Progress
Carried v1 defects
Thirteen defects found in v1, each owed a regression test in v2
Reading v1 to port it turned up defects worth naming. They are tracked here because a rewrite that silently reintroduces them has gained nothing, and because "the new design makes this impossible" is a claim that deserves a test.
Addressed by design means the v2 architecture removes the defect by construction — a per-request cache instead of a shared one, a real lock instead of a busy-wait. It does not mean a test exists. Each still needs one that would fail if the old behaviour came back.
| # | Defect carried from v1 | Addressed by design |
|---|---|---|
| D1 | Write calls share the read memo-cache; duplicate writes silently no-op | yes |
| D2 | verify=False on every backend call | yes |
| D3 | Busy-wait spin lock serialises all media distortion | not yet |
| D4 | Fixed temp filenames raced across 50 threads | yes |
| D5 | Shared unlocked SQLite connection | yes |
| D6 | Unbounded, unlocked, never-expiring caches | yes |
| D7 | JWT signing key regenerated on every restart | not yet |
| D8 | sleep() in a loop over every group, on a worker thread | not yet |
| D9 | deleteAdmins missing @RequestBody | yes |
| D10 | No index on Event.groupId, User.username, User.birthdate | yes |
| D11 | No pagination anywhere | yes |
| D12 | Actuator health and metrics exposed anonymously | yes |
| D13 | CORS allowed-origins '*' with credentials | yes |
The numbering matches §6 of the v1 feature map.