carlos / platform Public

| Previous finding | Disposition | Evidence from revision 12 at 034727d4 | |---|---|---| | R3-1. Expiry/install races | Resolved | §5.3 retains candidate expiry checks and genMu serialization of installation, expiry and cleanup. | | R3-2. Unprotected console Locate | Resolved | §5.4 requires locked Swappable.Locate and assigns the wrapper to Config.GeoIP. | | R3-3. Coordinate-only results | Resolved | §8.1a accepts coordinate-only hits; §9 counts their country as _unknown. | | R3-4. Heartbeat freshness | Resolved | §5.5 uses status.BoxStale and retains the jittered-heartbeat test. | | R1-4, carried forward: orphan destruction | Resolved | §3 requires startup and daily orphan sweeps; §15 expires noncurrent versions. | | R1-16, carried forward: rollout verification | Resolved | §5.5 requires every expected box to satisfy readiness; missing or unreadable expected heartbeats block. | | R4-1. Duplicate tunnel analytics | Resolved | §§8.4 and 9 require zero remote observations and exactly one at the hub. | | R4-2. Publication deadline across backhaul | Resolved | §4.2 retains staging followed by a 202 response and a polled publication job. | | R5-1. Concurrent upload staging | Resolved | §4.2 reserves the mutex before reading the body and retains ownership through job cleanup. | | R6-1. Plaintext tunnel cache mismatch | Resolved | D2 and §§8–9, 16 consistently require the transport-independent tunnel mark. | | R6-2. Abandoned upload staging | Resolved | §4.2 retains the dedicated staging directory, startup cleanup and restart tests. | | R7-1. Publication of expired candidates | Resolved | §4.1 rejects expired candidates, rechecks before pointer replacement and forbids a force override. | | R7-2. Empty sanitized source | Resolved | §6 requires the valid fallback identifier mmdb. | | R7-3. Attribution lost through overflow | Resolved | §9 exempts attributed sources from folding into _other. | | R7-4. Interface discrepancies | Resolved | §§4.1 and 6 retain the corrected signatures and Unix-seconds conversion. | | R8-1. Box identity namespaces | Resolved | §5.5 requires (namespace, label) throughout inventory matching and blockers. | | R8-2. Shutdown propagation bound | Resolved | §4.2 specifies 11.5 minutes for edges and 12.5 for the console, conditional on successful pointer reads. | | R8-3. Existing-blob verification | Resolved | §3 requires both SHA-256 and size to match before replacing the pointer. | | R9-1. Readiness without database convergence | Resolved | §5.5 distinguishes unreadable, live, absent and expired pointers, including expiry determined by the clock. | | R9-2. off waiting behind publication | Resolved | §4.2 requires immediate 409 while an upload or publication job holds the slot. | | R10-1. Console-override expiry deferred past rollout | Resolved | §16 explicitly places protected override loading, startup expiry refusal and periodic closure in plan 1. | | R11-1. Expiry clears the freshness alert before bucket marking | Resolved | §10.4 now recognizes marked or clock-expired pointers and retains their metadata after dropping the reader; §18 records delayed-marking, restart, fresh-publication and explicit-off tests. |

No new findings.

Verdict: accept.