carlos / platform Public

| Previous finding | Disposition at c24b64d2 | |---|---| | R1-1 — Readiness without established database state | Resolved. Unknown pointers block readiness; off and expired pointers require empty mirrors. | | R1-2 — off waits behind publication | Resolved. TryLock returns 409 during publication. | | R1-3 — Unbounded console pointer reads | Resolved for reads. Pointer reads are streamed and capped. | | R1-4 — Recovery generation deleted after failed synchronization | Resolved for the reported installation paths. Cleanup preserves loaded and retained generations until synchronization succeeds. | | R1-5 — Rejected-upload test does not establish zero reads | Resolved at the reservation boundary. The panicking-reader test detects reads before slot reservation. | | R1-6 — Countries overflow ordering | Resolved. _other survives sorting and is relabelled during rendering. | | R2-1 — Feed status writes bypass the read cap | Partly resolved; P2 remains. internal/console/geoipfeed.go:174 still calls Put; internal/release/store.go:408 reads the entire existing object before checking its precondition. An oversized feed.json can still exhaust memory. Use the stat/streamed-hash checks implemented by PutFrom, and test the underlying write path. | | R2-2 — Timed-out checks never persist failures | Resolved. Status persistence receives a separate bounded context. | | R2-3 — Unreadable feed status clears an alert | Resolved. Read and parse failures preserve established feed state. | | R2-4 — Unusable directory prevents “not loaded” alert | Resolved. Control-plane state is retained before directory preparation. | | R2-5 — Published alert reasons never change while unhealthy | Resolved. Reason changes update Value and emit an event. | | R3-1 — Console follower keeps serving an expired database | Resolved. Each tick checks the loaded reader independently; candidate metadata is also checked. | | R3-2 — Transient status-read failure erases feed history | Resolved. Unknown history is not overwritten. | | R4-1 — Unbounded bucket operations block startup or publication | Resolved. Startup cleanup is asynchronous; maintenance and staging reads have deadlines. | | R4-2 — Restart falsely clears a persisted GeoIP alert | Resolved. Unknown inputs cannot establish recovery. | | R4-3 — Email delivery suppresses active reason changes | Resolved for the reported sequences. Successful delivery resets the other reason markers; tests cover repeated episodes and returning to an earlier reason. | | R4-4 — Region guesses carry another generation’s attribution | Resolved. Location and source are captured under the same reader lock. | | R5-1 — Unknown feed state suppresses confirmed expiry | Resolved. Established unhealthy conditions are evaluated before the unknown-state guard; the regression test includes evaluator sustain. |

New findings:

1. P2 — A failed startup deletion leaves a disabled feed’s alert firing indefinitely. internal/console/server.go:1445, internal/console/geoipfeed.go:365: unset CONSOLE_GEOIP_FEED and restart while feed.json records seven failures. If the startup deletion fails or times out, clearFeedStatus only logs the failure. Nothing retries deletion: the feeder is disabled, and maintenance sweeps only database blobs. After bucket access recovers, the console box continues reading the old failing status and reporting reason 5 indefinitely, contrary to §10.4’s clearing rule. Retry deletion with bounded attempts and backoff until successful or cancelled. Test a failed deletion followed by recovery without another restart.

Validation was static. Targeted tests could not start because Go’s work directory is read-only; cross-compilation remains unverified.

Verdict: revise.