From 3deb1b88883dd37ef5ca13eef52cb7b6c5cb16a8 Mon Sep 17 00:00:00 2001
From: shad <shad@flow-master.ai>
Date: Sun, 14 Jun 2026 21:02:52 +0400
Subject: [PATCH] fix(oracle-l8-r4): scrub demo.flow-master.ai from Telemetry +
 Landing

Oracle round-9 watch-out: same liveMeta.fetchedFrom leak class
existed in two more user-visible surfaces:

- src/components/Telemetry.tsx: 'source' block rendered the host
  string. Now hard-coded 'EA2'.
- src/scenes/Landing.tsx: hero paragraph said 'runs end-to-end
  through EA2 on <host>'. Dropped the host suffix entirely.

liveMeta import removed from Telemetry (no other refs). Landing
still uses liveMeta for the workItems/distinctDefs stat counters.
---
 qa/probe_landing.mjs         | 21 +++++++++++++++++++++
 src/components/Telemetry.tsx |  4 ++--
 src/scenes/Landing.tsx       |  3 +--
 3 files changed, 24 insertions(+), 4 deletions(-)
 create mode 100644 qa/probe_landing.mjs

diff --git a/qa/probe_landing.mjs b/qa/probe_landing.mjs
new file mode 100644
index 0000000..022ad0c
--- /dev/null
+++ b/qa/probe_landing.mjs
@@ -0,0 +1,21 @@
+import { chromium } from "playwright";
+const args = ["--host-resolver-rules=MAP canvas.flow-master.ai 65.21.71.186", "--ignore-certificate-errors"];
+const b = await chromium.launch({ headless: true, args });
+const ctx = await b.newContext({ viewport: { width: 1440, height: 900 } });
+const p = await ctx.newPage();
+p.on("response", async (r) => {
+  if (/\/api\/v1\/auth\/dev-login|\/api\/v1\/auth\/me/.test(r.url())) {
+    console.log(`[${r.status()}] ${r.url().replace("https://canvas.flow-master.ai","")}`);
+  }
+});
+await p.goto("https://canvas.flow-master.ai/", { waitUntil: "networkidle" });
+await p.waitForTimeout(800);
+await p.locator(".persona-chip", { hasText: /Mariana/ }).click();
+await p.locator(".dev-login-btn").click();
+console.log("clicked dev-login, waiting for landing");
+await p.waitForSelector(".hero-actions", { timeout: 30000 }).catch((e) => console.log("hero-actions timeout:", e.message));
+await p.waitForTimeout(2000);
+const chips = await p.locator(".hub-chip").allTextContents();
+console.log("chip count:", chips.length);
+console.log("chips:", chips.slice(0, 12).map(s => s.trim()));
+await b.close();
diff --git a/src/components/Telemetry.tsx b/src/components/Telemetry.tsx
index 6fb4474..5f6f898 100644
--- a/src/components/Telemetry.tsx
+++ b/src/components/Telemetry.tsx
@@ -5,7 +5,7 @@
 // The "ui tick" dot is a UI heartbeat labelled as such.
 import { useEffect, useMemo, useState } from "react";
 import { useApp, scenarioById } from "../state/store";
-import { liveMeta } from "../data/scenarios";
+
 import { Pulse, Spark } from "./icons";
 
 function Sparkline({ values, color, label }: { values: number[]; color: string; label: string }) {
@@ -117,7 +117,7 @@ export default function Telemetry() {
       </div>
       <div className="t-block">
         <span className="t-eyebrow">source</span>
-        <span className="t-v mono">{liveMeta.fetchedFrom?.replace("https://", "") ?? "—"}</span>
+        <span className="t-v mono">EA2</span>
       </div>
       <div className="t-tick" aria-label="ui tick" title="UI heartbeat — pulses every 1.5s, does not represent backend activity" />
     </div>
diff --git a/src/scenes/Landing.tsx b/src/scenes/Landing.tsx
index cb0ad55..d167a85 100644
--- a/src/scenes/Landing.tsx
+++ b/src/scenes/Landing.tsx
@@ -51,8 +51,7 @@ export default function Landing() {
             FlowMaster turns the operational map of a company into living,
             typed processes — backed by humans, agents, and rules — and gives you
             one control surface to drive them. Every procurement, finance, people,
-            and service workflow runs end-to-end through EA2 on{" "}
-            <span className="mono">{liveMeta.fetchedFrom?.replace("https://", "") ?? "the FlowMaster backend"}</span>.
+            and service workflow runs end-to-end through EA2.
           </p>
           <div className="hero-actions">
             <button className="btn btn-primary btn-lg" onClick={() => setScene("mission")}>