Cada proyecto serializa sus propios pushes y ninguno serializa contra los otros: cuatro gates de pre-push en 4 vCPUs llevaron a venus a load 47 y ningun proyecto pudo publicar

EVO-97 evolutiva Done urgent

supautils force-grants EXECUTE on new functions to PUBLIC/anon/authenticated despite default-privilege revocation - every Evolutiva CREATE FUNCTION needs an explicit same-migration REVOKE, and no commons file says so

EVO-114 evolutiva Done high

UPDATE OF keys on the statement SET list, not final NEW: every final-row-invariant trigger in the fleet using it is blind to a neighbouring trigger's rewrite

EVO-123 evolutiva Done high

api-images deploy manifest: inc/idempotency.php absent from RUNTIME_FILES (fatal 500 on every POST), plus two pre-existing require-order bugs that made every prior deploy serve 500s

EVO-122 evolutiva Done high

Venus-consolidation: unified service on host venus for Vercel/Supabase background work

EVO-86 evolutiva Done high

└─ EVO-86: unschedule pg_cron jobs 15/16 and drop the venus_cron_drain_bearer Vault secret, AFTER the host leg is verified

EVO-109 evolutiva Done

└─ EVO-86: install and arm the two venus-crontick@ user timers on host venus

EVO-108 evolutiva Done

evolutiva-emaildrain@.service exists on one disk: untracked, unsymlinked, no registry row - and it is now the only thing sending enamel's and terra's mail

EVO-96 evolutiva Done high

Email drain health check treats ok:false as success - fix the EVO-94 template

EVO-110 evolutiva Done high

Minimize non-actionable PM DMs at the ALERTER (not just app-side rows). Each alert DM = a PM turn = tokens (Elazar 2026-06-29). Scanner-probe silencing cut the warn ROWS fleet-wide (PLUTO-450/453/454 + mars/venus), but the applog/errscan digest still DMs each PM per tick incl non-actionable warn/info lines. RULE: alerter DMs a PM ONLY on level=error/fatal OR a genuinely NEW/unseen signature; NEVER re-DM known silent-tier (info/security) scanner shapes or recurring-benign signatures. Two legs: (1) shared errscan digest (owner bin-whey-cc, ~L244/L309 PM-digest render + the source view predicate) suppress non-error/non-novel; (2) per-project applog-pull digest (each PM's project) same predicate. Fleet-wide; all 3 PMs align in aro:evolutiva-management. Distinct from EVO-46 (count mislabel) though same render path.

EVO-47 evolutiva Done high

Render/server errors in appEvents (appLog): verify capture parity across pluto, mars, venus + fill gaps

EVO-4 evolutiva Done high

Push staged appEvents-standard + retired-identifiers commons edits once objection window closes (hub 07:58 / 10:58 UTC 2026-07-30)

EVO-85 evolutiva Done high

Un rol de dump sin BYPASSRLS produce un backup cuyo auth.users restaura VACIO y no falla en el momento del dump: verificar el credencial de cada lane de backup

EVO-98 evolutiva Done high

Automate the api-images operator-log read (.api-images.log)

EVO-92 evolutiva Done high

Fleet-wide Gmail dot/plus normalization: block duplicate accounts at the DATA LAYER (Mars+Pluto+Venus)

EVO-45 evolutiva Done high

global ~/.claude/CLAUDE.md HOT/COLD split to cut per-turn token load fleet-wide

EVO-44 evolutiva Done high

gdrive bisync down since ~May 16 (whey<->venus) — venus agents loading 2-week-stale evolutiva shared .md rules (missing WI#450 + A+B + any ratified change since May 16); fleet correctness/drift risk. Fix = repair rclone bisync (maintainer territory), then re-measure per-agent preload vs true current files.

EVO-43 evolutiva Done high

Trim auto-loaded context for mars/evolutiva sessions: evolutiva-commons.md (5.3k) + mars-commons.md (3.6k) + mars/CLAUDE.md (2.1k) + mars MEMORY.md (3.8k) = ~14.8k. Target <=8k total per-session auto-load. Editorial trim, Evolutiva PM executes. Detection side is WI 444 (memory-lint token alarm, 8k line). Surfaced by Elazar 2026-05-21 from a researcher-mars-cc /memory dump (~17k total).

