carlos / platform Public

| Previous finding | Disposition at aaa1434e | |---|---| | R1-1 — Readiness without established database state | Resolved. Unknown pointers block readiness; off and expired pointers require empty mirrors. | | R1-2 — off waits behind publication | Resolved. TryLock returns 409 while publication holds the slot. | | R1-3 — Unbounded console pointer reads | Resolved for reads. Pointer reads are streamed and capped. | | R1-4 — Recovery generation deleted after failed synchronization | Resolved for the reported installation paths. Loaded and retained generations survive installation failures and unsuccessful synchronization. | | R1-5 — Rejected-upload test does not establish zero reads | Resolved at the reservation boundary. The panicking-reader test detects reads before reservation. | | R1-6 — Countries overflow ordering | Resolved. _other remains intact until rendering and sorts last. | | R2-1 — Feed status writes bypass the read cap | Partly resolved; P2 remains. geoipfeed.go:174 still calls Put; release/store.go:408 reads the entire existing object before checking its precondition. An oversized feed.json can still exhaust memory. Apply the stat/streamed-hash precondition checks used by PutFrom. | | R2-2 — Timed-out checks never persist failures | Resolved. Status persistence gets a separate bounded context. | | R2-3 — Unreadable feed status clears an alert | Resolved. Read and parse failures preserve established feed state. | | R2-4 — Unusable directory prevents “not loaded” alert | Resolved. Pointer state is retained before directory preparation. | | R2-5 — Published alert reasons never change while unhealthy | Resolved. Reason changes update Value and emit an event. | | R3-1 — Console follower keeps serving an expired database | Resolved. Loaded-reader expiry is checked independently of local state and candidate loading. | | R3-2 — Transient status-read failure erases feed history | Resolved. Unknown history is not overwritten. | | R4-1 — Unbounded bucket operations block startup or publication | Resolved for the reported paths. Startup cleanup is asynchronous; maintenance and staging reads have deadlines. | | R4-2 — Restart falsely clears a persisted GeoIP alert | Resolved. Unknown inputs cannot establish recovery. | | R4-3 — Email delivery suppresses active reason changes | Resolved. Successful delivery records the last reason per recipient and resets other reason markers. | | R4-4 — Region guesses carry another generation’s attribution | Resolved. Location and source are captured under one reader lock. | | R5-1 — Unknown feed state suppresses confirmed expiry | Resolved. Established unhealthy conditions are evaluated before the unknown-state guard. | | R6-1 — Failed startup deletion leaves a disabled feed alert firing indefinitely | Resolved. Deletion retries with bounded attempts and capped exponential backoff until success or cancellation. The regression test covers recovery without restart. |

New findings:

1. P2 — Unbounded feed edition metadata can make both control records unreadable. internal/console/geoipfeed.go:244, internal/console/geoippublish.go:263: Last-Modified is checked only for emptiness, then copied into the published pointer and feed status. A malformed provider or redirect response containing a 70 KiB value, followed by an otherwise valid archive and checksum, produces records exceeding their 64 KiB read caps. Publication succeeds and sweeps the previous blob, but mirrors cannot read the new pointer and feed-status readers reject the new history. Validate and bound the edition before publication, and enforce serialized control-record limits before writing. Test oversized metadata while a usable generation is published; refusal must preserve that generation.

1. P2 — Successful unchanged-edition checks can leave the feed reported as “not run yet.” internal/console/geoipfeed.go:114: disable the feed, allowing startup cleanup to delete feed.json, then re-enable it while its current edition remains published. Both providers’ unchanged-edition paths return an empty edition. Check clears failure counters but never sets LastSuccess or LastEdition, so carlos system geoip status reports “not run yet” despite successful daily checks, potentially for the rest of the DB-IP month. Return the confirmed current edition and record successful checks consistently. Test re-enabling with an existing pointer and absent feed status.

Validation was static. Targeted tests could not start because Go’s work directory is read-only; cross-compilation remains unverified.

Verdict: revise.