P1 findings: Daemon & Federation (coalescer race, async lock, route ordering)

[TusanHomichi]

Summary

Multiple P1-level issues found in the daemon and federation modules.

Findings

1. Event coalescer race condition

• Location: conary-server/src/daemon/ or conary-core/src/daemon/
• Issue: SSE event coalescer can drop events during high-frequency updates due to race between coalescing and flushing.
• Fix: Use atomic swap or channel-based coalescing.

2. Async lock held across await points

• Location: conary-server/src/daemon/
• Issue: std::sync::Mutex held across .await points, risking deadlock.
• Fix: Use tokio::sync::Mutex or restructure to drop lock before await.

3. Route ordering conflicts

• Location: conary-server/src/daemon/
• Issue: Route registration order causes some routes to shadow others (e.g., catch-all before specific paths).
• Fix: Register specific routes before catch-all handlers.