Elazar decision: authorize coder03-mars-ca + db03-mars-ca as rows in mars-commons.md, or the codex switch cannot land code on Mars

MARS-734 mars Done urgent

P0: Mars production database is in READ-ONLY mode - all writes failing

MARS-700 mars Done urgent

docentes/[id] still RSC-crashing post-v1.82.1 (digest 3811385828, eventId 5401bdaf)

MARS-263 mars Done urgent

SMTP fully broken: SMTP_HOST env var has literal \n suffix -> EDNS getaddrinfo fail, ALL outbound email fails (notify/review/migration). Fix: defensive .trim() on SMTP_* env reads in mailer config + correct Vercel env vars.

MARS-319 mars Done urgent

BUG: número de documento input invisible on /practicas/nueva (CSS regression from v1.54 form-field width fix)

MARS-223 mars Done urgent

chat-duo Elazar Pending pane refreshes mid-type → loses user input. Bug: pane re-render clobbers focused input field. Owner: llmmsg-srv-cc-w (chat-duo).

MARS-290 mars Done urgent

Práctica date off-by-one: stored/displayed -1 day from entered

MARS-286 mars Done urgent

PROD-DOWN: práctica create fails — studentAssignmentsArchive trigger fn still INSERTs dropped isDemo column (MARS-78 class, slipped table)

MARS-88 mars Done urgent

The identity resolver's exact-legajo arm can never match a self-service access request against a bulk-imported user: the form stores bare 377/21, the roster stores OD-0377/21

MARS-797 mars Done high

Resolve db-mars-cc registry ownership after approved retirement

MARS-740 mars Done high

support-admin: no way to close an access request that duplicates an account the person already uses - access-reject emails a false denial

MARS-776 mars Blocked high

/practicas list query hit the 10s statement_timeout twice for a real user: CTEs aggregate all practicas' teeth and images per call

MARS-736 mars Blocked high

Safeguard forced práctica unlock with student save grace period and teacher confirmation

MARS-738 mars Blocked high

EVO-12 mars leg: server-side 404/error capture replacing the client-only rail (filed because the leg lived only in an event body for 82 days)

MARS-724 mars Blocked high ↳ EVO-12

SOP support-api: stakeholder-pair-only private comments (CRUD + notify shipped)

MARS-467 mars Blocked high ↳ EVO-52

Support API: restrict internal-note visibility to Elazar plus ticket stakeholder

MARS-732 mars Blocked high

Disk used-vs-provisioned alarm: unreachable from SQL, and autoscale reports configured while inert below LARGE compute

MARS-711 mars Blocked high

statement_timeout errors spreading beyond MARS-736 scope: /practicas/[id] POST actions, /comisiones/[id], /alumnos

MARS-743 mars Blocked high

pg_net EXECUTE to PUBLIC: measure whether this ref grants net.http_post to every login role

MARS-712 mars Blocked high

Supabase saturation: instance-wide execution stalls (Oct-5 class) + PostgREST retry loop + Nano tier - root cause and fix plan (planning cost UNMEASURED: track_planning off)

MARS-769 mars Blocked high

/practicas/[id] detail route has 40 statement timeouts in 11 clusters, separate from list

MARS-798 mars Done high

Monitor WAL file count + archiver failures - 34h of failed archiving went completely unseen

MARS-703 mars Blocked high

db-breaker-open telemetry is written through the breaker it reports, so the pool-counter row is shed on every open

MARS-735 mars Done high

assignment-set is dead on arrival in production: malformed array literal "admin" - every call 500s and no reassignment can be made

MARS-778 mars Done high

Agent ops on support-action: access-request/user/role/assignment (Elazar GO 2026-09-22)

MARS-759 mars Done high

permission denied for table practicaHistorialEntries on practica/create - user-facing write path broken

MARS-770 mars Done high

Duplicate-conducto guard is the dominant practica-form rejection (29/32 in 30d)

MARS-766 mars Done high

/estadisticas/clinico broken for all users since the role cutover: mars_app_runtime lacks EXECUTE on fdi_tooth_class, called by 3 security_invoker views

MARS-737 mars Done high

image-proxy connect timeouts to api.pensanta.com - upstream unreachable from Vercel egress, api-images unowned

MARS-677 mars Done high

mars_app_runtime cutover returned dbOk:false in prod - diagnose before re-attempting

MARS-694 mars Done high

Set statement_timeout at the ROLE level (ALTER ROLE): unsettable from the client under Supavisor transaction mode, so MARS-695 could not include it

MARS-696 mars Done high

Four archive trigger functions wrap fn_normalize_archive_reason in EXCEPTION WHEN OTHERS and write archiveReason NULL on ANY failure - a permission denial is indistinguishable from a forgotten setArchiveContext after the fact

MARS-710 mars Done high

Connection-acquisition circuit breaker in src/lib/db.ts (2026-09-04 pool exhaustion): trip on the Supavisor ECHECKOUTTIMEOUT signature, not on pool.waitingCount

MARS-695 mars Done high

Nested pool checkout inside an open transaction (approve access request) - deadlock at 6 slots

MARS-689 mars Done high

Mars unreachable 2026-09-05 22:10-22:43Z: postgres accepted no connections on four independent paths

MARS-698 mars Done high

Remove approved-practica follow-up radiographs (unrequested feature)

MARS-686 mars Done high

Retro-review the 6 unreviewed deep commits shipped 2026-08-25..08-27 by coder-mars-ca

MARS-682 mars Done high

Clear BLOCK:4713c06 - orphaned follow-up radiograph blobs, permanent success-disabled state, Postgres boundary

MARS-683 mars Done high

Mars backup covers public+auth ONLY - measured impact is cron.job + supabaseMigrations, storage is empty

MARS-667 mars Done high

Mars demo-concept eradication: sweep-to-zero + ban-guard (bs-mrteu5nvtt6)

MARS-542 mars Done high

Orphan-image cleanup: a failed success-log counted as a failed delete (audit P1 on 18b5ec4)

MARS-660 mars Done high

Adopt .gitpush-strict marker in Mars repo root to prevent add -A peer-WIP sweeps

MARS-30 mars Done high

Investigate Supabase MCP permission errors when creating views — db-mars-cc fell back to psql (db-mars-cc-20437). Likely missing GRANT for MCP role. Affects all 3 projects.

MARS-291 mars Done high

eq (Elazar Questions) — decoupled-from-bwi pending-Qs tracker; 3-PM consensus + Elazar approval pm-mars-cc-18608/18632; venus stub in flight

MARS-289 mars Done high

Unify JTP and Ayudante: identical roles app-wide (caps + UI)

MARS-281 mars Done high

Email migration notice: 31 non-standard-email users

MARS-275 mars Done high

Raise coder/coder02/db/db02 auto-compact window to 400k (CLAUDE_CODE_AUTO_COMPACT_WINDOW in each agent's own .claude/settings.json)

MARS-644 mars Done high

Rectificaciones fix: (A) DB sweep 10 stuck-rectificar comA practas to noRevisado, (B) exempt rectificar from review dedup so re-rectificar works, (C) Reenviada-tras-rectificar badge on noRevisado rows, (D) teacher notification email on student resubmit

MARS-316 mars Done high

Solicitudes de acceso: role (student vs teacher) not visually clear — Estudiante tag present but teacher-like fields (Cátedra postgrado, JTP/Ayudante) rendered alongside, confusing reviewer

MARS-315 mars Done high

Ayuda y Soporte: in-app support-ticket flow — global FAB + Dialog + supportTickets table + internal-email notify Elazar on creation + Vercel cron hourly digest DM to PM + watchdog open-count poll (per Elazar -36580 + pm-mars-cc design -36593)

MARS-312 mars Done high

Enumerate legitimate DB principals for Mars (fleet DB-hardening step 2)

MARS-620 mars Done high

Enable log_connections (or equivalent) on Mars Supabase DB

MARS-619 mars Done high

Fix /administrar/usuarios throwing past 500 active users - add server-side pagination

MARS-615 mars Done high

SOP-MARS-39: período endDate silently blocked ALL práctica filing for 2026-1C-Grado cohort since 2026-08-01 (4-day undetected outage)

MARS-607 mars Done high

Materia-dimension migration 099/100: setActivePeriodo cross-materia blackout + createPeriodo missing materiaOptionId

MARS-606 mars Done high

SMTP host/port/secure validating resolver — replace the || default on the email-send path

MARS-601 mars Done high

Foto de perfil obligatoria para alumnos + foto del alumno en la UI de corrección

MARS-600 mars Done high

Repoint 5 remaining APP_URL fallback sites to resolveSiteOrigin()

MARS-599 mars Done high

/solicitar-acceso GET not genuine-Google gated (asymmetric with SUBMIT)

MARS-573 mars Done high

Disable GoTrue email/password provider (external_email_enabled)

MARS-570 mars Done high

Remove dangling Vercel preview-alias from GoTrue uri_allow_list (evolutiva-m-pensanta-com.vercel.app)

MARS-569 mars Done high

image-proxy profile-image gate not widened for /usuarios peer directory — students get broken avatars

MARS-558 mars Done high

review:locked-by-student strands práctica ungradeable on abandoned student edit (no lock TTL/override)

MARS-547 mars Done high

auth/callback rejects dangling supabaseAuthId as takeover instead of rebinding — 79 legacy users latent-locked-out

MARS-548 mars Done high

EVO-79 mars leg: access-request dedup PREVENTION — attach Google identity to existing pre-created account on confident match, not a 2nd user

MARS-532 mars Done high

EVO-71 mars: sweep live public fns for residual PUBLIC/anon/authenticated EXECUTE (supautils force-grant bypasses ALTER DEFAULT PRIVILEGES) + object-class probe

MARS-522 mars Done high ↳ EVO-71

EVO-68 Mars leg: replace email-DOMAIN login gate with genuine-Google-identity gate in auth/callback

MARS-518 mars Done high

Restore reportedPracticeDate required + drop today-default (reverse MARS-509 over-relaxation) + add to EVO-66 flash set

MARS-515 mars Done high

Create bedel account (magali.ayelen020@gmail.com) with /estadisticas access

MARS-441 mars Done high

SOP-27 follow-up: JTP-scoping/duplication/attribution/metrics bugs across /alumnos /practicas /informes /comisiones

MARS-471 mars Done high

└─ JTP-of-whom rebuild from práctica picks (Q2 systemic reconcile) + own-students-first visibility (Q1) — Elazar-ruled

MARS-474 mars Done high

└─ Informes differing-cells nondeterminism: same comision/URL renders different aprobacion/latencia/alumno-count across viewers minutes apart

MARS-473 mars Done

Slow-query regression: json_agg lookup-label query mean 5.9s

MARS-484 mars Done high

EVO-54 phase 1: demo/seed data debt inventory

MARS-481 mars Canceled high

fn_notify_applog_err 404 signature collapse — fleet-wide alert-dedup bug

MARS-439 mars Done high

Harden cron_auth_header(): REVOKE EXECUTE FROM PUBLIC + lock search_path

MARS-380 mars Done high

SOP-MARS-27: resolve support ticket — student JTP-pick secret

MARS-469 mars Done high

Runtime/toolchain + dependency upgrade baseline (fleet-wide reference)

MARS-449 mars Done high

Fix /administrar dup-title+stale-sidebar bug; extend header/breadcrumb pattern fleet-wide across admin section

MARS-450 mars Done high

Harden Postgres against trigger-bypassing hard-deletes on practicas + add deletion-integrity detection

MARS-435 mars Done high

Recover content of 2 untraced hard-deleted prácticas (f223ef93, cc487cbb) from pre-deletion backups

MARS-436 mars Done high

Mars alert rail blind: applog-mars pruned from aro:mars, error pages silently dropped

MARS-431 mars Done high

vFrictionEvents LIMIT 1000 truncates human admin logs dashboard - add all-time uncapped view

MARS-427 mars Done high

Friction-telemetry unification: one feedback chokepoint, canonical category=toast+mechanism, server-action transport, complete logs friction view

MARS-419 mars Done high

Security: revoke default anon/authenticated SELECT grants across Mars public schema (83 relations incl appEvents family)

MARS-416 mars Done high

No-silent-failure contract (Mars lane): audit census + author shared mutation-wrapper/form-hook/lint-guard + codify contract in commons

MARS-408 mars Done high

Harden /api/log-error (auth+rate-limit+body-cap)

MARS-393 mars Done high

Codex audit — P0 security/forensics: resume-link fail-closed + appEvents storage-key strip (7 sites) + userRoles role-change changelog

MARS-38 mars Done high

Harden INNER JOINs to lookupOptions that drop a live row if a status/programa lookup is ever deleted (soporte + alumnos)

MARS-166 mars Done high

Mars DB scaling: migrate serverless runtime from direct-5432 to Supavisor transaction pooler (6543); reserve direct-5432 for weekly-kpi cron + migrations/seed; cut runtime pg.Pool max 16->~3; audit+cap per-request concurrent-query fan-outs (mirror Pluto mapWithConcurrency); pre-flight named-prepared-statement check (txn mode drops them). 3-PM consensus bs-mql6kqmrm6j, Venus=reference (already on pooler). One-env-var + cron carve-out, reversible.

