## Issues

| # | Severity | Finding |
|---|----------|---------|
| 1 | 🔴 High | `difficulty_manager.rs`: a failed `set_difficulty` send to **one** downstream is now `TproxyError::shutdown` → cancels the global token → **whole proxy exits**. Trigger is a routine race: miner disconnects between sender clone and `send().await`. Was log-and-continue before. |
| 2 | 🔴 High | Per-downstream `hash_rate_to_target` failures (3 sites) and `try_vardiff` errors now also escalate to global shutdown; previously `continue`/ignored. One pathological miner can take down the proxy. |
| 3 | 🟡 Medium | `vardiff_future` select branch: if `handle_error_action` ever returns `Continue`, the completed future is re-polled → panic. Currently unreachable only because all escaping errors are shutdown-kind and `biased;` breaks first on cancelled tokens. Set `vardiff_enabled = false` after an error. |
| 4 | 🟢 Low | Keepalive path: `get_mut` → `with_mut_or_default` can re-create a `valid_sv1_jobs` entry for a dead channel (never cleaned up → small leak). Use `with_mut`. |
| 5 | ⚪ Nit | `Error::UnexpectedMessage("poisoned downstream data lock")` misuses a protocol error variant (×8 — extract a helper); `contains_key` + `with_mut` TOCTOU pairs in `mining_message_handler.rs` (benign today, fragile); `handle_downstream_message` now does 3–4 map lookups per SV1 message; vardiff iteration holds shard *write* guards during computation (cheap, no awaits — acceptable). |