Comments only -- no code changed. Covers the blocklist, file allowlist,
login allowlist, auto-denylist, CrowdSec reporter and firewall.
Removes development narration: "(Task 2)" left over from a plan in
Firewall.PurgeExpired, "matching the per-feature JSON config pattern used
by X" repeated across four config loaders, "Recurring and tokenless
before" describing an edit rather than the code, and a duplicated
threading note in BlocklistSnapshot that the inline comment already made.
Points Firewall at dev-docs/ip-bans-and-allowlists.md instead of a
"ban-channel design doc" that does not exist.
Fixes a stale reference the cleanup surfaced: FileAllowlist's remarks
still told readers to opt in via blocklist.json's "allowlistEnabled",
which moved to "enabled" in ip-allowlist.json.
Kept, in tightened form, everything that encodes a reason the code cannot
show: the CrowdSec culture and LAPI protocol notes, why the reporter
flushes off the loop thread at shutdown, why FullMode.Wait rather than
DropWrite, why Firewall reads Core.Now instead of DateTime.UtcNow, and the
volatile-swap contracts on both snapshots.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
b8b5a1e0c9