MARS-145 mars Done high

agent-local context-warn statusLine hook (clone pluto reference at 100k/150k/200k/300k)

MARS-276 mars Done high

Lane A: /practicas pagination + filters + drop HARD_LIMIT — wire existing filter-bar/pagination/search-input components, URL-synced searchParams, default pageSize=50, server-pushed filters

MARS-249 mars Done high

Lane B: /administrar/usuarios/[id]/editar — unified user-edit page mirroring crear-form (kind picker + identity + roles + comisión + JTP + ayudante + periodo); replaces modal-in-grid + read-only detail pages

MARS-253 mars Done high

KPI row collapses to column on mobile — should stay side-by-side (Total/Sin calificar/Aprobadas/Desaprobadas)

MARS-225 mars Done high

Bedel can create alumno from /administrar/alumnos: full form on-page (pulldowns), no popup, no two-step user-then-role

MARS-256 mars Done high

Welcome email on user creation: createAlumnoWithUser (and other create-user surfaces) sends Spanish welcome email via existing nodemailer mailer.ts; fire-and-forget, graceful no-op if SMTP not configured

MARS-257 mars Done high

/notificaciones page has dead/old paths leading to 404 — audit links, fix or remove the page

MARS-258 mars Done high

audit codebase: wrap server components/actions/handlers in try/catch + reusable soft-landing error UI; trace digest 4277881123 (RSC sanitized prod error)

MARS-259 mars Canceled high

Soft-land all RSC errors; trace digest 4277881123

MARS-260 mars Done high

fix /administrar/docentes/[id] RSC crash (digest 1647002915, eventId c3cd6e9c)

MARS-261 mars Done high

Fix /administrar/docentes/[id] RSC crash UNAUTHORIZED

MARS-262 mars Canceled high

Lock sqlite mirror scope to lookupOptions; drop PII; gitpush-pre mtime lint

MARS-264 mars Done high

merge users Felicitas Cava: A=81694c6a (old, dangling auth) → B=0872484c (active Google OAuth)

MARS-265 mars Done high

Luana Lazarte: update existing user email+authId to gmail, close pending accessRequest

MARS-266 mars Done high

mergeUsers: set loser.surrogateOfUserId=keeper at soft-delete (audit BLOCK)

MARS-269 mars Done high

count users with non-gmail/non-pensanta/non-institutional login emails + email all

MARS-270 mars Done high

ship per-app /api/internal/send-email + drop deferred lockdown commons rules

MARS-271 mars Done high

drop dangling icloud auth row eb5854c8 (Luana)

MARS-272 mars Done high

evolutiva-commons: 'do not defer' rule (do now or open WI; never silent defer)

MARS-273 mars Done high

Document email-send playbook + no-deferred-jobs rule (Elazar tag 11573 b+c)

MARS-274 mars Canceled high

share global ~/.claude rules to venus via /gdrive/temp/

MARS-280 mars Done high

Students may edit submitted prácticas until docente clicks Aprobar/Desaprobar

MARS-282 mars Done high

Add 'Rectificar' approval state: docente-only, comment required, email + in-app notification to student

MARS-283 mars Done high

Solicitar información button: add operator message field + ensure send to user works

MARS-284 mars Done high

Provision access: María Miyauchi Harumi + Daiana Pilla (Comisión F)

MARS-285 mars Done high

Date Handling commons + fix periodos-grid.tsx + periodos/[id]/page.tsx TZ anti-pattern

MARS-287 mars Done high

viewAllPracticas cap re-ship: bedel role gets cross-comision /practicas read-only

MARS-288 mars Done high

Bug: Pendiente hace anchored to wrong date on practicas

MARS-220 mars Done high

Ayuda y Soporte universal feedback button

MARS-311 mars Canceled high

Cátedra branding sweep: APP_CATEDRA_NAME env + email subject prefix [Endodoncia FOUBA]

MARS-277 mars Done high

/administrar/usuarios/crear: dedicated form replacing modal/inline 'Agregar usuario' — kind picker (teacher/student/other) with contextual selects

MARS-243 mars Done high

Support ticket #1: Maria Azul Etcheverry cannot submit practica at /practicas/nueva - reports 'filled all required data + radiographs but it will not let me send it' (2026-05-20 17:47 -03). Investigate, reproduce, fix+push if code bug, else explain cause + what is missing.

MARS-324 mars Done high

practica-form client-side required-field validation: on submit, if required fields empty, block submit, scroll to first missing field + show clear toast (no server round-trip)

MARS-326 mars Done high

Support ticket #2: Jose Santiago Gonzalez has alumno profile but reports he is a docente - role misconfigured

MARS-327 mars Done high

Support ticket #3: Juana Frega gets an error when submitting a practica at /practicas/nueva

MARS-328 mars Done high

supportTickets close-and-notify: closing a ticket in /administrar/soporte emails the user the resolution text

MARS-329 mars Done high

UI/UX cohesion audit — pre-client meeting deep-dive: per-role flows, surrogate-account removal, cross-surface comisión+jtp+ayudante consistency, IA consolidation

MARS-246 mars Done high

└─ Twin-route in-place UI unification (deferred from WI#213)

MARS-255 mars Done

Comb entire app for raw UUID/ID shown in UI instead of label; fix all (reported on /informes JTP/Ayudante column)

MARS-335 mars Done high

JTP/Ayudante live-vs-snapshot: reporting/drill/notifications must read CURRENT assignment not creation snapshot; null same-person backfill (ayudante=jtp); add both-roles guard

MARS-21 mars Done high

└─ student-assignment-tcm.ts peer-inference fallback (L188-234) seeds a NULL SA from OTHER students' practicas.jtpUserId/ayudanteUserId snapshot; TCM-gated (deletedAt IS NULL + role-matched) so stale teachers rejected — NOT a rule-(b) violation, low risk. Tighten to prefer live peer SA over práctica snapshot.

MARS-22 mars Backlog low

Weekly hub-DM relay for the ux-pain-digest: a recurring agent-side step (CronCreate or proxy poll) reads the fresh appEvents action=ux-pain-digest row (detail.textReport, detail.relay) and DMs the report to PM + Elazar on the llmmsg hub, then flips detail.relay.delivered=true. Needed because the Vercel cron can't reach the tunnelled hub. Wire BEFORE first digest fires Mon 2026-06-15 13:00 UTC. Satisfies Elazar's 'dm you, me, email' bar (email+appEvents already done by MARS-83).

MARS-84 mars Done high

CR-practicaComentarios: comments on prácticas

MARS-212 mars Done high

MARS-352 hotfix: view-as 22P02 crash — loadSessionUserById used COALESCE(supabaseAuthId, '') on a UUID column → invalid-uuid-syntax 500 on every Ver como render. Fixed with ::text cast (auth.ts:161). SHA 234bf66 v2.23.1, audit+coder cross-PASS. Sole COALESCE(uuid,'') site confirmed.

MARS-357 mars Done high

/practicas pagination defects (visible at ?state=rectificar): (1) pagination is off/incorrect; (2) the 'show N records' page-size selector is missing. Investigate the list pagination + page-size control, fix both. Elazar 2026-06-30. Reversible UI.

MARS-362 mars Done high

Rectificar-reminder mailer: bearer-gated /api/internal/rectificar-reminder, per-student email listing their rectificar prácticas as /mi-cursada/[id] links, sample/live-gated (confirm-token + cohort===39), live routes through emailOutbox (454-self-heal). Elazar directive 2026-06-30.

MARS-366 mars Done high

Vercel edge-request cost: kill <Link> prefetch fan-out into force-dynamic routes (Mars was 42.6% of 1M Pro cap)

MARS-104 mars Done high

soporte/actions.ts: (1) close+notify race can double-email a user — make close conditional UPDATE…RETURNING, email only the transitioned row; (2) support update returns ok when zero ticket rows updated — treat empty RETURNING as not-found. Codex audit, Elazar-greenlit 2026-06-30. Investigate-then-fix; audit cross-review (notify/email path).

MARS-365 mars Done high

/informes JTP-Ayudante aggregate contradicts drilldown: shows 0% graded/pending for a teacher who is up-to-date (Florencia Neput, uuid bcd98024); wrong grading nags sent. Suspect getJtpStats SA-gated graded axis (MARS-5/inert-oracle root cause)

MARS-12 mars Done high

'Pendiente hace' column sorts as string not numeric (e.g. 10 days ordered before 2). Sort by the underlying numeric/duration value, not the formatted label. Likely /practicas. Elazar 2026-06-30. Reversible.

MARS-363 mars Done high

404-capture path exhausts Postgres connection pool during scanner floods (EMAXCONN)

MARS-346 mars Done high

Weekly info-event analyzer: NEW recurring job scanning INFO-level appEvents for UX pain points (600+ 'Seleccioná la pieza' nags etc) + useful data, DMs a report. Operationalizes MARS-70; consumes re-added info-level toast logging (A1). Elazar 06-09.

MARS-83 mars Done high

Floating 'Ayudar' button overlaps/covers the pagination 'next' button on /practicas. Reposition (move up / adjust offset or z-order) so it no longer obscures the paginator controls. Elazar 2026-06-30. Reversible UI.

MARS-364 mars Done high

errscan failed to alert on a real 6h prod outage (isDemo regression 2026-06-09): 43 error-events + 2 unhandled-server-error met BOTH spike-≥10 AND prod-down triggers, yet neither Elazar nor pm-mars-cc got a DM. errscan state is whey-local (NOT in Mars Supabase — db confirmed no seen_signatures table there). Diagnose on whey: did the cron/daemon fire today? did it connect to Mars DB + read appEvents? is alert-routing/DM broken? Owner bin-whey-cc (was offline when filed). Elazar 06-09.

MARS-80 mars Done high

Logger severity-correctness audit: every appEvents write uses the right level (info/warn/error). Sweep all logEvent/appEvent call sites; flag mis-leveled signatures (user-correctable validation toasts at error, real failures at info, etc). Precondition for the two-tier analyzer. Elazar 06-09.

MARS-81 mars Done high

Frequent analyzer (errscan ~2h) scope to error+warn ONLY — confirm/adjust errscan's event-level filter so the high-freq sweep ignores info. errscan owned by bin-whey-cc (cross-host); PM coordinates the change. Elazar 06-09.

MARS-82 mars Done high

Investigate /administrar/logs errors: full triage of appEvents error/warn rows. Deliver (a) each error class + root cause + actionable fix, (b) logging hygiene audit — what is logged that should NOT be (noise/benign warns) + what is NOT logged that SHOULD be (coverage gaps). db categorizes appEvents; audit cross-checks Vercel runtime logs for failures never reaching appEvents. Elazar 06-09, explicitly wants real findings not reassurance.

