Sub-ticket of ONEDB-15 Lezama telemetry repoint: DSN still targets dead whey-tunnel 172.30.0.1; decide venus-PG repoint vs retire. Step 1 (nw-lezama): test TCP 91.99.136.171:5432 from lezama (GCABA egress 80/443-only suspected). Open->repoint DSN + nw-venus pg_hba grant for lezama egress (IP rotates - needs range or hostssl). Blocked->Elazar governance call (retire lezama telemetry writes vs spool-sync) per Lezama-RESTRICTED policy. Interim: JSONL spool = no data loss; nw-lezama stops sys-check.timer if erroring hard. Also: whey pg_hba:136 dead 172.30.0.2/32 telemetry_rw line - nw-whey pulls it whichever branch wins. · one-db