Both features ran on every shard out of the box, each polling on its own
60s timer for files most shards never generate. Neither was ever asked for.
Blocklist: the only disable path was an empty "file", and the default is
non-empty, so Start() always reached Task.Run(PollLoop) plus a recurring
SweepGuard timer. Adds "enabled" (default false). A shard that has a list
on disk but no "enabled" key logs a Warning rather than silently dropping
a gate it was relying on.
File allowlist: moves out of blocklist.json into its own ip-allowlist.json
with "enabled" (default false), "files" and "reloadInterval". It was never
a sub-feature of the blocklist -- its two consumers are BlocklistFilter,
where the generator already subtracts these files anyway, and
BanExemptions, which suppresses behavioural ban contributions and works on
a shard running no blocklist at all. That second consumer is the only
mechanism for what it does, so a shared flag could not express it.
"allowlistFiles" stays bound on BlocklistSettings, defaulting to null and
deliberately not honoured, purely so an operator who set it is told where
it went instead of losing the carve-out silently.
The two still work together: the blocklist warns at startup when it is on
and the file allowlist is not, since only the generator's subtraction is
covering carve-outs then, and that does not cover ban contributions.
Also fixes the promote-guard sweep, which was recurring and tokenless, so
Stop() cancelled the poll but left the sweep running and a later Start()
added another. It is now held and stopped, and only started when hits are
reported -- nothing can mark the guard otherwise.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
19b8ce2ce4