MARS-78 mars Done high

Audit quick HIGH wins — solicitudes N+1 (vAccessRequestsForReview LATERAL, 500q/load to 1) + analyzeModeOn=false (stop imageUploadAnalysisEvents +600/day growth) + practicas/[id] serial-await to Promise.all (mirror mi-cursada sibling).

MARS-41 mars Done high

SA.jtpUserId live split-brain — coordinated 4-step fix (reconcile 40 rows → create/import writes+3 reads switch to assignedTeacherUserId → vStudentAssignments jtpName join+back-compat alias → drop legacy col+move partial index). Folds in vPracticasSinEvaluar + vComisionAyudantesByJtp snapshot-view leaks. Root of MARS-21/28/Montoya bug family.

MARS-40 mars Done high

Ayudante grading-responsibility = NONE (Elazar policy B): ayudantes must NOT count toward sin-calificar NOR receive grading nags. getJtpStats pending/sin-calificar axis -> JTP (assignedTeacherUserId) ONLY (drop ayudante CROSS JOIN from that axis); weekly-kpi grading nags -> JTP only; drill auto-follows getJtpStats. Acceptance: Belén Montoya bcd98024 (pure ayudante) shows 0% sin calificar; no ayudante gets a grading nag. Fixes both Belén-100% + Florencia-nag complaints.

MARS-23 mars Done high

└─ Clean mislabeled appEvents: remove form-validation toast logger (toast/error-shown, level=error noise) + recategorize sa-teachers-cascade category admin→system

MARS-27 mars Done high

└─ Re-add ayudante notify at práctica creation as INFORMATIONAL (new type practicaAyudanteAsignada, in-app only, no email); JTP keeps grading practicaToReview+email. Elazar follow-up to MARS-23/25 — notify whoever was PICKED as JTP/ayudante, nobody else; no grading semantics for ayudante.

MARS-26 mars Done high

└─ Notifier de-nag (MARS-23 follow-up): notifyPracticaCreated (practicas/nueva/actions.ts:960-968) sends in-app 'Nueva práctica para revisar' (type practicaToReview) to BOTH JTP and ayudante via graderIds=dedup([jtpId,ayudanteId]). Drop ayudanteRecipientId -> notify JTP only. This is Florencia's original nag path (in-app); email already JTP-only. Correct under policy B (ayudante not a grader).

MARS-25 mars Done high

└─ weekly-kpi digest: stop nagging ayudantes for ungraded practicas (JTP-only pending per MARS-23 Elazar ruling) — REQUIRED before Monday 06-08 cron

MARS-24 mars Done high

└─ Block JTP unassign-to-null in /alumnos dropdown: remove the empty '-' option for the JTP (assignedTeacherUserId) column so a student's JTP can only be reassigned to another teacher, never cleared to none. KEEP '-' for the ayudante column (ayudante is optional). Add server-side guard in reassignTeacher rejecting null when field=assignedTeacherUserId.

MARS-29 mars Done

└─ /practicas: add visible teacher filter scoped to JTP-role only — show prácticas where the selected teacher is the JTP (assignedTeacherUserId, live), exclude prácticas where they're the ayudante. Surface the MARS-23 JTP-only ?jtp= drill as a first-class filter control.

MARS-28 mars Done

get_practica_detail_bundle: fixed per-call planning of vPracticaHistorial puts the tail on the 10s cap, cancelling /mi-cursada under mild stalls

MARS-752 mars Done

└─ vPracticaHistorial planning-cost fix for get_practica_detail_bundle, split from MARS-752

MARS-809 mars Backlog

SOP-MARS-72: support ticket at /practicas/nueva

MARS-805 mars Done

└─ findDuplicateConducto gap: pre-check passes, insert still 23505s on uq_practicaToothConductos_tooth_label

MARS-808 mars Done high

└─ SOP-MARS-72 follow-up: pull Vercel runtime logs for 2026-10-09T20:30:01.5Z and 20:46:27.6Z, practica/create

MARS-806 mars Done high

└─ SOP-MARS-73: ticket at /practicas/nueva

MARS-807 mars Done

resolutionNote goes to the reporter verbatim as the email body, with nothing warning the author or screening internals

MARS-779 mars Blocked

administrar-actions.ts: "use server" file exports roster getters with no in-function gate (getDocenteMemberships, getAlumnoAssignments, getAlumnoAssignmentsForPeriodos, getComisionesWithCounts, getPeriodoDetail...)

MARS-748 mars Blocked

Endodoncia I comision LETTER CONFLICT (SOP-MARS-58): Mars follows the client 209-x-es-y mapping 6/6 and the catedra attendance sheet uses the other letter - client decision, not a data repair

MARS-728 mars Blocked

Review-depth pilot close: reconciliation is unverifiable by construction - Elazar decides keep classifier / drop pilot

MARS-705 mars Blocked

Nota/concepto-final grading column — spec needed from Elazar before build

MARS-444 mars Blocked

└─ Exam-scores matrix (1er/2do/final, 3-4 instancias, calif 1-10, absent-marker TBD)

MARS-475 mars Done

EVO-123: convert 11 UPDATE OF invariant guards to AFTER/no-column-list

MARS-801 mars Backlog

Queryable not-xray image view: count + % of uploaded práctica images flagged as NOT a real radiografía. Elazar 2026-06-26: he has not seen one real x-ray — ~99% are photos of a monitor screen, not actual radiographs. The image-analysis path already produces a flag (a 3-letter code/word per Elazar) that marks an image as not-an-xray. Build a DB view (db + coder) over the existing image-analysis data (likely imageUploadAnalysisEvents) that reports total images vs flagged-not-xray count and percentage, queryable any time (overall + optionally by periodo/comisión/recent-window). FIRST identify the actual flag field + its not-xray value. Read/analysis surface only, no enforcement/blocking. Build deferred — tracking only.

MARS-200 mars Blocked

SOP-MARS-69: Lucila Pirovani asks to delete practica a5070113

MARS-764 mars Done

Resolve provenance/allowed-set for applog_reader EXECUTE on fn_dbperf_statements_top50

MARS-804 mars Backlog

Review-depth pilot: keep measuring; verdict issued-but-not-recorded is the open finding

MARS-687 mars Done

Measure the connection-layer fixes, then decide on MARS-690 - reminder DMs start 2026-09-09

MARS-691 mars Done

Record the node-pg error code, elapsed ms and furthest connection phase (DNS/TCP/TLS/SCRAM-start/SCRAM-done) per failed acquisition attempt - the post-failure breaker snapshot cannot attribute a layer and that is what MARS-787 is blocked on

MARS-799 mars Done

Mars DB exporter can silently lose schema sections under a lower-privilege DSN (PLUTO-772 class)

MARS-800 mars Done

404 copy tells a permission-denied user we are investigating an error - turns every authz denial on /alumnos/[id] and /comisiones/[id] into a support ticket

MARS-751 mars Done

comisiones/[id] generateMetadata is ungated - leaks comision name in the title to a viewer the page 404s

MARS-750 mars Done

The create-upload path does not retry ECONNREFUSED, so a single RST loses a student's radiograph even though the next connect 0.4s later succeeds

MARS-788 mars Done

Fleet appEvents schema standardization: single log(entry) entrypoint (no level-wrappers) + promote hot fields to real columns, minimize jsonb-blob reliance

MARS-411 mars Todo

Mars appEvents conform to fleet standard (evolutiva-appevents-standard.md): add categoryId uuid FK->lookupOptions + seed appEventCategory group (16 canonical + practica/studentAssignment/assignment) + backfill 18 free-text values w/ mapping; add 4 promoted cols (httpStatus/durationMs/path/failureCode); add logError/logWarn/logInfo wrappers + pickKnown + isCritical sync-bypass; append-only trigger (GUC-bypass) AFTER appEventRelays sidecar cutover (replace detail.relay.delivered UPDATE pattern); replace level-only prune with 5-cat-security tiered retention; canonical v_appEvents_* views; legacy_events sink. Staged db+coder. BLOCKED on committed SSOT + Elazar priority call.

MARS-107 mars Blocked

Mars measured VENUS-319 burst mispairing: 10 rows stranded

MARS-582 mars Done

Two Mars access requests pending 4-5 days, triaged and approvable - need an admin in the UI (approveRequest is session-bound)

MARS-746 mars Blocked

└─ SOP-MARS-65: which email should Camila Mamani Cardozo use (blocks SOL-MARS-59)

MARS-760 mars Backlog

mars appEvents stores a raw client ip on exactly one rail - the 404 capture - and nowhere else: 19 of 14276 rows in 30d

MARS-796 mars Blocked

Post-deploy internal probe manufactures the genuine-bad-route 404 warn row that errscan then escalates as a first-ever-seen signature

MARS-795 mars Done

Unattributed production pg_dump sweep: identify the lane and RECORD it (recurs ~3x/week, never documented)

MARS-772 mars Done

EVO-93: move this app's email-outbox drain off Supabase pg_cron onto a venus systemd timer

MARS-699 mars Done

Replace MARS-691's daily reminder with event-triggered alerts (ECHECKOUTTIMEOUT+pool counters, non-stall statement_timeout kill, checkpoint write) - retire the timer only in the same change

MARS-729 mars Backlog

edit-rejected tells the student to ask a docente who has no way to add conductos, while a self-serve delete-and-recreate path exists unmentioned

MARS-784 mars Done

Safari-only opaque 'Script error.' hides 30% of Safari's unhandled errors: 33 events / 20 users since June, zero stack on every one

MARS-782 mars Backlog

MARS-84 UX-pain digest can never reach its pattern threshold for parameterised toasts: feedbackKey embeds the entity id, so one problem fragments into 11 keys

MARS-780 mars Backlog

SOP-MARS-68: Sandra Di Pietro names herself JTP for Onofa Matias move to B - Endo 1

MARS-763 mars Done

SOP-MARS-67: mover a Onofra Matias de comision D a B (Sandra Di Pietro)

MARS-762 mars Done

SOP-MARS-70: ticket 91114c2b on /mi-cursada

MARS-765 mars Done

authenticator lost supautils from session_preload_libraries - dashboard-only fix, blocked on Elazar

MARS-775 mars Backlog

SOP-MARS-71: ticket d59b70b7 on /mi-cursada practica 499ccafe

MARS-768 mars Done

Runtime-role DML smoke test: exercise each affected verb through the real code path AS mars_app_runtime, not an information_schema grants assert

MARS-771 mars Backlog

Access request ccea3504: Evelyn, no profile for evelyn11121 gmail

MARS-767 mars Done

SOP-MARS-66: lector grant inert when user also holds ayudante

MARS-761 mars Done

SOP-MARS-64: new support ticket

MARS-758 mars Done

SOP-MARS-63: lost the ring of my token ring network

MARS-756 mars Done

SOP-MARS-62: how to print the current screen

MARS-755 mars Done

MARS: FK covering indexes for Disk IO budget alert

MARS-754 mars Done

Read-only research role: new viewAllPracticas-only role for grado+posgrado case access (SOP-MARS-59)

MARS-744 mars Done

Scanner 404 Block W - structural scanner families

MARS-753 mars Done

Two ungated getters exported from a use-server module return bulk student/docente name+email

MARS-749 mars Done

Version-control live evolutiva-dbperf host script and record row 102 provenance

MARS-742 mars Done

Preserve shared Mars worktree before idle -cc retirement

MARS-739 mars Done

Alert on postgres_logs 'checkpoint complete' with write= over a few seconds - would have fired BEFORE the 2026-09-04 student-visible 500s

MARS-733 mars Deferred

Elazar ruling needed: pm/06-passwords-and-settings.md is a TRACKED credential store, conflicting with the fleet no-inlined-secrets rule

MARS-731 mars Canceled

SOP-MARS-56 decision: ayudante role vs research access to student practica data (8 days, zero replies, claimed role not in system)

