| 1 | | Previous finding | Disposition at `c24b64d2` | |
| 2 | |---|---| |
| 3 | | R1-1 — Readiness without established database state | **Resolved.** Unknown pointers block readiness; off and expired pointers require empty mirrors. | |
| 4 | | R1-2 — `off` waits behind publication | **Resolved.** `TryLock` returns 409 during publication. | |
| 5 | | R1-3 — Unbounded console pointer reads | **Resolved for reads.** Pointer reads are streamed and capped. | |
| 6 | | R1-4 — Recovery generation deleted after failed synchronization | **Resolved for the reported installation paths.** Cleanup preserves loaded and retained generations until synchronization succeeds. | |
| 7 | | R1-5 — Rejected-upload test does not establish zero reads | **Resolved at the reservation boundary.** The panicking-reader test detects reads before slot reservation. | |
| 8 | | R1-6 — Countries overflow ordering | **Resolved.** `_other` survives sorting and is relabelled during rendering. | |
| 9 | | R2-1 — Feed status writes bypass the read cap | **Partly resolved; P2 remains.** `internal/console/geoipfeed.go:174` still calls `Put`; `internal/release/store.go:408` reads the entire existing object before checking its precondition. An oversized `feed.json` can still exhaust memory. Use the stat/streamed-hash checks implemented by `PutFrom`, and test the underlying write path. | |
| 10 | | R2-2 — Timed-out checks never persist failures | **Resolved.** Status persistence receives a separate bounded context. | |
| 11 | | R2-3 — Unreadable feed status clears an alert | **Resolved.** Read and parse failures preserve established feed state. | |
| 12 | | R2-4 — Unusable directory prevents “not loaded” alert | **Resolved.** Control-plane state is retained before directory preparation. | |
| 13 | | R2-5 — Published alert reasons never change while unhealthy | **Resolved.** Reason changes update `Value` and emit an event. | |
| 14 | | R3-1 — Console follower keeps serving an expired database | **Resolved.** Each tick checks the loaded reader independently; candidate metadata is also checked. | |
| 15 | | R3-2 — Transient status-read failure erases feed history | **Resolved.** Unknown history is not overwritten. | |
| 16 | | R4-1 — Unbounded bucket operations block startup or publication | **Resolved.** Startup cleanup is asynchronous; maintenance and staging reads have deadlines. | |
| 17 | | R4-2 — Restart falsely clears a persisted GeoIP alert | **Resolved.** Unknown inputs cannot establish recovery. | |
| 18 | | R4-3 — Email delivery suppresses active reason changes | **Resolved for the reported sequences.** Successful delivery resets the other reason markers; tests cover repeated episodes and returning to an earlier reason. | |
| 19 | | R4-4 — Region guesses carry another generation’s attribution | **Resolved.** Location and source are captured under the same reader lock. | |
| 20 | | R5-1 — Unknown feed state suppresses confirmed expiry | **Resolved.** Established unhealthy conditions are evaluated before the unknown-state guard; the regression test includes evaluator sustain. | |
| 21 | |
| 22 | New findings: |
| 23 | |
| 24 | 1. **P2 — A failed startup deletion leaves a disabled feed’s alert firing indefinitely.** |
| 25 | [internal/console/server.go:1445](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/geoip-for-apps/internal/console/server.go:1445), [internal/console/geoipfeed.go:365](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/geoip-for-apps/internal/console/geoipfeed.go:365): unset `CONSOLE_GEOIP_FEED` and restart while `feed.json` records seven failures. If the startup deletion fails or times out, `clearFeedStatus` only logs the failure. Nothing retries deletion: the feeder is disabled, and maintenance sweeps only database blobs. After bucket access recovers, the console box continues reading the old failing status and reporting reason 5 indefinitely, contrary to §10.4’s clearing rule. Retry deletion with bounded attempts and backoff until successful or cancelled. Test a failed deletion followed by recovery without another restart. |
| 26 | |
| 27 | Validation was static. Targeted tests could not start because Go’s work directory is read-only; cross-compilation remains unverified. |
| 28 | |
| 29 | Verdict: revise. |
| 30 | |
amadan