| 1 | | Previous finding | Disposition | Evidence from revision 11 at `9146bd06` | |
| 2 | |---|---|---| |
| 3 | | R3-1. Expiry/install races | Resolved | §5.3 retains expiry checks before download and installation, with `genMu` serializing selection, expiry and cleanup. | |
| 4 | | R3-2. Unprotected console `Locate` | Resolved | §5.4 requires locked `Swappable.Locate` and assigns the wrapper to `Config.GeoIP`. | |
| 5 | | R3-3. Coordinate-only results | Resolved | §8.1a accepts coordinate-only hits; §9 counts their country as `_unknown`. | |
| 6 | | R3-4. Heartbeat freshness | Resolved | §5.5 retains `status.BoxStale` and the jittered-heartbeat test. | |
| 7 | | R1-4, carried forward: orphan destruction | Resolved | §3 retains startup and daily orphan sweeps, followed by §15’s noncurrent-version expiration. | |
| 8 | | R1-16, carried forward: rollout verification | Resolved | §5.5 requires every expected box to satisfy readiness; unreadable heartbeats block through missing expected identities. | |
| 9 | | R4-1. Duplicate tunnel analytics | Resolved | §§8.4 and 9 require zero remote observations and exactly one at the hub. | |
| 10 | | R4-2. Publication deadline across backhaul | Resolved | §4.2 retains staging followed by a 202 response and a polled publication job. | |
| 11 | | R5-1. Concurrent upload staging | Resolved | §4.2 reserves the mutex before reading the body and retains ownership through job cleanup. | |
| 12 | | R6-1. Plaintext tunnel cache mismatch | Resolved | D2 and §§8–9, 16 consistently require the transport-independent tunnel mark. | |
| 13 | | R6-2. Abandoned upload staging | Resolved | §4.2 retains the dedicated staging directory, startup cleanup and restart tests. | |
| 14 | | R7-1. Publication of expired candidates | Resolved | §4.1 rejects expired candidates, rechecks before pointer replacement and forbids a force override. | |
| 15 | | R7-2. Empty sanitized source | Resolved | §6 retains the valid fallback identifier `mmdb`. | |
| 16 | | R7-3. Attribution lost through overflow | Resolved | §9 exempts attributed sources from folding into `_other`. | |
| 17 | | R7-4. Interface discrepancies | Resolved | §§4.1 and 6 retain the corrected signatures and Unix-seconds conversion. | |
| 18 | | R8-1. Box identity namespaces | Resolved | §5.5 requires `(namespace, label)` throughout inventory, heartbeat matching and blockers. | |
| 19 | | R8-2. Shutdown propagation bound | Resolved | §4.2 now specifies 11.5 minutes for edges and 12.5 for the console, conditional on successful pointer reads. | |
| 20 | | R8-3. Existing-blob verification | Resolved | §3 requires both SHA-256 and size to match before replacing the pointer. | |
| 21 | | R9-1. Readiness without database convergence | Resolved | §5.5 now treats a pointer past D1’s deadline as expired even before it is marked; the status handler checks the clock. | |
| 22 | | R9-2. `off` waiting behind publication | Resolved | §4.2 requires immediate 409 while an upload or publication job holds the slot. | |
| 23 | | R10-1. Console-override expiry deferred past rollout | Resolved | §16 explicitly places protected override loading, startup expiry refusal and periodic closure in plan 1; `openGeoIP` implements that lifecycle independently of the deployment store. | |
| 24 | |
| 25 | 1. **P2 — §§5.3, 10.4: expiry can clear the freshness alert before the console marks the pointer.** Consider a manually published GeoLite2 database with no feed. Its age alert is already firing when the edge’s expiry ticker closes the reader. The loaded-database reasons then disappear, but §10.4’s expired-pointer reason requires `"expired": true`. The console may not write that flag until its next daily maintenance pass. Following these predicates can therefore report recovery precisely when GeoIP becomes unavailable, contrary to the requirement that expiry never clears an alert. Treating the unmarked pointer as live merely substitutes the delayed missing-generation alert and still permits a clearing interval. |
| 26 | |
| 27 | **Evidence:** [geoipmirror.go:431](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/geoip-for-apps/internal/edge/geoipmirror.go:431) expires the reader locally; [geoipmirror.go:225](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/geoip-for-apps/internal/edge/geoipmirror.go:225) clears its loaded metadata. Bucket expiry runs only every 24–25 hours at [server.go:1422](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/geoip-for-apps/internal/console/server.go:1422). The existing alert machinery clears on the first below-threshold reading at [alert.go:172](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/geoip-for-apps/internal/metrics/alert.go:172). |
| 28 | |
| 29 | **Fix:** make the alert’s expiry predicate match §5.5: marked expired **or** past D1 by the clock. Retain the observed pointer’s metadata after dropping the reader. Require the existing alert to remain firing across that transition, and test delayed bucket marking, restart with an expired unmarked pointer, fresh publication and explicit `off`. |
| 30 | |
| 31 | Verdict: revise. |
amadan