Blocked spare or undistributed bridges
When written, Lox did not consider that spare/undistributed bridges may become blocked. In Lox's threat model, if bridges aren't distributed, this shouldn't happen. However, since rdsys is the source of truth for whether or not bridges are blocked, it's theoretically possible that a spare or undistributed bridge may be marked as blocked in a certain region in rdsys, despite that bridge not having been distributed.
In reality though, might a bridge actually be marked as blocked if it hasn't been distributed (i.e., if it only exists in a spare bucket)?
One way I'm imagining this could happen is if a particular block of bridges that have a common feature are blocked. We may assume, or test these bridges for reachability, and determine that they are blocked, regardless of whether or not they have been distributed. However, I think in most situations like this we would not consider these bridges as being blocked as a result of a censor blocking a bridge they learned about through Lox. In this case, we could just call these bridges not-working
and replace them with working
bridges rather than marking them as blocked and allowing migrations to new buckets.
If there are additional instances where bridges that are not distributed are marked as blocked though, these bridges should be handled differently. There's no point in having marked a spare bridge as blocked since it hasn't been distributed, so it should just be removed. The Lox authority currently does not include this logic, but could if necessary. Probably Lox will have to be deployed for sometime before we can definitively say whether or not there is any reason to consider this problem.