MARS-727 mars Done

Restore Mars error->email-to-Elazar loop (bs-mqn8g0rhso5 fleet decision): B ESOCKET operator-email hotfix (after->emailOutbox enqueue) + C instant-error-email onRequestError->enqueue direct-to-Elazar, throttled

MARS-161 mars Backlog

EVO-58 admin storage tile (Hostinger 25GB) — /administrar ambient panel

MARS-513 mars Blocked

The weekly-kpi DATABASE_URL_DIRECT pool may share mars_app_runtime and silently inherit its 10s statement_timeout, which would kill a long KPI batch

MARS-714 mars Backlog

Full write-to-human appEvents consumer/gate/transform enumeration for mars

MARS-590 mars Backlog

usuarios: DB-backed regression tests for updateAlumno/tier authz matrix

MARS-556 mars Backlog

Opportunistic compliance: rename tipoDocumento/numeroDocumento -> documentoType/documentoNumber (entity-first) on users + accessRequests; confirm stored value stays lowercase 'dni'/'pasaporte' (Mars already correct)

MARS-406 mars Backlog

Refactor DataTable onto shared Pluto sort core (vendored)

MARS-394 mars Backlog

Mars logging structural hardening (R1 follow-up): middleware-injected requestId correlation + actor de-anon in onRequestError (F-3/F-4), isCritical sync-write for auth/authz/security cats (F-5), log-error 5min digest dedup (F-6) — audit design-review first (middleware is auth-adjacent)

MARS-116 mars Backlog

Vercel runtime-log API billing-capped (ExceedsBillingLimitError) — blinds PTD runtime-log gate until cap reset/raised

MARS-141 mars Backlog

Reconcile 'principal' JTP checkbox on /docentes vs no-principal-JTP claim

MARS-610 mars Backlog

Práctica-create uploads to api-images before the transaction commits: pre-row orphans, no sweeper

MARS-693 mars Backlog

instrumentation.ts pulls pg (node driver) into the Edge middleware graph — move error-capture behind an Edge-safe boundary

MARS-452 mars Backlog

Percent-encoded path evasion bypasses SCANNER_PROBE_RE allowlist entirely

MARS-586 mars Backlog

EVO-57 Mars: audit-trail schema normalization plan (coverage + naming)

MARS-492 mars Blocked ↳ EVO-57

└─ WP4c: archive twins + triggers for practicaReviews + practicaComentarios + studentPostgradoProgression

MARS-497 mars Deferred

└─ WP4b: archive twins + triggers for supportTickets/Messages/NotifySubscriptions + accessRequests + accountSwitchLinks

MARS-496 mars Deferred

└─ WP4a: archive twins + triggers for userRoles + lookupOptions

MARS-495 mars Deferred

└─ WP2+WP3: add deletedByUserId + createdByUserId coverage columns

MARS-494 mars Deferred

└─ WP1 naming: deletedBy -> deletedByUserId dual-column shim

MARS-493 mars Deferred

practicaCodigo format: add PRA-MARS- prefix

MARS-614 mars Backlog

Adopt Pluto admin-list/detail reference pattern (5 principles) on Mars

MARS-482 mars Backlog

EPIC mobile-first refactor (Elazar directive, all 3 apps): Mars is desktop-CSS-with-patches, not mobile-first. Staged base-up rework. Stage0 foundation (44px tap floor + search/form fixes, mobile-only media blocks, desktop density unchanged); Stage1 DataTable mobile card mode (fixes /practicas + /docentes); Stage2 /mi-cursada; Stage3 /practicas/nueva form (+tooth-selector tap targets, +undefined .conducto-* classes latent bug); Stage4 filter-bar accordion; Stage5 practica detail (/practicas/[id]+/mi-cursada/[id]: info-bar, changelog, comentarios, review-form, image-viewer pinch-zoom currently broken on mobile); Stage6 secondary (soporte thread, notificaciones, perfil, postgrado-progression). Order 0>1>2>3>5>4>6. Owners: coder-mars-cc 0/3/5, coder02-mars-cc 1/6. Held on proxy-mars BEFORE baseline (Elazar launching). Admin wide-tables=P3 tail/defer.

MARS-97 mars Backlog

Formalize numeroHistoriaClinica as validated patient DNI (governance-gated)

MARS-534 mars Backlog ↳ EVO-80

Adjunto oversight/governability landing: adjunto logs in -> lands on a page showing comisión health, which JTPs need help, pending workload (Elazar 06-06, q3). NEEDS DESIGN/BRAINSTORM - distinct surface from /practicas

MARS-35 mars Backlog

PM DB-fed triage loop: support-ticket + access-request events DM PM; PM reads DB + triages (bs-mqotdmmk6b5)

MARS-174 mars Backlog

Custom 404: add LLM-copy block to not-found page + enrich routing/not-found event (referrer, appVersion, requestId) + rate-limiter

MARS-330 mars Backlog

jtp_roster (?jtp= query, MARS-474 P2): join-order defect fires review LATERAL 1.6M times instead of ~3K

MARS-685 mars Backlog

get_practica_detail_bundle unexplained exec-time regression (up to 46.7s max)

MARS-680 mars Backlog

Mobile practica-create failures are undiagnosable: client 'Failed to fetch' leaves no server-side row

MARS-679 mars Backlog

Verify restored-Mars object completeness after bin-whey-cc's rail patch

MARS-675 mars Backlog

Archive trigger captures NEW not OLD on UPDATE — verify forensic recovery coverage across audited tables (db)

MARS-64 mars In progress

Práctica edit-quota lock burns a slot on tab-abandon, not just on save

MARS-646 mars Backlog

Standardize /alumnos filters onto the shared URL-param filter pattern

MARS-635 mars Backlog

Profile photo escalating nag -> hard block on 10th prompt; show photo in practica for teacher identification

MARS-580 mars Backlog

└─ Admin lever to clear a profile-photo block (and handle self-deleted photos re-entering the ladder)

MARS-628 mars Done high

└─ Route the profile-photo nag upload through the MARS-567 honest-copy validator before uploadProfileImage

MARS-627 mars Done high

/practicas dashboard: pending-queue rows repeat in the flat table — dedup UX (Elazar option pick pending)

MARS-478 mars Backlog

CI guard: static logEvent call-site scan vs checked-in action-classification manifest (MARS-465 follow-up)

MARS-466 mars Backlog

Admin landing: pinned-first sidebar + numbered emoji card grid (fleet-uniform pattern, bs-mrlnhbp0y3n)

MARS-458 mars Backlog

Middleware session-refresh (createServerClient) -- edge-bundle-safe design needed

MARS-454 mars Backlog

MARS-145 follow-up: daytime-peak 53300 re-scan of the txn-pooler runtime pool

MARS-383 mars Backlog

EVO-47 db-lane: redefine vAppErrorsRecent + vAppAlertsRecent to expose level + category + normalizedRoute; rollup signature = normalizedRoute+level+category (subsumes EVO-46 lane-2 distinctPaths). Enables the level/category-aware alert-suppression predicate. Class-A review pre-apply (reversible CREATE OR REPLACE VIEW).

MARS-344 mars Backlog

Support-agent registry + atomic assign/list-budget functions for support-API

MARS-648 mars Backlog

Add a main-JTP designation to comisiones

MARS-608 mars Backlog

Fleet curated-knowledge-file + prune-arrow adoption: repo-visible SSOT digest .md (coder/db/audit/pm all edit+prune) as the reviewed distillation on top of auto-memory ON; raw memory captured then distilled into the .md, prune superseded. Decoupled from the solo agent (adopt regardless). 4-PM unanimous brainstorm bs-mr3bt2c0vgy. Mars=reference (solo-mars-cc.md already this shape). Scope: standing digest+prune discipline, mirror to venus/pluto/ayudarg.

MARS-372 mars Done

route.ts: /api/log-error outer catch swallows its own failures, no appEvents row

MARS-577 mars Backlog

Prune cron.job_run_details on a schedule - Mars has no retention, and it is the table MARS-698 diagnosis depends on

MARS-701 mars Done

fn_notify_pm_triage exception-swallow silently drops PM alerts

MARS-596 mars Done

evolutiva_agent_rw cannot write practicas/practicaTeeth/studentAssignments - EXECUTE on fn_normalize_archive_reason was never granted to it at MARS-694, silent since then

MARS-709 mars Done

public-schema ALTER DEFAULT PRIVILEGES grants mars_app_runtime=arwd on every new table - narrow grant lists in migrations are decorative

MARS-707 mars Done

Audit PTD render-GET tooling: enable exercising authed routes (dedicated test-user + stored session, OR a server-side render-self-check route) — Mars leg of the cross-project gap that let Pluto's /informes 500 ship unexercised (audit unauth render-GET -> 302/login, authed routes never actually rendered in PTD)

MARS-118 mars Blocked

└─ MARS-118 leg A: bearer-authed data-layer self-check route, with an allowlist that cannot silently shrink

MARS-720 mars Done

└─ Refactor session-reading src/lib modules to take an explicit actor param instead of calling getSession() internally

MARS-721 mars Backlog low

MARS-612 follow-up: make the two Endo I server backstops independent of the client (raw calibreCono before coercion; count image survivors instead of subtracting an unvalidated client array length)

MARS-716 mars Done

practicas_integrity_check dedupe window (55 min) is SHORTER than its cron interval (hourly), so it suppresses nothing and re-pages every run

MARS-718 mars Done

Student duplicate-práctica deletion request: student requests delete (reason=duplicate), picks keeper from pulldown, teacher approves -> non-keeper soft-deleted

MARS-147 mars Todo

Materialise the reviewer-vs-assigned-pick discriminator on practicaReviews, then label both surfaces

MARS-213 mars Todo

iPhone HEIC upload: wasm-decoder go/no-go — gated on MARS-508 instrumentation (userAgent + detail.diag container) format-mix data

MARS-517 mars Done

Document the rectificar student-reminder email workflow: what triggers it, what emails a student actually receives, volume/dedup — then decide cleanup

MARS-525 mars Done

└─ EVO-72 driver: approval emails are not coalesced against burst grading (median 55min for 8 emails) - decide the coalescing policy

MARS-719 mars Backlog

Teacher-facing student reassignment surface (JTP/Ayudante self-service, NOT on /alumnos)

MARS-108 mars Done

Re-key grading attribution to práctica-pick (jtpUserId) — reverses live-SA model

MARS-136 mars Done

Commons demote pass: move mechanism out of the auto-loaded files behind lazy anchors

MARS-717 mars Done

Hide non-required fields + require Endodoncia I fields for Endodoncia I students

MARS-612 mars Done

Is this app's cron bearer recoverable at all? Vercel sensitive-only env vars are unreadable and the state is invisible until first call

MARS-713 mars Done

Check size of Mars images on Hostinger (api-images file store) — measure total disk + file count used by Mars JPEGs on the api.pensanta.com/mars FTP-jail host; report bytes + count, flag if cleanup/retention needed.

MARS-42 mars Done

Teachers can claim out-of-scope students as theirs (JTP/ayudante takeover)

MARS-553 mars Backlog

Sidebar/navbar per-role regroup (Stage A): execute the holistic restructure the /sidebars-preview diagnostic (75ad66f, 2026-06-04) was built to inform. Per-role nav still cluttered/inconsistent. Use the preview tool (renders real sidebar per role side-by-side) to design grouping, then regroup. Only piecemeal edits landed since (MARS-33/34, WI#327, WI#214); holistic cleanup dropped + untracked until now (Elazar 06-09).

MARS-77 mars Backlog

MARS-468 follow-up: support-action idempotency ledger for close/reopen + test coverage

MARS-470 mars Done

Sweep pre-086 owner-rights agent-granted views to security_invoker=true

MARS-561 mars Done

INVESTIGATE (not-prejudge): authed post-OAuth /mi-cursada empty-state-vs-404 gap. Row 1 of the triage: a legit OAuth-redirected alumno on the canonical landing got classified genuine-bad-route via the external-referer heuristic. CONFIRM FIRST whether bare /mi-cursada notFound()s for an authed no-active-cursada user (code read says it renders an EMPTY STATE, does NOT 404 — so the 404 is on a different path/referer shape) before prescribing any empty-state fix. Scope: not-found-classify external-referer branch + post-OAuth referer shape.

