| 1 | | Previous finding | Disposition | Evidence from revision 12 at `034727d4` | |
| 2 | |---|---|---| |
| 3 | | R3-1. Expiry/install races | Resolved | §5.3 retains candidate expiry checks and `genMu` serialization of installation, expiry and cleanup. | |
| 4 | | R3-2. Unprotected console `Locate` | Resolved | §5.4 requires locked `Swappable.Locate` and assigns the wrapper to `Config.GeoIP`. | |
| 5 | | R3-3. Coordinate-only results | Resolved | §8.1a accepts coordinate-only hits; §9 counts their country as `_unknown`. | |
| 6 | | R3-4. Heartbeat freshness | Resolved | §5.5 uses `status.BoxStale` and retains the jittered-heartbeat test. | |
| 7 | | R1-4, carried forward: orphan destruction | Resolved | §3 requires startup and daily orphan sweeps; §15 expires noncurrent versions. | |
| 8 | | R1-16, carried forward: rollout verification | Resolved | §5.5 requires every expected box to satisfy readiness; missing or unreadable expected heartbeats block. | |
| 9 | | R4-1. Duplicate tunnel analytics | Resolved | §§8.4 and 9 require zero remote observations and exactly one at the hub. | |
| 10 | | R4-2. Publication deadline across backhaul | Resolved | §4.2 retains staging followed by a 202 response and a polled publication job. | |
| 11 | | R5-1. Concurrent upload staging | Resolved | §4.2 reserves the mutex before reading the body and retains ownership through job cleanup. | |
| 12 | | R6-1. Plaintext tunnel cache mismatch | Resolved | D2 and §§8–9, 16 consistently require the transport-independent tunnel mark. | |
| 13 | | R6-2. Abandoned upload staging | Resolved | §4.2 retains the dedicated staging directory, startup cleanup and restart tests. | |
| 14 | | R7-1. Publication of expired candidates | Resolved | §4.1 rejects expired candidates, rechecks before pointer replacement and forbids a force override. | |
| 15 | | R7-2. Empty sanitized source | Resolved | §6 requires the valid fallback identifier `mmdb`. | |
| 16 | | R7-3. Attribution lost through overflow | Resolved | §9 exempts attributed sources from folding into `_other`. | |
| 17 | | R7-4. Interface discrepancies | Resolved | §§4.1 and 6 retain the corrected signatures and Unix-seconds conversion. | |
| 18 | | R8-1. Box identity namespaces | Resolved | §5.5 requires `(namespace, label)` throughout inventory matching and blockers. | |
| 19 | | R8-2. Shutdown propagation bound | Resolved | §4.2 specifies 11.5 minutes for edges and 12.5 for the console, conditional on successful pointer reads. | |
| 20 | | R8-3. Existing-blob verification | Resolved | §3 requires both SHA-256 and size to match before replacing the pointer. | |
| 21 | | R9-1. Readiness without database convergence | Resolved | §5.5 distinguishes unreadable, live, absent and expired pointers, including expiry determined by the clock. | |
| 22 | | R9-2. `off` waiting behind publication | Resolved | §4.2 requires immediate 409 while an upload or publication job holds the slot. | |
| 23 | | R10-1. Console-override expiry deferred past rollout | Resolved | §16 explicitly places protected override loading, startup expiry refusal and periodic closure in plan 1. | |
| 24 | | R11-1. Expiry clears the freshness alert before bucket marking | Resolved | §10.4 now recognizes marked **or clock-expired** pointers and retains their metadata after dropping the reader; §18 records delayed-marking, restart, fresh-publication and explicit-off tests. | |
| 25 | |
| 26 | No new findings. |
| 27 | |
| 28 | Verdict: accept. |
amadan