| new file mode 100644 |
| index 000000000..8f9e191be |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R12.md |
| @@ -0,0 +1,28 @@ |
| +| Previous finding | Disposition | Evidence from revision 12 at `034727d4` | |
| +|---|---|---| |
| +| R3-1. Expiry/install races | Resolved | §5.3 retains candidate expiry checks and `genMu` serialization of installation, expiry and cleanup. | |
| +| R3-2. Unprotected console `Locate` | Resolved | §5.4 requires locked `Swappable.Locate` and assigns the wrapper to `Config.GeoIP`. | |
| +| R3-3. Coordinate-only results | Resolved | §8.1a accepts coordinate-only hits; §9 counts their country as `_unknown`. | |
| +| R3-4. Heartbeat freshness | Resolved | §5.5 uses `status.BoxStale` and retains the jittered-heartbeat test. | |
| +| R1-4, carried forward: orphan destruction | Resolved | §3 requires startup and daily orphan sweeps; §15 expires noncurrent versions. | |
| +| R1-16, carried forward: rollout verification | Resolved | §5.5 requires every expected box to satisfy readiness; missing or unreadable expected heartbeats block. | |
| +| R4-1. Duplicate tunnel analytics | Resolved | §§8.4 and 9 require zero remote observations and exactly one at the hub. | |
| +| R4-2. Publication deadline across backhaul | Resolved | §4.2 retains staging followed by a 202 response and a polled publication job. | |
| +| R5-1. Concurrent upload staging | Resolved | §4.2 reserves the mutex before reading the body and retains ownership through job cleanup. | |
| +| R6-1. Plaintext tunnel cache mismatch | Resolved | D2 and §§8–9, 16 consistently require the transport-independent tunnel mark. | |
| +| R6-2. Abandoned upload staging | Resolved | §4.2 retains the dedicated staging directory, startup cleanup and restart tests. | |
| +| R7-1. Publication of expired candidates | Resolved | §4.1 rejects expired candidates, rechecks before pointer replacement and forbids a force override. | |
| +| R7-2. Empty sanitized source | Resolved | §6 requires the valid fallback identifier `mmdb`. | |
| +| R7-3. Attribution lost through overflow | Resolved | §9 exempts attributed sources from folding into `_other`. | |
| +| R7-4. Interface discrepancies | Resolved | §§4.1 and 6 retain the corrected signatures and Unix-seconds conversion. | |
| +| R8-1. Box identity namespaces | Resolved | §5.5 requires `(namespace, label)` throughout inventory matching and blockers. | |
| +| R8-2. Shutdown propagation bound | Resolved | §4.2 specifies 11.5 minutes for edges and 12.5 for the console, conditional on successful pointer reads. | |
| +| R8-3. Existing-blob verification | Resolved | §3 requires both SHA-256 and size to match before replacing the pointer. | |
| +| R9-1. Readiness without database convergence | Resolved | §5.5 distinguishes unreadable, live, absent and expired pointers, including expiry determined by the clock. | |
| +| R9-2. `off` waiting behind publication | Resolved | §4.2 requires immediate 409 while an upload or publication job holds the slot. | |
| +| R10-1. Console-override expiry deferred past rollout | Resolved | §16 explicitly places protected override loading, startup expiry refusal and periodic closure in plan 1. | |
| +| R11-1. Expiry clears the freshness alert before bucket marking | Resolved | §10.4 now recognizes marked **or clock-expired** pointers and retains their metadata after dropping the reader; §18 records delayed-marking, restart, fresh-publication and explicit-off tests. | |
| + |
| +No new findings. |
| + |
| +Verdict: accept. |
| \ No newline at end of file |
amadan