MARS-165 mars Done

Inventory + lock down public function EXECUTE and sequence privileges (adjacent to MARS-416 relation-grant revoke)

MARS-417 mars Done

Real 404s hidden in alert-rail noise: /login x19, /practicas/<uuid> x36

MARS-583 mars Done

└─ Friendlier landing for a soft-deleted práctica link (vs generic 404)

MARS-706 mars Backlog low

Log native HTML5 validation hints as friction events (any user-facing feedback = logged; native constraint-validation currently bypasses the toast/checkRequired path)

MARS-412 mars Done

Audit createdBy/At + deletedBy/At + changelog/archive coverage

MARS-483 mars Done ↳ EVO-55

Per-agent Postgres login roles (REFERENCE impl)

MARS-490 mars Done ↳ EVO-56

Stamp session_user into archive-trigger snapshots alongside app.user_id

MARS-491 mars Done

vComisionAyudantesByJtp SA-join fix

MARS-477 mars Done

EVO-52: extend support-api for full SOP-ticket CRUD (status transitions incl. close/resolve, private Elazar+stakeholder-only comment type, notify-list on ticket events) — bearer-invokable, no direct DB/chrome-mcp/manual-human path

MARS-468 mars Done

Pool exhaustion 2026-09-04: root cause identified (compute/storage I/O stall) — app-side hardening in progress

MARS-688 mars Done

Provision mars_app_runtime low-priv role, split statement_timeout from postgres

MARS-692 mars Done

Move follow-up radiograph gate+lock+insert into one atomic Postgres function (MARS-683 finding 3)

MARS-684 mars Canceled

Third-party-infra status-page-first rule -> evolutiva-ops.md (terra-authored, maintainer placement call)

MARS-678 mars Done

useActionForm has zero Mars consumers - decide adopt vs leave

MARS-420 mars Canceled

Retire /api/app-version, consolidate on /api/health (Elazar one-endpoint directive)

MARS-676 mars Done

/mi-cursada/[id] render fan-out can demand 9 pool slots against max:6

MARS-672 mars Done

MARS-672: author get_practica_detail_bundle DB function

MARS-673 mars Done

image upload: retry once on upstream connect timeout (practica/create)

MARS-670 mars Done

Editar práctica: permitir quitar una pieza ya cargada (SOP-MARS-46)

MARS-663 mars Done

MARS-628: profile-photo exemption + ladder-restart columns

MARS-666 mars Done

SOP-MARS-47: add Miyashiro to postgrado comisiones

MARS-665 mars Done

SOP-MARS-45: soft-delete practica 260701-01

MARS-664 mars Done

Review form: preventive cue under Calificación when Rectificar is selected and the grade is empty

MARS-662 mars Done

UX Friction (epic): reduce user pain points surfaced by toast/error telemetry

MARS-69 mars Done

└─ Analyze all toast/error-shown messages in appEvents to map UX pain points (e.g. 600+ 'Seleccioná la pieza' nags on /practicas/nueva) and propose form/flow fixes

MARS-70 mars Done

EVO-70 Tier 1: emailOutbox AFTER INSERT FOR EACH STATEMENT trigger → pg_net wake marker to drain route

MARS-520 mars Done ↳ EVO-70

SOP-mars-N display prefix rollout

MARS-460 mars Done

P4 (PARKED, Elazar) solo-mars as default alert/eventLog responder — gated on fine-tuning + backtest pass (bs-mr8o7w73qz4)

MARS-404 mars Done

Form name="catedra" mis-stores Programa value: solicitar-acceso Programa select writes grado/postgrado into the catedra column. Split into proper programa column (or relabel) so catedra and programa are distinct truthful fields.

MARS-187 mars Done

└─ accessRequests.programa column + view updates (MARS-187 prerequisite)

MARS-476 mars Done

Honest copy for server-side image-upload failures (practicas/nueva)

MARS-650 mars Done

Práctica editor: bare file input, students cannot find how to add radiografías

MARS-647 mars Done

Solicitar eliminación reads as text, not a button

MARS-645 mars Done

Profile-photo nag: upload starts on file select (27-student required-field friction)

MARS-643 mars Done

estadisticas: split materia-level stats (Endo I vs Endo II)

MARS-638 mars Canceled

Split Endodoncia I vs Endodoncia II on /estadisticas (materia as reporting dimension)

MARS-637 mars Done

Endo I clinical scope restriction (client-approved quote)

MARS-636 mars Done

Shared D/M/Y date control: digit caps + auto-advance

MARS-634 mars Done

Add rominasseron@gmail.com as Endo I test student (Seron Estudiante Prueba)

MARS-633 mars Done

Load-failed suppress order reverted after audit BLOCK:1462817

MARS-632 mars Done

Review-depth pilot infrastructure (classifier + tests)

MARS-631 mars Done

image-proxy fetch-failed: capture target host + err.cause/code in catch for attribution

MARS-343 mars Done

logEvent: internal-probe UA suppression only covers 13/234 call sites, not fleet-wide

MARS-579 mars Done

Admin can create a support ticket on behalf of another user

MARS-609 mars Done

Mars backup-lane inventory for fleet registry + fix backup-db.sh EXPECTED_REF fallthrough

MARS-621 mars Done

Dedupe/downgrade users-list-overflow alert before it starts paging on every admin page load

MARS-617 mars Done

Set up período/comisión/materia for Endodoncia I

MARS-613 mars Done

Reclassify nudge-shown (MARS-600) from warn to info severity to stop real-time alert paging

MARS-611 mars Done

setRoles() missing self-admin/last-admin lockout guard

MARS-604 mars Done

8 archive tables: service_role holds UPDATE/DELETE/TRUNCATE, append-only is convention not grant

MARS-597 mars Done

Wire agent-scoped solo push gate for solo-mars-cc (.solo-audit.sh pattern)

MARS-415 mars Canceled

Provision solo-mars Vercel-MCP build+runtime-log read before enforcing solo self-PTD floor (bs-mr8rcwpk2t7 pluto#3)

MARS-405 mars Canceled

P2 codify triage playbook into solo-mars-cc.md (auth-gate first) before any solo alert duty (bs-mr8o7w73qz4)

MARS-403 mars Canceled

P1 solo-router rebind: adopt Class-S -> solo-mars / Class-A -> full-team as default dispatch (bs-mr8o7w73qz4)

MARS-402 mars Canceled

Measure SCANNER_PROBE_RE for pre-existing over-match against real routes (not admitted-population gate)

MARS-587 mars Done

EVO-86: mars self-addressed error-tier alerts, 07-27/07-29 (FIXED)

MARS-592 mars Done

applog-pull.ts:391 signature collapse — mars 404s all collapse to one dedup key

MARS-588 mars Done

VENUS-327: extend SCANNER_PROBE_RE + pin hold-out fixtures (classifier-coverage only)

MARS-585 mars Done

Applog rail resume-cursor stall risk (VENUS-318 sibling) — confirm cursor age + adopt fix

MARS-581 mars Done

mailer/resume-link/digest/kpi templates: bare || env fallback, not a validating resolveSiteOrigin() — commons violation, unverifiable prod origin

MARS-578 mars Done

route.ts: /api/log-error attributes client errors to view-as target instead of real actor

MARS-576 mars Done

Audit findings from MARS-574 retro review: 4 BLOCKs to fix

MARS-575 mars Done

Retro cross-vendor review debt: 5 SHAs owed to audit-mars-ca (harness dark since 2026-07-25)

MARS-574 mars Done

New /informes/sincalificar backlog sub-report (JTP/Ayudante, Alumnos, Prácticas, Sin calificar, Sin calificar %, Última actividad)

MARS-568 mars Done

Honest failure copy for unreadable cloud-picker-stub image upload (arrayBuffer threw / container=unread) — MARS-84/508 follow-up

MARS-567 mars Done

Support reply/close delivers to stale supportTickets.createdByEmail snapshot instead of re-resolving live via createdByUserId->users.email (wrong-recipient if reporter email changed during ticket life)

MARS-565 mars Done

getPracticasFilterOptions jtps subquery: push comisión predicate into a SECURITY INVOKER get_comision_picked_teachers(comisionIds[]) fn before the org-wide pick materialization (MARS-550/560 residual, 80ms->~20ms, fixes unbounded-growth-with-practicas)

MARS-562 mars Done

JTP filter-dropdown query 624ms->3ms: lean vComisionPickedTeachers view replaces heavy roster-view subquery

MARS-560 mars Done

salud-datos dead-link: UsersRoleMismatch/TeachersOrphan name links pointed at nonexistent /administrar/usuarios/[id]

MARS-552 mars Done

Perf: JTP filter-options loader over-fetching, 1079.9ms mean query (dbperf 2026-07-21)

MARS-550 mars Done

supportTickets best-practice fields: subject + category + priority + updatedAt (converge to PLUTO-563)

MARS-544 mars Done

Map uq_users_docpair + uq_users_legajo 23505 → friendly Spanish across the 4 other user-writing paths (completar/actions.ts, perfil/actions.ts, user-actions.ts, users-actions.ts) — 077 uniques are global+live so a doc/legajo collision there raw-500s

MARS-539 mars Done

doc-pair + legajo create-vs-update TOCTOU: advisory locks serialize create-vs-create only; no DB unique on doc-pair/legajo → race can mint two live rows sharing a documento or legajo

MARS-537 mars Done

Redesign /alumnos toward Pluto's /administrar/alumnos list + /alumnos/(id) detail pattern (Elazar direction)

MARS-526 mars Done

estadisticas/clinico polish: drop 'borradores', standard Corregidas/No corregidas/Todas labels, Programa→Período cascade (Postgrado leaking into Período)

MARS-531 mars Done

Pieza-level statistics: client wants per-pieza stats (%/mediana/ratios/pivots) — decide expand /estadisticas vs new /estadisticas/piezas; confer coder-mars-cc + audit-mars-ca

MARS-524 mars Done

/alumnos double-render: page renders then visibly re-renders ~2s later (Elazar-reported UX flash)

MARS-527 mars Done

EVO-71 tooling reference: author fn-REVOKE enforcement — (1) .gitpush-pre.sh static guard flagging CREATE [OR REPLACE] FUNCTION lacking same-tx REVOKE EXECUTE FROM PUBLIC/anon/authenticated + (2) post-apply catalog assertion (proacl excludes PUBLIC/anon/authenticated on new public fns)

MARS-523 mars Done ↳ EVO-71

EVO-70 Tier 0: conditionalize drain-email-outbox pg_cron — EXISTS-guard so empty ticks fire zero HTTP/Vercel

MARS-519 mars Done ↳ EVO-70

└─ MARS-519 follow-up: add drift-breadcrumb comment in email-outbox.ts tying RECLAIM_AFTER + claim eligibility to the pg_cron T0 guard fn

MARS-521 mars Backlog low

iPhone RX (HEIC) client-side decode-convert instead of reject

MARS-508 mars Done

EVO-67: add 'No especificado' (value=noEspecificado) row to sexo lookupOptions group — field stays required

MARS-516 mars Done

EVO-66: preventive friction-flash on nueva-práctica static required gates + reduced-motion a11y retrofit

MARS-514 mars Done

EVO-62 friction-fix campaign: mine + fix top FRICTION-tier UI sources

MARS-507 mars Done

Grading-vs-editing concurrency nudge: verify it's real + design a truthful 'Editando' signal

MARS-512 mars Done

vPracticaHistorial conducto-leg predicate pushdown (dbperf mig067)

