| 1 | | Previous finding | Disposition at `9cd8e78f` | |
| 2 | |---|---| |
| 3 | | R1-1 — Readiness without established database state | **Resolved.** Unknown pointers block readiness; off and expired pointers require empty mirrors. | |
| 4 | | R1-2 — `off` waits beyond caller timeout | **Resolved.** `TryLock` refuses concurrent publication with 409. | |
| 5 | | R1-3 — Unbounded console pointer reads | **Resolved for pointer reads.** `readPointerCapped` streams and caps the object. | |
| 6 | | R1-4 — Recovery generation deleted after failed synchronization | **Resolved.** Installation-error cleanup protects loaded and retained generations; failed synchronization retains all potentially recoverable generations. | |
| 7 | | R1-5 — Rejected-upload test does not establish zero reads | **Resolved at the reservation boundary.** The panicking-reader test detects reads before slot reservation. | |
| 8 | | R1-6 — Countries overflow ordering | **Resolved.** `_other` survives sorting and is relabelled during rendering. | |
| 9 | | R2-1 — Feed status writes bypass the read cap | **Partly resolved; P2 remains.** `internal/console/geoipfeed.go:174` still calls `Put`, and `internal/release/store.go:408` still reads the entire existing object with `os.ReadFile` before checking the write precondition. An oversized `feed.json` can exhaust memory despite the initial capped read. Apply the stat/streamed-hash checks already used by `PutFrom`, and test this underlying write path. | |
| 10 | | R2-2 — Timed-out checks never persist failures | **Resolved.** Status writes receive a separate bounded context. | |
| 11 | | R2-3 — Unreadable feed status clears an alert | **Resolved for established state.** Read and parse failures preserve the previous feed state. | |
| 12 | | R2-4 — Unusable directory prevents “not loaded” alert | **Resolved.** Control-plane state is retained before directory preparation. | |
| 13 | | R2-5 — Published alert reasons never change while unhealthy | **Resolved for publication.** Reason changes update `Value` and emit an event. | |
| 14 | | R3-1 — Console follower keeps serving an expired database | **Resolved.** Every tick checks the loaded reader independently of `current`; candidates also receive a metadata expiry check. | |
| 15 | | R3-2 — Transient status-read failure erases feed history | **Resolved.** An unsuccessful status read prevents replacement of unknown history. | |
| 16 | | R4-1 — Unbounded bucket operations block startup or publication | **Resolved.** Startup cleanup is asynchronous and bounded; maintenance receives bounded contexts; staging independently bounds its pointer read. | |
| 17 | | R4-2 — Restart falsely clears a persisted GeoIP alert | **Resolved for the reported unreadable-input cases.** Unknown state produces no metric reading, preserving the restored firing rule. The new guard introduces finding 1 below. | |
| 18 | | R4-3 — Email delivery suppresses active reason changes | **Partly resolved; P2 remains.** `internal/console/alertwatch.go:231–242` permanently records delivered reasons as `geoip@N=true`. After `2 → 3 → 0 → 2 → 3`, the second expiry notification is suppressed. Returning to a previously delivered reason within one firing episode is also suppressed. Persist the **last delivered reason per recipient**, preserving retries. Extend the test beyond its current `2 → 3 → 0` sequence. | |
| 19 | | R4-4 — Region guesses carry another generation’s attribution | **Resolved.** `recordingLocator` uses `Swappable.LocateFrom` to capture the lookup and its source under the same reader lock. | |
| 20 | |
| 21 | New findings: |
| 22 | |
| 23 | 1. **P2 — Unknown feed state suppresses an independently established expiry alert.** |
| 24 | `internal/edge/geoipmirror.go:554–557`: `AlertCode` returns no reading until both pointer and feed state are known, before checking any affirmative reason. On cold boot with a readable expired pointer and malformed or unreadable `feed.json`, polling confirms expiry and removes the database, but reason 3 never reaches the evaluator—even after its 30-minute sustain. An unrelated feed-status failure therefore hides a confirmed database failure indefinitely. Evaluate established unhealthy conditions before withholding an unknown reading; require sufficient knowledge before reporting recovery. Add a cold-start test combining an expired pointer with unreadable feed status and drive it through the evaluator. |
| 25 | |
| 26 | Validation was static. Targeted tests could not start because Go’s work directory was read-only; cross-compilation remains unverified. |
| 27 | |
| 28 | Verdict: revise. |
| 29 | |
amadan