The last piece of the day’s plan, and deliberately a different lens from the audits that ran earlier: those covered auth, injection and authorization; this pass hunted for plain correctness bugs across everything shipped since Audit #11: logic errors, state-management gaps, silent failures and off-by-ones. It was split by area (controllers, services, views, models and jobs, and the provisioning script), each verified against the actual code.
What actually broke things
Switching the active Mail Only server did not re-apply the mail server config. The switch handler resynced mailboxes, catch-alls, mailing lists and forwarders but missed the one config push the mail filtering plugin needs, so autoresponders, filters and spam thresholds set up before linking would do nothing on the new server. Fixed with the same pattern the other resyncs use.
Deleting the active Mail Only server left a dangling setting. The active-server setting is now cleared on delete, and services check that it still points at something real.
A licence exemption was missing in a scheduled job. The hourly licence-validation command only exempted the DNS-only role, the same gap the licence page had (fixed in Audit #14), so a Mail Only box would have kept requesting a trial licence. Fixed.
DNS and FTP showed “Inactive” on Mail Only once a domain was set. Neither service is installed on that role; they are now left out of the status page and dashboard card, as they already were for DNS-only.
An addon-domain limit did not match what the page showed. The check counted subdomains toward the limit while the displayed count did not. Fixed.
Smaller fixes
- A check-then-create race in Deploy from Git’s “deploy now” action, now under a lock.
- A date field missing from a model’s type casts.
- The DNS secondary-zone status service swallowed a failed call silently; it now logs a warning while staying a soft failure, since it feeds a dashboard card.
- Two small bugs in provisioning-script zone actions, closed even though the current caller does not reach them.
Noted for later
A handful of lower-severity clean-ups were left for a future pass rather than bundled into a day that already held a large set of live fixes.
Verified
Full local suite (1,701 tests) and the code-style check green. Deployed as v0.16.43 to the test servers, then the two headline fixes were verified live against the linked satellite: the switch handler did re-apply the mail server config, and a disposable server record showed the active setting being cleared on delete, with the real link left untouched.