MARS-506 mars Done

practicas filter-dropdown perf: getPracticasFilterOptions 2.2s/call under load

MARS-505 mars Done

Adopt pluto's SCANNER_PROBE_RE Block M+N (fleet parity)

MARS-503 mars Done ↳ EVO-61

Adopt pluto's SCANNER_PROBE_RE Block O (fleet security sync)

MARS-502 mars Done

Review-form: place Calificación next to Resultado

MARS-501 mars Done

Práctica Historial de cambios: restore dropped resubmit + radiograph events

MARS-500 mars Done

Re-auth audit-mars-ca Vercel MCP OAuth

MARS-447 mars Done

Inventory + retire demo-data gates/rows

MARS-480 mars Done ↳ EVO-54

Alumnos fix (795c124)

MARS-499 mars Done

Suppress weekly-KPI all-zero digest sends

MARS-498 mars Done

MARS-475 follow-up: student self-view of own exam scores

MARS-488 mars Done

SOP-7 A: override-ayudante UI — authorized role can correct/remove the auto-added ayudante on a práctica (Romina complaint; auto-add is by-design, gap = no override path)

MARS-60 mars Done

vStudentAssignments/vTeacherComisionMemberships missing users.deletedAt IS NULL predicate

MARS-472 mars Done

user soft-delete path does not cascade to userRoles (silent live-role orphans)

MARS-382 mars Done

└─ restoreUser must regrant roles after MARS-382 soft-delete cascade (role-less restore gap)

MARS-479 mars Backlog

/alumnos page renders raw UUIDs in the Comisión and JTP/Ayudante columns instead of human names — violates evolutiva-commons 'no raw IDs/UUIDs in UI/exports'. Surfaced by Elazar 2026-06-30 (duplicate-student screenshot). Fix the /alumnos render path to resolve comisiónId→comisión name and jtpUserId→teacher name (use existing name lookups/views; don't add a new query fan-out if a join/view already serves it). Reversible UI fix.

MARS-355 mars Done

practica-link-dead fires on 2 live, non-deleted prácticas — viewer-permission gating suspected

MARS-437 mars Done

└─ No-404 directive: navigation/practica-link-dead fired 3x — find and eliminate the dead practica link source (broken link/route), not just relabel the event

MARS-106 mars Done

/practicas/[id] detail-grid: 25px overflow @768 (nowrap dt labels force 1fr tracks past tooth-panel) + label truncation @360 ('Restauraci…') — needs live-DOM-measured fix

MARS-101 mars Done

Widen image upload to accept PNG/WebP/HEIC/HEIF, not just JPEG

MARS-434 mars Done

Friction rollup views (digest/top/byUser) — criteria-agnostic

MARS-461 mars Done

Create canonical-named duplicate views: vOpenAccessRequests + vUserFrictionEvents

MARS-456 mars Done

Disable 107 orphan-auth users (auth huerfanas, never logged in)

MARS-86 mars Done

Audit Next.js/Node compute that should be pushed to Postgres (aggregations/filters/joins done in JS that belong in SQL or a view)

MARS-68 mars Done

└─ Rewrite teacher-practicas CTE: kill seq-scan on practicas (18.4% DB time) — LATERAL/direct JOIN from studentAssignments, est. 60-70% wall-time cut. Sites: weekly-kpi.ts + reporting.ts. See db/pg-stat-statements-report.md

MARS-73 mars Done

└─ Cache unread-notifications count (5.1% DB time, 41k calls): SELECT count(*) FROM notifications WHERE userId AND readAt IS NULL fires every page load — counter column on users or 30s sessionStorage TTL. See db/pg-stat-statements-report.md

MARS-74 mars Done

/administrar/friction admin page

MARS-462 mars Done

Land generic outcome-code capability in action-core.ts (MARS-408) for Venus parity

MARS-428 mars Done

Fix pagination Siguiente snap-back (base-ui nativeButton + DataTable history clobber)

MARS-459 mars Done

Create shared/md/evolutiva-db-views.md (use-case-key registry, fleet-wide)

MARS-455 mars Done

MARS-449 follow-up: middleware Supabase session-refresh + setAll no-store headers hardening

MARS-453 mars Canceled

Edge-safe error sink for pg bundled into Edge instrumentation

MARS-451 mars Done

Harmonize /administrar nav+UI to established pattern

MARS-448 mars Done

vAccessRequestsPending (migration 036) — retro WI for Elazar-direct DB request

MARS-446 mars Done

estadisticas practica-vs-pieza UX redesign + push-gate fix

MARS-443 mars Done

vMultiradicularStats: 3h refresh cadence + resource-cost tracking

MARS-442 mars Done

Wire client-side image-too-small toast to friction telemetry (No-Silent-Failures gap)

MARS-440 mars Done

salud-datos 500: vDataHealth/vDataHealthSummary views missing, never DDL'd

MARS-433 mars Done

log-error identity-flood check: uuid=text operator mismatch

MARS-430 mars Done

practicaCodigo 500 on /practicas/[id] (practicasArchive alias regression)

MARS-429 mars Done

Build vFrictionEvents tiered view family (base/1w/1m + NoLimit twins)

MARS-426 mars Done

Duplicate-conducto-label 500 on práctica edit (uq_practicaToothConductos_tooth_label)

MARS-425 mars Done

nudge 'rectificar:pending' re-fires for the same user within minutes

MARS-423 mars Done

Fix native-validation over-logging (12 rows/3 submits -> 1/validation block)

MARS-422 mars Done

Stop viewport logging (data sufficient fleet-wide) + act via mobile-first epic

MARS-413 mars Done

Investigate persistent PostgREST 503 PGRST002 on Mars Data API

MARS-418 mars Done

Agregar botón Solicitar eliminación en prácticas editables

MARS-414 mars Done

Práctica notification email subject collides across recipients (Gmail collapses duplicate tag); add per-recipient discriminator

MARS-407 mars Done

mars

MARS-401 mars Done

Accent-insensitive search (unaccent/f_unaccent) — Mars leg

MARS-400 mars Done

Weekly student-rectificación reminder + JTP/ayudante/comisión escalation ladder

MARS-398 mars Done

Untrack agent-dir .mcp.json — literal LLMMSG_HUB_BEARER inlined in 9 git-tracked files

MARS-396 mars Done

Bump next 16.1.6 -> 16.2.x + regression pass

MARS-388 mars Done

send-email recipient/domain allowlist

MARS-391 mars Done

xlsx supply-chain: no npm fix (CDN dist or replace)

MARS-389 mars Done

Consolidate 5 cron token checks to timingSafeEqual

MARS-390 mars Done

Backfill split_part(email,'@',1) trgm expression index once users table grows

MARS-387 mars Done

Solicitudes de acceso -> Pluto-parity refactor (bs-mr4h5azsk3g): adopt Pluto's /admin/solicitudes card-list + detail SKIN on Mars, ZERO feature drop. Mars keeps: match-candidate email vs doc-triple dedup + email-change branch, fraud flags, comision auto-assign-on-approve + block-if-no-active-teacher, signed single-use completar resume-link, needs-info checklist, notify-institutional-email, advisory-lock dup-pending guard, SOL-N numbering, 23505->Spanish map, appEvents-on-every-path. Fold FROM Pluto: copy-analysis-context, per-field needs-info checklist UX, tiered merge-candidate panel skin. Share TO Pluto: signed completar link, comision auto-assign, SOL-N, advisory-lock guard, 23505 map. Process: Mars coder diffs Mars superset vs Pluto reference surface (2 route pages + list/detail clients + access-request action fns + field-spec + status-sql), implements in-repo, NO cross-repo push. ALSO app-sidebar 'Mars v{ver}' label. ASSUMPTION pending Elazar: skin-parity NOT feature-parity-down. Restore-twin fork = SEPARATE shared bug MARS-181, do NOT duplicate here.

MARS-376 mars Done

Make users_normalizedemail_unique a partial index (WHERE deletedAt IS NULL) — non-partial index blocks Approve for any dormant-purged student who re-applies (500 duplicate key on approve-access-request). Repro: Laura Lafuente 06-23. One migration: DROP INDEX + CREATE UNIQUE INDEX ... WHERE deletedAt IS NULL. Consider also: approve handler should detect existing soft-deleted user by normalizedEmail and reactivate vs blind insert.

MARS-181 mars Done

pg_trgm fuzzy-match infra for access-request matching (MARS-376 S3 dep)

MARS-377 mars Done

vHealthStudentsNoComision: add data-health view for students lacking comisión assignment — Elazar asked explicitly -29846; gap confirmed by audit -29913 + db -29908 (existing vHealthAssignmentsBad covers assignment mismatches, not no-comisión).

MARS-302 mars Done

Cátedra branding sweep p2: page <title>, app header

MARS-278 mars Done

practicas.lastSubmittedAt + reset SLA timer on resubmit

MARS-221 mars Done

DataTable migration: non-admin list pages (practicas, alumnos, alumnos/[id], mi-cursada, informes, perfil)

MARS-222 mars Done

Field-primitive migration batch 2 (next non-overlap surface, ~15-20 inputs)

MARS-224 mars Done

Orphan/missing-data audit — find students w/o teacher, teachers w/o students, and other missing-relation gaps. Inventory existing views/code; build report query if missing.

MARS-227 mars Done

Build data-health views + UI to surface accounts with problems (missing assignments, role mismatches, orphan teachers, stale FKs, etc.). Brainstorm proposals on aro:mars 2026-05-02 — db proposed per-category mini-views + union vDataHealth; coder proposed /admin/data-health page + critical-only daily digest.

MARS-234 mars Done

└─ Verification email campaign — adjuntos/JTP/ayudantes

MARS-219 mars Done high

└─ /a-solucionar UI: rename or alias /administrar/salud-datos as /a-solucionar, ensure new vHealthNonAllowlistEmail category surfaces. Per Elazar -30391 — broaden coverage of irregularities inbox. Includes 'Resolver' action per row when actionable. mars-db -30526 has views ready.

MARS-303 mars Done

build CPU: gitpush-pre.sh doc-skip — when only .md/CLAUDE.md/MEMORY.md changed, skip lint/typegen/typecheck/build to save ~30 build CPU min per push

MARS-236 mars Done ↳ EVO-36

Mars: remaining Vercel + Supabase optimization todos (timeout 300→90s, disable Web Analytics + Speed Insights toggles, set spend cap, 7 A-pattern Promise.all([list,count]) sites)

MARS-237 mars Done ↳ EVO-36

v1.60.5 (3d8a5b1) perf(lookups): React cache() wrap on getLookupOptions + getMultipleLookupCategories — per-render dedup across 16 call sites

MARS-238 mars Done ↳ EVO-36

v1.60.6 (067ceb5) perf: parallelize /practicas/nueva teacher pools + /mi-cursada/[id] (getUserProgramas + getPracticaDetail) + drop dead @vercel/analytics dep

MARS-239 mars Done ↳ EVO-36

v1.60.7 (b007fb9) perf(mi-cursada): /mi-cursada query rewrite — fold KPI counts via COUNT(*) FILTER OVER() + LATERAL for adjuntoName/teeth/imageCount + React cache() on getStudentPracticas

MARS-240 mars Done ↳ EVO-36

vUserActiveRoles view: consolidate userRoles+vLookupOptions JOIN repeated at users-actions.ts:164/169/230 + data-health-actions.ts:58 + self-service-assignment.ts:51 — return userId, roleValues[], roleLabels[] (filtered deletedAt IS NULL)

MARS-241 mars Done ↳ EVO-36

pendienteHaceDias view col on vPracticas: lift practicas-table.tsx:19-21 JS Date.now() math to DB ((now() AT TZ 'America/Buenos_Aires')::date - createdAt::date) — TZ-correct, sortable/filterable SQL-side

MARS-242 mars Done ↳ EVO-36

audit: confirm tipoDocumento (and other lookup-backed selects) store UUID FK to lookupOptions, not raw text — refactor any that drifted

MARS-244 mars Done

Migrate from legacy Supabase anon/service_role JWT keys to new sb_publishable_* + sb_secret_* (deadline late-2026); audit Authorization-header usage

MARS-245 mars Done

Audit + replace ugly red destructive-variant buttons (per Elazar UX feedback 5881)

MARS-248 mars Done

Lane D: add studentAssignments.ayudanteUserId UUID NULL FK + index + archive trigger update

MARS-250 mars Done

Lane F: jtp/ayudante predicate consistency — per-file audit + refactor surfaces using snapshot when live should be

MARS-251 mars Done

Lane E: surrogate user consolidation — coder removes Cambiar cuenta switcher UI, then db merges 24 surrogate users → 8 canonical (33 FK reassignments, soft-delete preserves audit trail)

MARS-252 mars Done

Lane C: sidebar + URL consolidation — collapse twin route trees (/alumnos vs /administrar/alumnos), kill /admin and /administrar redirect stubs, sidebar 5→3 sections, role-aware home with no redirect chains

MARS-254 mars Done

codify access-request triage workflow (Luana/Felicitas pattern) into mars-commons or db-role doc

MARS-267 mars Done

Codify access-request triage workflow in mars-commons

MARS-268 mars Canceled

feat(/informes exports): add pendingRate% to xlsx/csv/html/text exports — deferred from 10ae061

MARS-295 mars Done

Profile picture upload + display + enlarge — user uploads avatar; show in user badge across app (alumnos list, etc.); click-to-enlarge so teachers can recognize students. Pluto already has initials-fallback badge; Mars needs same + upload + enlarge.

