchanged major cannot bypass it.
- `internal/console/apiupdates_test.go:339` covers full-state clears with the fleet gate open and closed, preservation of the stale major, and refusal of a changed major.

### 3. The control socket loses the channel for default settings

ADDRESSED.

- `internal/instanceupdates/control.go:89` fills a missing channel from the fetched route without modifying storage; an explicit settings channel retains precedence.
- The fallback uses the same `reg.Get(host)` result at line 74. `Mount` passes its fixed host at line 48, so request parameters cannot select another host’s channel.
- `internal/instanceupdates/control_test.go:166` and `:183` cover empty-column fallback, unchanged storage and explicit-channel precedence.

## New findings in the fix diff

None.