[PAC-114] docs+test(nginx): PAC-14 §4 pointer, D-8 amendment marker, build-time VITE_SENTRY_DSN rollback; whitespace-only Sentry origin fails closed (#280)

PAC-86 review follow-ups, items 2 and 4 (item 1, DSN rotation, is an
operator action and is not part of this change).

- contracts/features/PAC-14.md: §4 points to the PAC-86 frontend
  amendment in §2; §7 rollback item 3 gets an amendment note:
  VITE_SENTRY_DSN is inlined at build time, so it is not a runtime kill
  switch (rebuild, or unset NGINX_CSP_SENTRY_ORIGIN to block events).
  Approved text kept.
- contracts/features/PAC-14.yaml: rollback line corrected the same way.
- docs/specs/NEW-deploy-hardening.md: amendment marker on D-8, which still
  described the default Sentry origin.
- nginx/test/nginx_test.go: TestWhitespaceOnlySentryOriginRefusesToStart:
  " ", "   " and a space-padded origin are refused by the render step
  (nginx does not start). Mutation-checked: trimming spaces in the render
  script makes it fail.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: Enach

contracts/features/PAC-14.md

@@ -127,6 +127,11 @@ func main() {
 
 Target repo: `Enach/smart-calendar-flow` (React, bun).
 
+- **Amended (pointer added by PAC-114, 2026-11-14).** The frontend init below is
+  amended by PAC-86: there is **no default DSN**, and the `?? "<DSN>"` fallback
+  is superseded. The amendment note sits in §2 ("Amended by PAC-86"), next to
+  the backend's PAC-81 amendment. The text below is kept as PAC-14 approved it.
+
 - Install `@sentry/react`. Initialize once at the app entrypoint, **before** the
   React tree mounts:
 
@@ -215,6 +220,15 @@ schema, any `frontend/` source (separate repo), any secret/credential file.
    `VITE_SENTRY_DSN` (frontend) -> init degrades to "monitoring disabled" on next
    start, so monitoring can be turned off without reverting code.
 
+   **Amended by PAC-114 (2026-11-14).** Item 3 holds for the backend only:
+   `SENTRY_DSN` is read at process start, so unsetting it and restarting turns
+   backend monitoring off. `VITE_SENTRY_DSN` is not a runtime kill switch: Vite
+   inlines it at build time, so turning web monitoring off means rebuilding and
+   redeploying the frontend image without it. Without a rebuild, unsetting
+   `NGINX_CSP_SENTRY_ORIGIN` and restarting nginx removes the Sentry origin from
+   `connect-src` (PAC-86), so browsers block the events. The text above is kept
+   as PAC-14 approved it.
+
 ---
 
 ## 8. Release gates

contracts/features/PAC-14.yaml

@@ -35,5 +35,5 @@
     "Frontend error boundary captures a render exception and shows fallback UI.",
     "Contract/provider/consumer tests must pass locally before implementation approval."
   ],
-  "rollback": "Revert the implementation PRs and keep the approved contract revision immutable. Runtime kill switch: unset SENTRY_DSN / VITE_SENTRY_DSN."
+  "rollback": "Revert the implementation PRs and keep the approved contract revision immutable. Runtime kill switch (backend only): unset SENTRY_DSN and restart the backend. VITE_SENTRY_DSN is set at build time, not a runtime kill switch: turn web monitoring off by rebuilding and redeploying the frontend without it, or, without a rebuild, by unsetting NGINX_CSP_SENTRY_ORIGIN and restarting nginx so the CSP blocks the events (amended by PAC-114, 2026-11-14; see contracts/features/PAC-14.md section 7)."
 }

docs/specs/NEW-deploy-hardening.md

@@ -1150,6 +1150,12 @@ Factory-assumed (pending challenge):
   no wildcard; AC-B4) + operator-configured origins; `object-src 'none'`;
   `base-uri 'self'`; `form-action 'self'`; `frame-ancestors 'none'`. Enforced,
   because AC-B3 proves zero violations with a positive and negative control.
+  **Amended by PAC-86 (2026-11-14; marker added by PAC-114).** The Sentry
+  ingest origin has no default any more: the web has no hard-coded DSN, so with
+  `NGINX_CSP_SENTRY_ORIGIN` unset or empty `connect-src` holds no Sentry origin,
+  and when set it holds exactly that origin, which must be the origin of the
+  frontend build's `VITE_SENTRY_DSN`. See AC-B4's amendment. The text above is
+  kept as approved.
 - **D-9. Real client in nginx**: right-most address not in the trusted list,
   recursive; list empty by default (spoofing impossible; limits shared until
   configured; the runbook makes configuring it a deploy step).

nginx/test/nginx_test.go

@@ -279,6 +279,30 @@ func TestInvalidSettingsRefuseToStart(t *testing.T) {
 	}
 }
 
+// PAC-114: a whitespace-only NGINX_CSP_SENTRY_ORIGIN is not "unset". It is
+// neither treated as empty (no Sentry origin) nor trimmed: the render step
+// refuses it, so nginx does not start. The refusal must name the setting, so
+// it comes from the validation and not from a broken generated config.
+func TestWhitespaceOnlySentryOriginRefusesToStart(t *testing.T) {
+	t.Parallel()
+	stub := startStub(t)
+	for what, v := range map[string]string{
+		"one space":       " ",
+		"several spaces":  "   ",
+		"space-padded ok": " https://o1.ingest.sentry.example ",
+	} {
+		env := map[string]string{"NGINX_CSP_SENTRY_ORIGIN": v}
+		out, err := runNginxOnce(t, stub, env, "nginx", "-t")
+		if err == nil {
+			t.Errorf("%s: started with %q; want a refusal\n%s", what, env, out)
+			continue
+		}
+		if !strings.Contains(out, "paceday-render: NGINX_CSP_SENTRY_ORIGIN") {
+			t.Errorf("%s: refused, but not by the NGINX_CSP_SENTRY_ORIGIN check\n%s", what, out)
+		}
+	}
+}
+
 func TestConfigLoads(t *testing.T) {
 	t.Parallel()
 	stub := startStub(t)