MARS-235 mars Done

Hide Elazar's name from teacher-facing report lists

MARS-305 mars Done

Weekly KPI emails to teachers (cron Mon 06:00 ARG)

MARS-306 mars Done

Soft-Delete view rollout: inventory lookup-source tables + create vActive<Table> views + migrate option-list call sites per evolutiva-commons §Soft-Delete (consensus 0e5cf15)

MARS-309 mars Done

entity-changelog PRACTICA_FIELDS coverage gap: only 9 of ~20 practica edit fields tracked; many edits produce empty-changes historial entries (filed by coder-mars-cc-36489 from v1.106.2 P0 push)

MARS-310 mars Done

/llms.txt + /docs/llms.txt routes — curated markdown from pm/ docs

MARS-314 mars Done

/informes: fix % column sort (numeric-as-string bug, both tables) + add 'Min. practicas' numeric filter to both tables + rename heading to 'Estado de revision'

MARS-317 mars Done

Radiograph orientation flip not persisting on practica edit (Julieta Torrent, com A)

MARS-318 mars Done

Daily error-digest Vercel cron: new /api/cron/error-digest route + vercel.json entry. Date-scoped last-24h appEvents error scan, noise-filtered (exclude toast/error-shown UI noise), grouped by action, emails Elazar a digest only above a threshold. Mirror the send-weekly-kpi cron pattern.

MARS-320 mars Done

Support-resumen email: add ticket number to each row + add an easy-to-copy LLM task-prompt block at the bottom that Elazar can paste to a Claude Code session to action the ticket.

MARS-321 mars Done

Support-digest copy-paste prompt block: replace wording with Elazar's exact template (intro line + Ticket de soporte fields + Fecha del reporte + Mensaje textual + numbered Tareas list incl. gitpush.sh). Follow-up to WI#474.

MARS-323 mars Done

Capture app version on support-ticket creation: new appVersion column on supportTickets, populated at ticket-create time with the running app version; show 'Version de la app' in the digest prompt block + email row. Existing tickets null -> render 'desconocida'.

MARS-325 mars Done

Daily error-analysis DB view over appEvents for recurring PM error review

MARS-332 mars Done

Admin shortcut: close-and-notify a support ticket directly from the /administrar/soporte ticket list without opening it

MARS-333 mars Done

Solicitud detail page (/administrar/solicitudes/[id]) must surface ALL applicant-submitted form fields, not a partial subset

MARS-186 mars Done

Invalid-JTP práctica sweep: reassign all practicas with jtpUserId=FOUBA/admin/non-teacher to proper record (never delete/orphan)

MARS-185 mars Done

Build Mars real-time per-ticket support→PM-channel DM (clone PLUTO-191) — unbuilt EVO-31 leg, caused SOP-16 59.8h-unseen; BLOCKED on cross-app mechanism decision (pm-venus consolidating to Elazar)

MARS-179 mars Done

404 classifier scanner-probe gap: external vuln-scanner paths nested under a legit segment (/app/.git/config 29x paged 2026-06-29, /informes/.env, /<seg>/wp-login.php, .php) inherit own-route via top-segment fallback -> alert. Fix: pre-filter denylist demoting dotfiles (except .well-known), .php[0-9]*, token set (wp-admin/wp-login/xmlrpc/phpmyadmin/cgi-bin/vendor/actuator/.aws/.git) to a SILENT info/security tier (force-retain 365d, ZERO page) BEFORE the top-segment fallback. Denylist must match ANY path segment (nesting), not root-anchored. Adopt Pluto's proven SCANNER_PROBE_RE as reference (PLUTO-442/446/450). Cross-fleet defect (venus VENUS-80, pluto PLUTO-450). Reversible; ambiguity still defaults to error per 404-is-error.

MARS-340 mars Done

error-digest cron daily liveness heartbeat: emit logEvent(info/admin/error-digest-ran) on EVERY run before the below-threshold early-return, so cron-alive is a trivial DB query forever

MARS-148 mars Done

Práctica Historial leaks raw archiveReason codes to users (admin:backfill-practicaCodigo, admin:sa-update-replay)

MARS-47 mars Done

Redesign /estadisticas around client's true ask: headline = count & % of teeth 4-7 within CORREGIDAS universe (683/45.2% vs demás 827/54.8%), not a corregidas-rate; fix live Grupo-B=0 stale-cache bug; add corregidas-vs-no-corregidas section + patient profile of 4-7 teeth (procedencia/complejidad/intervencionDocente/sexo/ageBand, widened matview); Pluto /informes KPI-card layout no chart lib; GRADO default (Elazar bs-mqungtiyqty 2026-06-26)

MARS-193 mars Done

Modal/dialog friction telemetry: instrument the shared dialog/modal primitives (edit-rules ACK modal, ConfirmDialogButton, any other Dialog) to emit appEvents on shown / accepted / dismissed / abandoned-without-action, so silent friction like the edit-rules block becomes queryable. Conform to fleet appEvents standard; dedup so a re-render does not spam. Class-A: appEvents write-path + multi-surface; audit design-ping before impl. Elazar 2026-06-30.

MARS-351 mars Done

Disable dormant never-onboarded students (never logged-in/authed this cycle) so they drop from reports + regular screens

MARS-146 mars Done

periodos deletedAt/isActive invariant trigger (mig016): a soft-deleted periodo could coexist with isActive=true (archive trigger is archive-only, never clears isActive), so isActive-only reads could surface a deleted periodo. Elazar's root-fix = enforce the invariant at source via BEFORE UPDATE trigger: deletedAt NULL→NOT NULL forces isActive=false; restore (deletedAt→NULL) does NOT auto-activate (admin sets deliberately). Scope: periodos is the ONLY table with both columns; 0 existing violations (no data repair). fn_periodos_enforce_isactive + trg_periodos_enforce_isactive, runs before trg_periodos_archive (alphabetical) so archive row captures isActive=false. Supersedes MARS-203 item-4 (periodo read-patches no longer needed). Audit pre-apply DDL review then db applies via MCP.

MARS-205 mars Done

Admin 'Ver como este usuario' (view-as) on /administrar/usuarios/<id>: let an authorized admin view the app as a given user to diagnose friction (motivating case: stuck student at edit-rules modal). Class-A SECURITY — impersonation touches auth/session/RLS + must be fully audited + admin-gated. Design-first: coder proposal (read-only view-as vs full-session assume, audit-logging of every impersonation, admin gate, clean exit-back-to-admin), audit design-review BEFORE build. Confirm Mars (path is /administrar not /admin) + read-only-vs-action scope w/ Elazar. Elazar 2026-06-30.

MARS-352 mars Done

weekly-KPI cron ENOTFOUND: DATABASE_URL_DIRECT repointed direct-host(06-19 edit)->session pooler + connectTimeout hardening; this-week blast=0 sent, re-send pending Elazar

MARS-176 mars Done

Weekly-KPI JTP self-digest does not reach ayudante-picked-as-JTP recipients — JTP_SQL scopes recipients to TCM roleLabel='JTP', so an ayudante carrying real picked-práctica backlog gets no self-nudge to grade it

MARS-139 mars Done

Externalize inline superuser DSN in db/backup-db.sh

MARS-134 mars Done

Downgrade image validation-rejection log level error→warn (size/dimension too small) so it self-excludes from the actual-error watcher; keep genuine upload-infra failures (image-API 500/PROCESSING_FAILED/timeout) at error. Sites: image upload + edit-image-upload-failed paths

MARS-75 mars Done

Demo sample-image generation broken: missing a-/b- sanitized fixtures + pm/sample-images not traced into Vercel bundle

MARS-71 mars Done

Practica notification delivery gap: @odontologia.uba.ar SMTP CONN-ETIMEDOUT failures are permanent (no retry) — teachers silently miss new-practica emails (8+ active unreviewed, some 5+ wks). Need retry queue and/or in-app pending-practica fallback so delivery never depends on a single SMTP attempt. See db email triage 2026-06-09

MARS-76 mars Done

Weekly-KPI email subject: append send-date (format 2026-Jun-30, ART, Spanish month abbrev) to the subject line; keep each email's existing single-período segment as-is (do NOT merge Grado+Postgrado). Class-S: subject-string template only, no audience/recipient/auth/predicate change. Elazar 2026-06-30.

MARS-350 mars Done

updatePostgradoProgression: wrap in withTransaction + setArchiveContext so studentPostgradoProgression archive rows carry archivedBy/archiveReason (currently NULL — actor signal lost once its appEvent is cut in Phase A)

MARS-72 mars Done

MARS-78 follow-ups: (A) log-hygiene fixes — toast/error-shown drop-or-downgrade from error (540 noise rows), practica/edit-image-upload-failed downgrade to warn (MARS-75 parity, 78 rows), navigation/404 capture pathname in detail (currently NULL — can't diagnose), client/unhandled-error add error.stack fallback for null-message entries (56 undiagnosable). (B) clean up 11 api-images orphaned by today's isDemo trigger regression (db supplies the image IDs; delete via image-api DELETE). Elazar approved both 06-09.

MARS-79 mars Done

PWA install-everywhere (bs-mqw8mww8u4h fleet decision): make Mars installable on Chrome/Edge desktop + Chrome Android (full) + iOS Safari Add-to-Home + macOS Safari Add-to-Dock. Mars is greenfield (zero manifest, zero SW, partial icons). Build the a-d add-list: (a) src/app/manifest.ts — name 'Evolutiva Mars'/short_name 'Mars'/start_url '/'/display standalone/theme+bg from globals tokens/icons 192+512+512-maskable; (b) generate public/icon-192.png, icon-512.png, icon-512-maskable.png from mars-planet.png (maskable ~20% safe-zone pad); (c) layout.tsx metadata appleWebApp{capable,title 'Mars',statusBarStyle} + icons.apple wiring existing 120-180 apple-touch files + viewport export with themeColor; (d) minimal service worker + client registration. a/b/c alone unlock iOS A2HS + macOS Add-to-Dock; a-d unlocks Chrome/Android full install+prompt. Firefox desktop = unfixable non-goal. Clone Pluto's live manifest+sw+icon shape. Reversible, no DB/auth. Audit diff + PTD.

MARS-338 mars Done

Sweep: uuid-format guard on all [id] resource routes (comisiones/docentes/alumnos/periodos/solicitudes/soporte/usuarios) — a non-uuid id casts into a uuid-typed query → 'invalid input syntax for type uuid' → unhandled 500 before missing/deleted handling runs (same latent defect found+fixed on practicas via MARS-155). Mirror the practicas data-layer guard (return null on non-uuid → existing friendly not-available path) or a shared isUuid() helper across all resource routes. Reversible per-route guard.

