venus EVO-19 leg: two-sink fix (pull capture out of not-found boundary); corrected probe shows 200 GET /login wrote action=404/level=error/alert=true row firing real alert+email; demonstrated pollution -> ship

Sub-tickets — 1/1 done

Questions

Activity

• wi-cli-venus created · 2026-06-21
  parent=#1255
• wi-cli-venus commented · 2026-06-21
  BLAST-RADIUS CONFIRMED (db-venus, decisive triplet): (1) ORGANIC false emails to Elazar = ZERO; alert=true/email total = 8, ALL ours (probes), organic = 0 -> his concern clean, no real false alert reached him from venus. (2) traffic-absence NOT immunity, CONFIRMED by direct test: a document-shaped request (Sec-Fetch-Dest: document = real-browser hard-nav) on /login 200 FIRED a phantom 404 row -> zero organic browser rows = venus has ~zero real browser traffic (pre-go-live, agents only curl), NOT browser exemption. (3) blindspot-clean: zero empty/null-route rows, the zero-organic read is real not a hidden-route artifact. ACCURATE IMPACT LINE (venus): LOW today (0 emails reached Elazar, pre-go-live) -> HIGH at go-live (every student browser hard-loading /login or any valid full-document page fires a false 404 alert+email). venus fix = go-live-grade prevention, not optional. This document-request test also resolves the fleet every-render-vs-curl-only tension: the mechanism DOES fire on real browser hard-nav; apps showing zero organic are traffic-limited, not immune.
• wi-cli-venus commented · 2026-06-21
  PROGRESSION (on-ARO visible per new incident model): audit diff-gate PASS - all 3 ayudarg gotchas covered (catch-all manifest-skip, inline capture no Promise<never>, 6 real server-throws); not-found.tsx stripped to pure UI = phantom cure. coder freeze-handshaking + pushing -> audit PTD (build+runtime+live-version + /login-phantom-gone + public-unmatched-logs-once smoke) -> PASS:<sha> pending. Venus referer-discriminator (over-escalation) NOT folded into this push per pm-venus scope call - filed as optional low-pri classifier-parity follow-up under EVO-21.
• wi-cli-venus completed · 2026-06-21
  GREEN — audit PASS:fdee1c9 / v0.65.3. Two-sink shipped: not-found.tsx pulled to pure UI + catch-all sink B. Phantom CURED: /login valid-200 x5 -> 0 navigation/404 rows (was 1 pre-fix). Catch-all /login/zzz -> real 404 + exactly 1 deduped own-route row. 3 ayudarg gotchas covered; manifest stays 39 templates (no pollution). Live /api/health 0.65.3 + deploymentId match, runtime clean 15min. Venus confirmation triplet for Elazar close: 0 organic false emails reached Elazar (pre-go-live) / traffic-absence-not-immunity (doc-shape probe fired) / would over-escalate at go-live -> fixed as PREVENTION. Follow-ups: VENUS-34 referer-parity (optional low-pri); practicas/[id] redirect telemetry gap (separate WI if wanted).