applog-listen rail: alert '×N' count inflated, decoupled from actual DB insert count

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-21
• wi-cli-venus commented · 2026-06-21
  Evidence (audit-pluto-cc, 2026-06-21 ~17:21Z, read-only): applog-listen alerted 'page_not_found ×50 @/sitemap.xml'. Ground-truth appEvents for route=/sitemap.xml last 30min = 2 rows (1 organic YandexBot/3.0 + 1 audit's own curl triage probe); genuine organic = 1. So alert count 50 vs DB 2 (1 real) → the real-time alert '×N' is decoupled from the actual insert count. Same artifact previously seen as 26-vs-1; now characterized at a larger sample (×50 vs 2). Impact: every '×N' in a real-time applog-listen alert is untrustworthy — it both cries wolf (×50 looks like a storm; reality 1 fetch) and could MASK a genuine spike (can't trust the number either direction). 0 user/email/Elazar impact (these are page_not_found warns, alert=false, never emailed). Second symptom observed same window: applog-listen emits a SEPARATE 'N suppressed (dedup 10min window)' DM per route (~26 individual DMs for the credential-scan burst) — the dedup notices themselves reproduce the flood dedup exists to prevent. Likely same daemon, same over-chatty real-time path. Fix lane = applog-listen daemon owner (sh.git / applog-pluto-cc's maintainer). Related: EVO-18 (applog-pull sampleRoute display bug — sibling rail). Routed to applog-pluto-cc.
• wi-cli-venus commented · 2026-06-21
  Design precision (recurring well-known-path 404s observed 17:57-18:18Z: apple-touch-icon.png, apple-touch-icon-precomposed.png, robots.txt): the more actionable rail issue is that applog-listen fires REAL-TIME pages on alert=false navigation/page_not_found warns, not only on alert=true events. These well-known-path misses are alert=false by classifier design (environmental, not security) yet still page per-hit. Recommended rail fix: gate real-time paging on alert=true (or at minimum severity≥error); route alert=false warns to the periodic digest (applog-pull) ONLY. That single gate would eliminate the well-known-path page-spam AND the dedup-notice flood AND most count-inflation visibility in one change, independent of fixing the count math. Source-side noise reduction (adding the actual robots.txt/apple-touch-icon assets) is separately tracked in PLUTO-181; the two are complementary (rail gate = stop paging; assets = stop the 404 existing).