---
phase: 07-user-plugin-and-authentication
reviewed: 2026-09-23T08:52:00Z
depth: standard
files_reviewed: 4
files_reviewed_list:
  - surf/serve.go
  - surf/serve_test.go
  - ../fonoteka.go/app/app.go
  - ../fonoteka.go/parity/avatar_assembled_test.go
findings:
  critical: 0
  warning: 0
  info: 1
  total: 1
status: clean
---

# Phase 7: Code Review Report

**Reviewed:** 2026-09-23T08:52:00Z
**Depth:** standard
**Files Reviewed:** 4 (07-08 gap-closure boot path)
**Status:** clean

## Summary

The UAT avatar 500 was a missing `attach.OpenBucket`/`Publish` on both HTTP boot paths. Serve and Handler now publish `*blob.Bucket` before Assemble. Assembled proof lives in `parity/avatar_assembled_test.go` and does not hand-publish a memblob. Earlier 07-06 review warnings (wrong-code activate 200, PHP fetch-after-logout 200) were closed by 07-07.

## Warnings

None.

## Info

### 1. Handler does not close the opened bucket

`surf.ServeCommand` defers `bucket.Close()`. `app.Handler` publishes the bucket and returns `http.Handler` with no cleanup hook, so a failed `party.Activate` after a successful Publish leaks the handle. In-process tests use `mem://`. Production CLI serve still closes. Not a user-facing bug.

## Prior findings (closed)

1. Wrong-code activate now serves Winter 500 HTML (`07-07`).
2. Fetch after logout stays 401 in Go; the PHP 200 reused case is not in the ported corpus (`07-07`).