Consider the following case:

Pull 1 (at t=0): {"new":[{"ip": 1.2.3.4, "duration":4h}, {"ip": 1.2.3.4, "duration":2h}]} -> Bouncer inserts 1.2.3.4

Pull 2(at t=2h + 1): {"deleted": [{"ip":"1.2.3.4"}]} -> Bouncer deletes 1.2.3.4

cscli decisions list would show that 1.2.3.4 is still banned due to the 4h decision, but it won't be present in ipset, nftables or whatever the bouncer is managing.

Here duration is irrelevant because ip would be deleted when the first decision expires.

I haven't thought this thoroughly, but one way to solve this would be to add a boolean column deleted for decisions table and then have unique constraint on (decision.deleted, decision.value).