# Deployment And Remediation Report: 2026-07-15 Kafka file-download consumer-group replay and Nearmap throttling

Incident: `INC-2026-07150002`

## Bad Release

- PR #4171 commit `16ab67a` changed the group identity.
- PR #4205 promoted the change to main.
- Image `2.0.2` was published at `2026-07-15T18:57:38Z`.
- mainenv commit `b37d2d6` changed production from 2.0.0 to 2.0.2.
- CD cancellation occurred after the GitOps commit.
- Old/new groups overlapped for `66` seconds.

## Candidate Remediation

- PR: [#4241](https://github.com/Aerialytic/Monorepo/pull/4241)
- Head: `dbd2126e92f70044696312e43200b3082b7eafd1`
- Verification comment: [source-task verification](https://github.com/Aerialytic/Monorepo/pull/4241#issuecomment-4985290774)
- Monitoring/runbook issue: [#4244](https://github.com/Aerialytic/Monorepo/issues/4244)
- Full CI: [run 29450818576](https://github.com/Aerialytic/Monorepo/actions/runs/29450818576) was queued at publication time.

## Candidate Strengths

- Stable production group identity.
- Exact environment validation before side effects.
- Retry only 429/5xx response errors.
- Jittered exponential backoff, one-second base, 3 retries / 4 attempts.
- No retry for other 4xx, decode, or unrelated failures.
- Signed-URL query redaction and on-prem locality contracts.

## Release Blockers

- Provider-wide distributed rate gate
- X-RateLimit header-aware pacing and reset delay
- Provider circuit breaker
- Fleet concurrency budget
- Consumer heartbeat and ownership-safe slow-request handling
- Bounded response buffering
- Offset continuity preflight for missing, expired, deleted, or out-of-range commits
- Request-level deduplication or idempotency and crash-consistent output/offset handling
- Path traversal removal and non-root runtime
- Kafka SASL/SSL credential-log removal, exposure assessment, and scoped rotation
- Run-loop-aware health checks
- Actual-artifact CI/CD enforcement
- Next/Staging overlay and storage-locality verification

## Required Deployment Gate

Build once and promote the exact tested artifact. Before production, prove consumer-group and offset continuity, provider-wide rate behavior, secret-free logs, run-loop health, request idempotency, and on-prem environment/storage isolation. After rollout, perform multi-replica telemetry checks and a real client-like iframe design-generation workflow.