carlos / platform Public

| Previous finding | Disposition | Evidence from revision 10 at f83276b7 | |---|---|---| | R3-1. Expiry/install races | Resolved | §5.3 retains expiry checks before download and installation, with genMu serializing selection, expiry and cleanup. | | R3-2. Unprotected console Locate | Resolved | §5.4 specifies locked Swappable.Locate and assigns the wrapper to Config.GeoIP. | | R3-3. Coordinate-only results | Resolved | §8.1a accepts coordinate-only hits; §9 counts their country as _unknown. | | R3-4. Heartbeat freshness | Resolved | §5.5 retains status.BoxStale and the jittered-heartbeat test. | | R1-4, carried forward: orphan destruction | Resolved | §3 retains startup and daily orphan sweeps, followed by §15’s noncurrent-version expiration. | | R1-16, carried forward: rollout verification | Resolved | §5.5 now makes unreadable heartbeats block through missing expected identities and requires every expected box to satisfy readiness. | | R4-1. Duplicate tunnel analytics | Resolved | §§8.4 and 9 retain zero remote observations and exactly one at the hub. | | R4-2. Publication deadline across backhaul | Resolved | §4.2 retains staging followed by a 202 response and a polled publication job. | | R5-1. Concurrent upload staging | Resolved | §4.2 retains mutex reservation before reading the body and ownership through job cleanup. | | R6-1. Plaintext tunnel cache mismatch | Resolved | D2 and §§8–9, 16 consistently require the transport-independent tunnel mark. | | R6-2. Abandoned upload staging | Resolved | §4.2 retains the dedicated staging directory, startup cleanup and restart tests. | | R7-1. Publication of expired candidates | Resolved | §4.1 rejects expired candidates, rechecks before pointer replacement and forbids a force override. | | R7-2. Empty sanitized source | Resolved | §6 retains the valid fallback identifier mmdb. | | R7-3. Attribution lost through overflow | Resolved | §9 exempts attributed sources from folding into _other. | | R7-4. Interface discrepancies | Resolved | §§4.1 and 6 retain the corrected signatures and Unix-seconds conversion. | | R8-1. Box identity namespaces | Resolved | §5.5 requires (namespace, label) throughout inventory, heartbeat matching and blockers. | | R8-2. Shutdown propagation bound | Partly resolved | §5.3 now bounds pointer reads at 30 seconds and qualifies read failures, giving 11.5 minutes. §4.2 still promises 11 minutes for edges and 12 for the console. Update these to 11.5 and 12.5 minutes, conditional on successful reads. | | R8-3. Existing-blob verification | Resolved | §3 requires both SHA-256 and size to match before replacing the pointer. | | R9-1. Readiness without database convergence | Partly resolved | §5.5 defines the required states, but apisystemgeoip.go:144 recognizes expiry only through cur.Expired. A database past D1’s deadline remains classified as live until the console marks it. Also evaluate geoip.Expired against the current time; test an expired, unmarked pointer with both loaded and empty mirrors. | | R9-2. off waiting behind publication | Resolved | §4.2 explicitly requires immediate 409 while an upload or publication job holds the slot; Off now uses TryLock. |

1. P2 — §§0 D1, 11.3, 15–16: the plan split leaves console-override expiry behind the initial rollout. D1 requires the console to close an expired CONSOLE_GEOIP_DB mapping. §16 includes GeoLite2 expiry in plan 1 but assigns the console reader work to plan 3 without explicitly separating the existing override’s expiry lifecycle. §15 permits deployment after plan 1. An implementer following that division can therefore ship edge expiry while region guesses continue using an expired override indefinitely.

Evidence: at f83276b7, main.go:296 still assigns openGeoIP directly to Config.GeoIP; main.go:1149 opens and returns the raw mapping without an expiry check or ticker. internal/console/server.go:1421 starts maintenance for the bucket publisher only; it does not expire that reader.

Fix: explicitly place override expiry in plan 1, while leaving mirrored-file following and the endpoint in plan 3. Require a protected reader, rejection of already-expired overrides at startup, and periodic closure at expiry even when no deployment store is configured. Test startup and expiry transitions through the region-guess caller.

Verdict: revise.