carlos / platform Public

1. P2 — Readiness can succeed without establishing the desired database state. internal/console/apisystemgeoip.go:137,299: a pointer read failure leaves ptr=nil, disabling SHA checks and allowing ready=true. After off, mirrors still serving the previous database also pass immediately. Represent unknown, off and live states separately: unknown must block; off must require empty mirror SHAs.

1. P2 — off can wait beyond the caller’s timeout. internal/console/geoippublish.go:290: Off waits on a mutex held throughout uploading and publishing, potentially for minutes. The CLI and backhaul time out after roughly 30 seconds, while the handler remains blocked. Return a busy response before waiting, or make shutdown a tracked job; cancellation must not leave an unobservable operation queued.

1. P2 — Console pointer reads are unbounded. internal/console/geoippublish.go:78: Current calls Store.Get, which reads the entire object into memory. A mistakenly uploaded database or oversized object at current.json can exhaust console memory during status, staging or maintenance, despite the defined 64 KiB pointer limit. Stream and cap the read before decoding, while preserving the corresponding ETag for conditional writes.

1. P2 — Failed directory synchronization still permits deleting the recovery generation. internal/edge/geoipmirror.go:166,396: after replacing generation A with B, a failed directory sync is treated as success and cleanup deletes A. A subsequent crash can recover current=A with A missing; boot then discards the surviving B as well. Retain both generations until the new selection is durable. Distinguish a completed rename from a durable commit so error handling never deletes B either.

1. P3 — The upload reservation test does not verify that the rejected body remains unread. internal/console/apisystemgeoip_test.go:126–140: the spy observes the client’s reader, and its result is discarded. Moving the server’s body read before TryLock would still pass the status and mutex assertions. Test with a server-side counting or panicking body and explicitly assert zero reads.

1. P3 — The countries overflow row loses its required ordering. internal/console/analyticsview.go:424–425: _other becomes other before sortedKV, whose last-row rule recognizes only _other. When aggregated overflow exceeds a leading country’s count, “other” appears above individual countries. Preserve the reserved key through sorting and translate its label during rendering.

Verdict: revise.