1. **P2 — Readiness can succeed without establishing the desired database state.** `internal/console/apisystemgeoip.go:137,299`: a pointer read failure leaves `ptr=nil`, disabling SHA checks and allowing `ready=true`. After `off`, mirrors still serving the previous database also pass immediately. Represent unknown, off and live states separately: unknown must block; off must require empty mirror SHAs.
2
3
2. **P2 — `off` can wait beyond the caller’s timeout.** `internal/console/geoippublish.go:290`: `Off` waits on a mutex held throughout uploading and publishing, potentially for minutes. The CLI and backhaul time out after roughly 30 seconds, while the handler remains blocked. Return a busy response before waiting, or make shutdown a tracked job; cancellation must not leave an unobservable operation queued.
4
5
3. **P2 — Console pointer reads are unbounded.** `internal/console/geoippublish.go:78`: `Current` calls `Store.Get`, which reads the entire object into memory. A mistakenly uploaded database or oversized object at `current.json` can exhaust console memory during status, staging or maintenance, despite the defined 64 KiB pointer limit. Stream and cap the read before decoding, while preserving the corresponding ETag for conditional writes.
6
7
4. **P2 — Failed directory synchronization still permits deleting the recovery generation.** `internal/edge/geoipmirror.go:166,396`: after replacing generation A with B, a failed directory sync is treated as success and cleanup deletes A. A subsequent crash can recover `current=A` with A missing; boot then discards the surviving B as well. Retain both generations until the new selection is durable. Distinguish a completed rename from a durable commit so error handling never deletes B either.
8
9
5. **P3 — The upload reservation test does not verify that the rejected body remains unread.** `internal/console/apisystemgeoip_test.go:126–140`: the spy observes the client’s reader, and its result is discarded. Moving the server’s body read before `TryLock` would still pass the status and mutex assertions. Test with a server-side counting or panicking body and explicitly assert zero reads.
10
11
6. **P3 — The countries overflow row loses its required ordering.** `internal/console/analyticsview.go:424–425`: `_other` becomes `other` before `sortedKV`, whose last-row rule recognizes only `_other`. When aggregated overflow exceeds a leading country’s count, “other” appears above individual countries. Preserve the reserved key through sorting and translate its label during rendering.
amadan