carlos / platform Public

| Previous finding | Disposition at 4287f396 | |---|---| | R1-1 — Readiness without established database state | Remains resolved. | | R1-2 — off waits behind publication | Remains resolved. | | R1-3 — Unbounded console pointer reads | Remains resolved for reads. | | R1-4 — Recovery generation deleted after failed synchronization | Remains resolved for the reported paths. | | R1-5 — Rejected-upload test does not establish zero reads | Remains resolved. | | R1-6 — Countries overflow ordering | Remains resolved. | | R2-1 — Feed status writes bypass the read cap | Resolved. DirStore.Put now uses os.Stat for create-only writes and hashFile for replacement checks, preserving conditional-write semantics with bounded memory. The added regression test checks allocations against a 256 MiB existing object and verifies successful replacement. | | R2-2 — Timed-out checks never persist failures | Remains resolved for download timeouts. | | R2-3 — Unreadable feed status clears an alert | Remains resolved. | | R2-4 — Unusable directory prevents “not loaded” alert | Remains resolved. | | R2-5 — Published alert reasons never change while unhealthy | Remains resolved. | | R3-1 — Console follower keeps serving an expired database | Remains resolved. | | R3-2 — Transient status-read failure erases feed history | Remains resolved. | | R4-1 — Unbounded bucket operations block startup or publication | Remains resolved for the reported operations. | | R4-2 — Restart falsely clears a persisted GeoIP alert | Remains resolved. | | R4-3 — Email delivery suppresses active reason changes | Remains resolved. | | R4-4 — Region guesses carry another generation’s attribution | Remains resolved. | | R5-1 — Unknown feed state suppresses confirmed expiry | Remains resolved. | | R6-1 — Failed startup deletion leaves a disabled feed alert firing indefinitely | Remains resolved. | | R7-1 — Unbounded feed edition metadata makes control records unreadable | Remains resolved. | | R7-2 — Unchanged-edition checks leave the feed reported as “not run yet” | Remains resolved. | | R8-1 — MMDB verification indefinitely holds the publish slot | Remains resolved for the reported traversal attacks. | | R9-1 — Malformed MMDB metadata can crash the entire console | Remains resolved for the reported arithmetic panic. | | R10-1 — Verifier child has no memory bound | Remains resolved on Linux for the reported allocation attack. | | R10-2 — Retained recovery generations survive GeoLite2 expiry | Remains resolved for the reported synchronization failure. | | R11-1 — Verified database crashes serving processes during lookup | Remains resolved for the reported stack-exhaustion path. | | R12-1 — Underscore header spellings bypass stripping | Remains resolved. |

Unchanged dispositions carry forward round 13’s conclusions; this review covers 6bdaba34..4287f396.

New findings: none confirmed.

Validation: static review of both changed Go files and relevant callers. Scoped whitespace and formatting checks passed. Targeted Go tests could not start because the read-only sandbox refused build-directory creation; runtime tests and cross-compilation remain unverified.

Verdict: merge-ready.