carlos / platform Public

| Previous finding | Disposition | Evidence from revision 11 at 9146bd06 | |---|---|---| | R3-1. Expiry/install races | Resolved | §5.3 retains expiry checks before download and installation, with genMu serializing selection, expiry and cleanup. | | R3-2. Unprotected console Locate | Resolved | §5.4 requires locked Swappable.Locate and assigns the wrapper to Config.GeoIP. | | R3-3. Coordinate-only results | Resolved | §8.1a accepts coordinate-only hits; §9 counts their country as _unknown. | | R3-4. Heartbeat freshness | Resolved | §5.5 retains status.BoxStale and the jittered-heartbeat test. | | R1-4, carried forward: orphan destruction | Resolved | §3 retains startup and daily orphan sweeps, followed by §15’s noncurrent-version expiration. | | R1-16, carried forward: rollout verification | Resolved | §5.5 requires every expected box to satisfy readiness; unreadable heartbeats block through missing expected identities. | | R4-1. Duplicate tunnel analytics | Resolved | §§8.4 and 9 require zero remote observations and exactly one at the hub. | | R4-2. Publication deadline across backhaul | Resolved | §4.2 retains staging followed by a 202 response and a polled publication job. | | R5-1. Concurrent upload staging | Resolved | §4.2 reserves the mutex before reading the body and retains ownership through job cleanup. | | R6-1. Plaintext tunnel cache mismatch | Resolved | D2 and §§8–9, 16 consistently require the transport-independent tunnel mark. | | R6-2. Abandoned upload staging | Resolved | §4.2 retains the dedicated staging directory, startup cleanup and restart tests. | | R7-1. Publication of expired candidates | Resolved | §4.1 rejects expired candidates, rechecks before pointer replacement and forbids a force override. | | R7-2. Empty sanitized source | Resolved | §6 retains the valid fallback identifier mmdb. | | R7-3. Attribution lost through overflow | Resolved | §9 exempts attributed sources from folding into _other. | | R7-4. Interface discrepancies | Resolved | §§4.1 and 6 retain the corrected signatures and Unix-seconds conversion. | | R8-1. Box identity namespaces | Resolved | §5.5 requires (namespace, label) throughout inventory, heartbeat matching and blockers. | | R8-2. Shutdown propagation bound | Resolved | §4.2 now specifies 11.5 minutes for edges and 12.5 for the console, conditional on successful pointer reads. | | R8-3. Existing-blob verification | Resolved | §3 requires both SHA-256 and size to match before replacing the pointer. | | R9-1. Readiness without database convergence | Resolved | §5.5 now treats a pointer past D1’s deadline as expired even before it is marked; the status handler checks the clock. | | R9-2. off waiting behind publication | Resolved | §4.2 requires immediate 409 while an upload or publication job holds the slot. | | R10-1. Console-override expiry deferred past rollout | Resolved | §16 explicitly places protected override loading, startup expiry refusal and periodic closure in plan 1; openGeoIP implements that lifecycle independently of the deployment store. |

1. P2 — §§5.3, 10.4: expiry can clear the freshness alert before the console marks the pointer. Consider a manually published GeoLite2 database with no feed. Its age alert is already firing when the edge’s expiry ticker closes the reader. The loaded-database reasons then disappear, but §10.4’s expired-pointer reason requires "expired": true. The console may not write that flag until its next daily maintenance pass. Following these predicates can therefore report recovery precisely when GeoIP becomes unavailable, contrary to the requirement that expiry never clears an alert. Treating the unmarked pointer as live merely substitutes the delayed missing-generation alert and still permits a clearing interval.

Evidence: geoipmirror.go:431 expires the reader locally; geoipmirror.go:225 clears its loaded metadata. Bucket expiry runs only every 24–25 hours at server.go:1422. The existing alert machinery clears on the first below-threshold reading at alert.go:172.

Fix: make the alert’s expiry predicate match §5.5: marked expired or past D1 by the clock. Retain the observed pointer’s metadata after dropping the reader. Require the existing alert to remain firing across that transition, and test delayed bucket marking, restart with an expired unmarked pointer, fresh publication and explicit off.

Verdict: revise.