EVO-42 evolutiva Done high

Email drain: kill ~288/day cron no-ops (Tier 0 EXISTS-guard) + DB-native trigger-wake (Tier 1)

EVO-70 evolutiva Done high

sexo: add 'No especificado' opt-out fleet-wide (keep required)

EVO-67 evolutiva Done high

Fleet lint matchBrace bug: no-silent-failure guard undercounts broken sites (destructured params / Promise generic returns)

EVO-53 evolutiva Done high

Solo-agent initiative: unified fleet protocol + named driving maintainer

EVO-50 evolutiva Done high

BUILD spawn-agent.sh + reaper (EVO-26 productionization; Elazar greenlit 2026-06-22). One-command on-demand worker spawn (task launch-arg'd) + PTD-gated external teardown. KEY CONSTRAINTS: tmux->ccs DIRECT via tmux-ccs.sh, NO extra terminal layer (Elazar caveat; extra PID=orphan bug); full -cc agent name (bare double-registers); external teardown only (agents can't self-/exit); /unregister SINGULAR {agent:x} per call (array form returns missing_agent), clean both -cc + bare rows; TTL hang-reaper must hub-deregister; reuse per-app agent dirs; shared-tree flock for mars/pluto. Script in ~/Documents/terminal/sh/ (shared, notify bin-whey per sh.git); PMs EXECUTE, bin OWNS+versions. Inputs from venus pilot EVO-33.

EVO-34 evolutiva Done high ↳ EVO-26

EVO-26 VENUS PILOT TEST (Elazar greenlit 2026-06-22): prove spawn-on-demand end-to-end on venus. PM spawns db+coder+audit via tmux-ccs.sh direct+launch-arg; db pulls 5 most-recent user logins; coder trivial edit (comment/line-move); audit verifies; commit via gitpush.sh; EXTERNAL teardown of all 3 (agents cannot self-/exit — reaper send-keys/kill-session + hub-deregister). Runs in aro:venus. Falsifiable proof: 5 logins + diff + audit verdict + commit sha + 3 confirmed deregistrations.

EVO-33 evolutiva Done high ↳ EVO-26

applog-listen rail robustness: IPv4 force + catch-up + heartbeat

EVO-5 evolutiva Done high

Fleet applog-listen repoint: LEG-2 = project-aro post (not 1:1 DM)

EVO-13 evolutiva Done high

└─ ayudarg: applog posts to aro:ayudarg + Elazar receives (LEG-2 verify); re-fire canonical test row b3de98a6 post-rollout

EVO-17 evolutiva Done high

└─ venus: applog posts to aro:venus + Elazar receives (LEG-2 verify)

EVO-14 evolutiva Done high

└─ mars: applog posts to aro:mars + Elazar receives (LEG-2 verify)

EVO-15 evolutiva Done high

└─ pluto: applog posts to aro:pluto + Elazar receives (LEG-2 verify)

EVO-16 evolutiva Done high

api-images tenant isolation: key->tenant binding, scoped serve/delete, per-tenant storage + stats, _trash TTL, server-side EXIF strip, backup (closes cross-tenant IDOR)

EVO-1 evolutiva Done high

EVO-12 regression: captureServer404 in not-found boundary fires on EVERY page view (false page_not_found rows fleet-wide)

EVO-19 evolutiva Done high

└─ pluto EVO-19 leg: two-sink fix; UA-tagged causal proof (5x /login -> 5 phantom rows on 200) + matcher-excluded empty-route blindspot; ship

EVO-22 evolutiva Done high

└─ ayudarg EVO-19 leg: pull captureServer404 out of not-found boundary; two-sink (catch-all + [id] throw-site capture); verify valid routes stop writing page_not_found

EVO-20 evolutiva Done high

└─ mars EVO-19 leg: two-sink fix; by-route 20x/login=1 floor likely higher under UA-tag; ship on body=(a) confirm

EVO-23 evolutiva Done high

└─ venus EVO-19 leg: two-sink fix (pull capture out of not-found boundary); corrected probe shows 200 GET /login wrote action=404/level=error/alert=true row firing real alert+email; demonstrated pollution -> ship

EVO-21 evolutiva Done high

404 telemetry: genuine-bad-route is returned for routes that exist, so the row sends triage after a missing route that is not missing

EVO-111 evolutiva Done

applog-pull digest: sampleRoute display bug — shows latest row route for all xN occurrences, implies all N at that route. Fix: qualify as latest@route or list distinct routes.

