| Previous finding | Disposition at `4287f396` |
|---|---|
| R1-1 — Readiness without established database state | Remains resolved. |
| R1-2 — `off` waits behind publication | Remains resolved. |
| R1-3 — Unbounded console pointer reads | Remains resolved for reads. |
| R1-4 — Recovery generation deleted after failed synchronization | Remains resolved for the reported paths. |
| R1-5 — Rejected-upload test does not establish zero reads | Remains resolved. |
| R1-6 — Countries overflow ordering | Remains resolved. |
| R2-1 — Feed status writes bypass the read cap | **Resolved.** `DirStore.Put` now uses `os.Stat` for create-only writes and `hashFile` for replacement checks, preserving conditional-write semantics with bounded memory. The added regression test checks allocations against a 256 MiB existing object and verifies successful replacement. |
| R2-2 — Timed-out checks never persist failures | Remains resolved for download timeouts. |
| R2-3 — Unreadable feed status clears an alert | Remains resolved. |
| R2-4 — Unusable directory prevents “not loaded” alert | Remains resolved. |
| R2-5 — Published alert reasons never change while unhealthy | Remains resolved. |
| R3-1 — Console follower keeps serving an expired database | Remains resolved. |
| R3-2 — Transient status-read failure erases feed history | Remains resolved. |
| R4-1 — Unbounded bucket operations block startup or publication | Remains resolved for the reported operations. |
| R4-2 — Restart falsely clears a persisted GeoIP alert | Remains resolved. |
| R4-3 — Email delivery suppresses active reason changes | Remains resolved. |
| R4-4 — Region guesses carry another generation’s attribution | Remains resolved. |
| R5-1 — Unknown feed state suppresses confirmed expiry | Remains resolved. |
| R6-1 — Failed startup deletion leaves a disabled feed alert firing indefinitely | Remains resolved. |
| R7-1 — Unbounded feed edition metadata makes control records unreadable | Remains resolved. |
| R7-2 — Unchanged-edition checks leave the feed reported as “not run yet” | Remains resolved. |
| R8-1 — MMDB verification indefinitely holds the publish slot | Remains resolved for the reported traversal attacks. |
| R9-1 — Malformed MMDB metadata can crash the entire console | Remains resolved for the reported arithmetic panic. |
| R10-1 — Verifier child has no memory bound | Remains resolved on Linux for the reported allocation attack. |
| R10-2 — Retained recovery generations survive GeoLite2 expiry | Remains resolved for the reported synchronization failure. |
| R11-1 — Verified database crashes serving processes during lookup | Remains resolved for the reported stack-exhaustion path. |
| R12-1 — Underscore header spellings bypass stripping | Remains resolved. |

Unchanged dispositions carry forward round 13’s conclusions; this review covers `6bdaba34..4287f396`.

New findings: none confirmed.

Validation: static review of both changed Go files and relevant callers. Scoped whitespace and formatting checks passed. Targeted Go tests could not start because the read-only sandbox refused build-directory creation; runtime tests and cross-compilation remain unverified.

Verdict: merge-ready.