| 1 | | Previous finding | Disposition | Evidence from revision 10 at `f83276b7` | |
| 2 | |---|---|---| |
| 3 | | R3-1. Expiry/install races | Resolved | §5.3 retains expiry checks before download and installation, with `genMu` serializing selection, expiry and cleanup. | |
| 4 | | R3-2. Unprotected console `Locate` | Resolved | §5.4 specifies locked `Swappable.Locate` and assigns the wrapper to `Config.GeoIP`. | |
| 5 | | R3-3. Coordinate-only results | Resolved | §8.1a accepts coordinate-only hits; §9 counts their country as `_unknown`. | |
| 6 | | R3-4. Heartbeat freshness | Resolved | §5.5 retains `status.BoxStale` and the jittered-heartbeat test. | |
| 7 | | R1-4, carried forward: orphan destruction | Resolved | §3 retains startup and daily orphan sweeps, followed by §15’s noncurrent-version expiration. | |
| 8 | | R1-16, carried forward: rollout verification | Resolved | §5.5 now makes unreadable heartbeats block through missing expected identities and requires every **expected** box to satisfy readiness. | |
| 9 | | R4-1. Duplicate tunnel analytics | Resolved | §§8.4 and 9 retain zero remote observations and exactly one at the hub. | |
| 10 | | R4-2. Publication deadline across backhaul | Resolved | §4.2 retains staging followed by a 202 response and a polled publication job. | |
| 11 | | R5-1. Concurrent upload staging | Resolved | §4.2 retains mutex reservation before reading the body and ownership through job cleanup. | |
| 12 | | R6-1. Plaintext tunnel cache mismatch | Resolved | D2 and §§8–9, 16 consistently require the transport-independent tunnel mark. | |
| 13 | | R6-2. Abandoned upload staging | Resolved | §4.2 retains the dedicated staging directory, startup cleanup and restart tests. | |
| 14 | | R7-1. Publication of expired candidates | Resolved | §4.1 rejects expired candidates, rechecks before pointer replacement and forbids a force override. | |
| 15 | | R7-2. Empty sanitized source | Resolved | §6 retains the valid fallback identifier `mmdb`. | |
| 16 | | R7-3. Attribution lost through overflow | Resolved | §9 exempts attributed sources from folding into `_other`. | |
| 17 | | R7-4. Interface discrepancies | Resolved | §§4.1 and 6 retain the corrected signatures and Unix-seconds conversion. | |
| 18 | | R8-1. Box identity namespaces | Resolved | §5.5 requires `(namespace, label)` throughout inventory, heartbeat matching and blockers. | |
| 19 | | R8-2. Shutdown propagation bound | Partly resolved | §5.3 now bounds pointer reads at 30 seconds and qualifies read failures, giving 11.5 minutes. §4.2 still promises 11 minutes for edges and 12 for the console. Update these to 11.5 and 12.5 minutes, conditional on successful reads. | |
| 20 | | R8-3. Existing-blob verification | Resolved | §3 requires both SHA-256 and size to match before replacing the pointer. | |
| 21 | | R9-1. Readiness without database convergence | Partly resolved | §5.5 defines the required states, but [apisystemgeoip.go:144](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/geoip-for-apps/internal/console/apisystemgeoip.go:144) recognizes expiry only through `cur.Expired`. A database past D1’s deadline remains classified as live until the console marks it. Also evaluate `geoip.Expired` against the current time; test an expired, unmarked pointer with both loaded and empty mirrors. | |
| 22 | | R9-2. `off` waiting behind publication | Resolved | §4.2 explicitly requires immediate 409 while an upload or publication job holds the slot; `Off` now uses `TryLock`. | |
| 23 | |
| 24 | 1. **P2 — §§0 D1, 11.3, 15–16: the plan split leaves console-override expiry behind the initial rollout.** D1 requires the console to close an expired `CONSOLE_GEOIP_DB` mapping. §16 includes GeoLite2 expiry in plan 1 but assigns the console reader work to plan 3 without explicitly separating the existing override’s expiry lifecycle. §15 permits deployment after plan 1. An implementer following that division can therefore ship edge expiry while region guesses continue using an expired override indefinitely. |
| 25 | |
| 26 | **Evidence:** at `f83276b7`, [main.go:296](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/geoip-for-apps/cmd/console/main.go:296) still assigns `openGeoIP` directly to `Config.GeoIP`; [main.go:1149](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/geoip-for-apps/cmd/console/main.go:1149) opens and returns the raw mapping without an expiry check or ticker. `internal/console/server.go:1421` starts maintenance for the bucket publisher only; it does not expire that reader. |
| 27 | |
| 28 | **Fix:** explicitly place override expiry in plan 1, while leaving mirrored-file following and the endpoint in plan 3. Require a protected reader, rejection of already-expired overrides at startup, and periodic closure at expiry even when no deployment store is configured. Test startup and expiry transitions through the region-guess caller. |
| 29 | |
| 30 | Verdict: revise. |
amadan