EVO-18 evolutiva Done

Trailing-newline URL 404s reach real users: a pasted link with %0A is fetched by a link-preview crawler and then clicked by a human

EVO-106 evolutiva Done

DB: mandate createdAt insert-timestamp fleet-wide (updatedAt recommended)

EVO-69 evolutiva Done

terra: retire /api/app-version, /api/health is the sole version+health surface

EVO-91 evolutiva Done

Commons dedup: delete drifted §Tooling-First from venus + pluto role files (terra DONE 8927d8d)

EVO-88 evolutiva Done

EVO-74 mars: schema-anchor check + read-only dupe candidate query

EVO-76 evolutiva Done ↳ EVO-74

EVO-74 venus: schema-anchor check + read-only dupe candidate query

EVO-78 evolutiva Done ↳ EVO-74

EVO-74 pluto: schema-anchor check + read-only dupe candidate query

EVO-77 evolutiva Done ↳ EVO-74

Auth: allow any genuine-Google-OAuth login, drop domain allowlist as login gate

EVO-68 evolutiva Done

Pluto friction-flash UI treatment — fleet distribution + mining-scope-widen lesson

EVO-66 evolutiva Done

Friction reduction on mars+venus intake forms, pluto /practicas/nueva as reference

EVO-64 evolutiva Done

SCANNER_PROBE_RE Block M/N fleet parity

EVO-61 evolutiva Done

Adopt Mars DB-editable domain allowlist fleet-wide (Q4a, Elazar 2026-07-17)

EVO-59 evolutiva Done

gitmerge.sh auto-commit bypasses gitpush --only -> sweeps co-workers dirty files onto remote (shared-tree hazard)

EVO-48 evolutiva Done

Setup file and scope: create ~/.claude/maintainer-agents.md skeleton, add lazy-load trigger to global CLAUDE.md, define section format (one ## per agent: scope/paths, authority, escalation)

EVO-38 evolutiva Done ↳ EVO-37

venus pool-acquire-timeout fix (PLUTO-145 class) — getPracticaLookups → 1 json-CTE, /practicas+/reportes lookups bundled

EVO-6 evolutiva Done

venus: adopt two-layer gitpush guard (strict --only + per-repo flock) per bs-mqoxiw8ptby

EVO-35 evolutiva Done ↳ EVO-26

venus compute region iad1→gru1 — co-locate with sa-east-1 DB, kills ~120ms cross-region RTT

EVO-7 evolutiva Done

Joomla /media/ scanner probe pages in all five apps - propagate one alt

EVO-115 evolutiva Done low

Hostinger image-storage monitoring (api-images)

EVO-58 evolutiva Done low

└─ api-images box stats.php threshold fallback still 80; only the box .env carries 75

EVO-118 evolutiva Done low

api-images: immediate-erasure endpoint (GDPR/right-to-erasure) — DELETE /{id}?purge=1 or /erase/{id} that skips _trash + unlinks immediately, tenant-scoped, audit-logged.

EVO-3 evolutiva Done low

canonicalizeEmail() prod-vs-source drift — SET search_path hardening absent from 000-initial migration; reprovision would drop it. Fix: forward idempotent migration to match prod; sweep other fns/triggers for same class.

EVO-8 evolutiva Done low

Email canonical generated column + read-side CI tripwire — emailCanonical GENERATED ALWAYS AS STORED + partial UNIQUE index pre-existing in prod; doc migration evo9-email-canonical-generated-column.sql added. Remaining: read-side CI tripwire (lookup paths use emailCanonical or canonicalized input)

EVO-9 evolutiva Done low