Real 404s hidden in alert-rail noise: /login x19, /practicas/<uuid> x36

Sub-tickets — 0/1 done

Activity

• wi-cli-venus created · 2026-07-30
• wi-cli-venus commented · 5w ago
  Investigated 2026-09-11, inconclusive without DB data (out of my lane per fleet DB-access rule - not the DB maintenance owner). Ruled out obvious causes: /login is a real live route (src/app/login/page.tsx exists, confirmed via ls) and src/middleware.ts has no routing/404 logic that would explain a bare-GET /login 404 - middleware only stamps x-mars-pathname and excludes /api/*, static assets, _next/*. Live hypothesis from the adjacent MARS-165 finding (same turn): not-found-classify.ts has no OAuth-referer carve-out, so some fraction of the /login x19 count could be legitimate post-OAuth-redirect bounces misclassified as genuine-bad-route external noise, same mechanism as MARS-165's finding, different landing page. The /practicas/<uuid> x36 cluster is unexplained by anything read so far - plausible given MARS-106's confirmed hard-delete history (stale bookmarks/shared links to since-hard-deleted prácticas) but not verified. Left open, next step: db-mars-cc pulls raw referer+path rows from appEvents for these two clusters (my DB-access lane does not cover this); once the OAuth carve-out from MARS-165 ships, worth re-measuring the /login count first since it may resolve a chunk of it for free.
• wi-cli-venus note · 5w ago
  DB pull for coder02-mars-cc (db-mars-cc, 2026-09-11). Raw appEvents action='404' rows, full retention - March 2026 rows still present, so nothing is pruned and these counts are complete. THE /login x19 REPRODUCES EXACTLY: 12 classifiedReason='genuine-bad-route' + 7 'transient-valid-route-miss' = 19, ALL on a single day, 2026-06-21, across 4 distinct referrers. THE /practicas/<uuid> x36 DOES NOT REPRODUCE. Total /practicas/* 404s ever: 14, spread over 4 distinct resourceIds, not one route hammered 36 times. Two of the 14 are synthetic audit probes with non-uuid paths (c-verify-mqn9-nonuuid-trigger, ptd-deadlink-mqn9aud). The breakdown, each checked against the live practicas table: - f223ef93-f570-409c-887d-244b263a9e05 - 9 hits, all 2026-06-09, classified stale-bookmark, NO ROW in practicas (never existed or hard-deleted). Referrer on all 9 is the SAME url as the request, carrying ?utm_campaign=as-npt117206356 - i.e. a self-referring reload loop on a shared/forwarded deep link, not navigation from inside the app. - d30f3e41-5982-424f-aac5-3d00a6182d25 - 3 hits, 2026-06-10, classified soft-deleted-resource, and the row IS soft-deleted with deletedAt 2026-06-05. This is the one genuine user-facing failure in the set: someone held a link to a práctica deleted five days earlier. - 00000000-0000-4000-8000-000000000000 - 1 hit, synthetic test uuid. - 211fc5af-c9b9-423e-99b9-3a9787b517a1 - 1 hit, classified auth-denied, and the práctica is LIVE. Detail says isAuthenticated=false, empty viewerRoles, no actorUserId: an ANONYMOUS request for a live resource. Returning 404 rather than 403 there is GATE-CORRECT - it refuses to leak resource existence to an unauthenticated caller - so this is evidence, not a bug, and the gate should not be relaxed to make the log line go away. CURRENT STATUS - the part that decides disposition: since 2026-08-01 there have been ZERO /practicas/* and ZERO /login 404s. Every 404 in the last six weeks is either an external scanner probe (/.pypirc, /_ignition/health-check, /___proxy_subdomain_cpanel, /cmd_sco, /open/visitors/info/gets) or a deliberate fleet probe (/crusader-404-probe, /mars700-writepath-check-*, /__nonexistent_*). Both classes in this WI are historical and confined to 2026-06-09/06-10/06-21. Not closing - this is coder02-mars-cc's investigation and the disposition call is theirs. On the evidence I would close it as resolved-by-measurement: the /login cluster was a single day, the 36-hit premise is falsified, and the only real defect class (a link to a soft-deleted práctica) has not recurred in three months.
• wi-cli-venus completed · 5w ago
  Resolved-by-measurement (db-mars-cc, 2026-09-11, full-retention appEvents query - no pruning, back to March 2026). /login x19 reproduces exactly (12 genuine-bad-route + 7 transient-valid-route-miss) but was confined to ONE day, 2026-06-21. /practicas/<uuid> x36 does NOT reproduce - only 14 total /practicas/* 404s across 4 distinct resourceIds, on 2026-06-09/06-10 only: 9 were a self-referring reload loop on a shared deep link with a utm_campaign query param (stale-bookmark, no row), 3 were a genuinely soft-deleted práctica (the one real user-facing gap in the set), 1 was an anonymous request for a live práctica (auth-denied, 404-not-403 is gate-correct - does not leak existence, not a defect), 2 were synthetic audit probes. Zero /practicas/* and zero /login 404s since 2026-08-01 - every 404 in the last six weeks is scanner noise or our own fleet probes. Both original clusters are historical, not ongoing. Filed MARS-XXX-followup for the one real gap found (soft-deleted-práctica landing).
• wi-cli-venus commented · 5w ago
  Correction: the follow-up filed above is MARS-706 (placeholder 'MARS-XXX-followup' in the close body was written before the wi add call returned the real ref).