So a client can get the analysis done and leave it unpublished if they don't like the results? Maybe that's standard practice but it doesn't seem great for users.
There's no "standard practice" that I know of--very few people are doing this kind of work. Behind every one of these analyses is weeks of contract negotiation where I try to convince assorted lawyers & CFOs to go along with my weird, idealistic ethical policies. And conversely, those lawyers and CFOs do their best to balance the desire for correctness with their duty to protect the company. This policy outlines how we compromise.
Originally I did offer a client veto, because clients weren't willing to sign without some assurance of control over the outcome. My current standard contract for analyses actually drops that client veto: I have final say on the analysis content and publication. There's still a grace period to allow the vendor to fix bugs & get things in order. I'm adopting this as the standard going forward, but it's been a long road to get there.
That said, I do perform private consulting--usually for in-house systems, sometimes for clients that can't afford a full analysis, and sometimes as a precursor to more involved work. That means that yes, vendors may be aware of bugs and I won't have told you about them--but I promise that my public work remains honest and forthcoming.
Curious, is there any single book you would say you've found to be the equivalent of say CLRS but for the fundamentals of distributed computing paradigms?
My current plan for deep diving into distributed systems theory has just been to go through resources like "Distributed systems for fun and profit", and aggregated lists/overviews like https://henryr.github.io/distributed-systems-readings/ and your distsys-class notes and then just DFS into certain topics from there - compared to the approach I've been taking with deep diving into OS and database theory which is just to go through text books like Operating System Concepts and Database System Concepts while applying the theory in side projects.
> "Once I've prepared a written analysis, the client may defer publication by up to three months. This gives the client a chance to understand the faults I've identified, attempt to fix bugs, update documentation, and deploy fixes to users."
So, a client can get the analysis done and attempt to defer publication for three months, after which time it'll be published. No?