MARS-163 mars Done

MARS-3 follow-up: /practicas filter should match /informes attribution (check ayudanteUserId in jtp filter)

MARS-18 mars Canceled

Weekly-KPI inline sends silently drop on transient SMTP 421: no retry + batch completion counter falsely reports fail:0 (5 teachers missed Monday digest 2026-06-08)

MARS-65 mars Done

Práctica identification: folio-primary UI polish — add Folio column to student/alumno práctica tables, lead changelog with folio, enable search-by-folio (keep HC as clinical secondary)

MARS-66 mars Done

createUser GoTrue NULL-token lockout: blank 8 auth.users token cols to '' (helper + repair) — cross-project, mirrors venus 5f4e8cb

MARS-143 mars Done

Pin NEXT_SERVER_ACTIONS_ENCRYPTION_KEY in Vercel prod (stop per-deploy server-action-ID churn)

MARS-133 mars Done

Device viewport telemetry: one-per-session client-env/viewport appEvent + /api/log-client-env route + breakpoint-band aggregation for mobile UX

MARS-129 mars Done

UX: eliminate /practicas/nueva guardrail toasts (piece-required add+submit, combined-image-size) via inline affordance enforcement

MARS-127 mars Done

MARS-84 durability follow-up: move the ux-pain-digest hub-DM relay from agent-side CronCreate to the venus host-poller (systemd-grade) — curl /api/internal/latest-ux-pain-digest weekly + DM PM+Elazar; needs CRON_SECRET in the host store + maintainer coordination. CronCreate dies with the agent session (misses a week if down at fire time); email leg backstops but DM should be durable.

MARS-124 mars Done

DB: drop 18 unused indexes (8 practicaTeeth clinical-filter + 3 practicaToothConductos + 3 practicas demographic + comisionId/accessRequestId/entitySeq/support/lock dead indexes); KEEP ix_appEvents_category_action_createdAt (new, stats unpopulated); reduces write amplification; audit pre-apply migration

MARS-121 mars Done

DB hygiene sweep: pull Supabase security + perf/index advisors + log planes (postgres/auth/api/storage/edge); analyze real signals vs infra noise; keep/drop report to PM; DDL via audit pre-apply

MARS-120 mars Done

docentes detail page: supervised ayudantes/JTPs must appear under their Adjunto (Belén Montoya missing under Nicolás Alfie in comisión F; alumnos-a-cargo all old year-comisiones, none from F)

MARS-6 mars Done

DB: search_path hardening (lint 0011) — audit SECURITY DEFINER fn subset FIRST (privesc priority), then pin SET search_path=public on flagged fns; behavior-preserving; DDL via audit pre-apply

MARS-119 mars Done

Restore practica/create success telemetry (regression since June 9): 499 prácticas created in 14 days but ZERO practica/create success appEvents — the success event was dropped or renamed in a commit around June 9, so the create funnel (start→success, mid-form abandonment) has been invisible for 2+ weeks. Fix: find the create action (practicas/nueva/actions.ts) + restore the success appEvent (logEvent on successful create), confirm it lands in appEvents. Reversible. Found in /practicas/nueva friction analysis 2026-06-26.

MARS-336 mars Done

Audit DateDmyField required-enforcement (parallel to Pluto PLUTO-10): src/components/form/date-dmy-field.tsx puts required on a HIDDEN input → browsers never constraint-validate it, so required is silently inert. Every caller relying on it for required-date enforcement has a validation gap (only explicit JS/server check actually blocks). 8 caller files in src. Audit each required DateDmyField caller, confirm an explicit check exists, add where missing. Root cause discovered via Pluto práctica DOB empty-date DB error.

MARS-62 mars Canceled

appEvents severity misclassification: notify-email-failed + client/unhandled-error logged as warn (should be error); navigation/practica-link-dead logged as info (should be warn)

MARS-105 mars Done

postgrado-progression.tsx Guardar lacks double-submit guard — bare async action (no useTransition), double-click fires two updatePostgradoProgression UPDATEs + two archive rows. Fix: wrap in useTransition + disabled={isPending} (~5 lines, same pattern as SupportReplyForm)

MARS-61 mars Done

api-images tenant-isolation cutover: hand owned image-id list for backfill + verify Mars images resolve post-cutover + confirm API_KEY_MARS scoped

MARS-110 mars Done

Teacher /alumnos redesign: row-click to student's practicas (active-periodo, JTP/ayudante-scoped) + drop email/inline-JTP-select + isStudentInScope ayudante-gate fix + denyAccess on /alumnos/[id]

MARS-111 mars Done

Real-life-as-SSOT JTP attribution analysis: quantify divergence between start-of-year studentAssignments (error-prone excel import) and actual student JTP picks (práctica.jtpUserId). Two mismatch classes: (1) JTP students picked but aren't assigned to; (2) students assigned to a JTP who picked a different one. Analysis only first (no writes); evidence base for evidence-based reassignment (NOT admin-pick UI). Links MARS-43 + live-vs-snapshot rule. (Elazar 2026-06-14)

MARS-126 mars Backlog

Multi-tooth RX tagging UX: passive-strong signal, not nag. (a) dropdown already lists only the práctica's selected teeth [live]; (b) untagged RX card gets red border + 'elegí la pieza' placeholder as primary passive cue; (c) auto-open+flash ONLY the last-added image's dropdown (never all — batch-add of N would fire N opens); (d) submit-with-untagged scrolls to+opens first offender instead of a toast. No modal. Single-tooth keeps silent auto-pick. Brainstorm: coder-mars+audit-mars-cc, approved Elazar 2026-06-12. Build after B2 edit-path.

MARS-99 mars Done

Edit-form RX upload parity (mi-cursada/[id]/editar): image-upload-area.tsx still has accept='image/jpeg' — same silent HEIC-drop class as SOP-13/MARS-94 but on the EDIT path. Apply the MARS-94 add-time fix: widen accept jpeg/png/heic/heif, de-silence with named toast, native HEIC->JPEG convert. Verify whether edit-form uses image-upload-area or its own handler first. Client-only fast-follow.

MARS-95 mars Done

errscan noise: login-unknown mis-leveled (callback/route.ts) pages the frequent tier; re-level warn->info + make errscan spike detection signature-aware so credential-stuffing volume still alerts independent of level (same class as Pluto P3-2)

MARS-96 mars Done

SOP-13: práctica /nueva RX upload — iPhone HEIC 'Pre' RX silently dropped at add-time (accept=image/jpeg + silent non-JPEG continue); student submits incomplete 3-RX sets. Fix shipped v2.15.17 (f43733d): widen accept jpeg/png/heic/heif, de-silence w/ named toast, native HEIC->JPEG convert via createImageBitmap, + adaptive recompress for secondary aggregate-cap mode. Client-only.

MARS-94 mars Done

EPIC: shift /users /estudiantes /docentes from admin-dashboard mgmt to self-managed roster (JTP/Ayudante/Adjunto/students self-pick relationships + self-confirmation workflow)

MARS-87 mars Backlog

Prod: support-reply action hangs on Enviando (no SMTP timeouts)

MARS-58 mars Done

Telemetry-gap sweep+fix: find+fix places where (1) HTML form validation failures aren't recorded as telemetry, (2) try/catch is missing on user actions, (3) toasts are missing on failures, (4) toasts aren't recorded as telemetry, (5) save/submit buttons fail silently without reason saved as telemetry. Goal: every user-facing failure leaves an appEvents row. Elazar 2026-07-02.

MARS-369 mars Done

Notification fan-out: graders-only at práctica-create call site (drop whole-comisión TCM fan + postgrado widening)

MARS-9 mars Done

Investigate práctica snapshot jtpUserId==ayudanteUserId: does persistPractica copy ayudanteUserId into the jtpUserId snapshot slot at creation? (303b6f3b froze Belén Montoya in BOTH slots; real JTP is Gonzalez; reviewedBy a 3rd teacher Spinosa). Quantify systemic-ness + audit persistPractica snapshot-write. Root-cause the flow — NO row patching.

MARS-19 mars Done

Práctica detail page: large empty whitespace below the bottom Historial card (viewport down to bottom is blank). Repro: open any /practicas/[id], scroll to Historial. Likely over-tall container min-height or stray bottom padding/margin. Check the recent MARS-364 .main-content padding-bottom:5rem change as a regression suspect. Elazar via bin-whey 2026-06-30.

MARS-367 mars Done

Telemetry friction analysis: mine existing appEvents/toast/error telemetry for data-backed friction-reduction opportunities (no guesses) - rank by frequency x user impact, propose concrete fixes. Elazar 2026-07-02. Read-only analysis deliverable.

MARS-370 mars Done

User dedupes: Tavolaro + Olexen

MARS-217 mars Done

MARS-48-D rework: prominent top no-reply banner (not footer) on 6 auth/onboarding emails

MARS-55 mars Done

solicitud detail /administrar/solicitudes/[id]: add 'ID de Solicitud de ingreso' label + self-link value (mirror MARS-51)

MARS-52 mars Done

práctica detail Comentarios: remove redundant 'Nuevo comentario' heading (placeholder already says it), preserve input a11y label

MARS-54 mars Done

Copiar-link affordance: shared CopyLinkButton on soporte/[id] heading (Ticket: SOP-N self-link) + practicas/[id] ref label

MARS-337 mars Done

práctica detail: relabel Código → ID de práctica + make código value a self-link to /practicas/[id]

MARS-51 mars Done

supportTickets human-readable ref (SOP-NNNN) in UI+email+links + fix Estado raw-UUID leak

MARS-45 mars Done

Human-readable práctica reference code (YYMMDD-NN, per-student-daily)

MARS-44 mars Done

Adopt PLUTO-462/463 fleet-canonical scanner-probe extension (SCANNER_PROBE_RE block K+L, 20 alts from the 2026-07-01 credential/infra sweep) into src/lib/not-found-classify.ts — additive to the 404-probe pre-filter, demotes matched probes to silent info/security tier (no page). Collision-checked 0-hit vs 68-route Mars manifest + public/; config.xml EXACT, config/*.json dir-anchored, /exec+generic verbs held out (recurrence-watch). Shipped dea8359 v2.23.13.

MARS-368 mars Done

PWA install-prompt (A2HS offer): mobile-only, only when not already installed, dismissible. Android/Chrome=capture beforeinstallprompt→custom 'Instalar app' button/banner→prompt(); iOS Safari=manual 'Compartir→Agregar a inicio' instructions banner (no auto-prompt API). Builds on MARS-338 PWA infra. Cross-fleet Elazar directive (Pluto=PLUTO-443).

MARS-339 mars Done

Proactive unreviewed-práctica backlog outreach: identify top 3-4 teachers (JTPs) by sin-revisión backlog, the active JTP in each's comisión, the adjunto + titular; draft email to adjunto/titular asking how to address the backlog before it's insurmountable. Real-audience outbound — held for Elazar approval before send. (Elazar 2026-06-14)

MARS-125 mars Backlog

Audit dormant/zero-auth user cohort for re-deletion: the 82 June-20-purge users confirmed zero auth footprint (0 login attempts in 14 days, scan 2026-06-26) are a clean re-delete candidate set; widen the audit to ALL dormant/never-onboarded users (active studentAssignment but no auth reality) and produce a re-delete vs keep decision per the 3-bucket auth-reality rule (ever-signed-in / recent-attempts / zero-footprint). Deferred by Elazar 2026-06-26 to be done later. Hold the actual soft-delete for Elazar go (bulk real-user op).

MARS-198 mars Done

Prod: práctica create broke — MARS-40 column drop left fn_archiveStudentAssignmentChange referencing dropped studentAssignments.jtpUserId; trigger rewritten in prod, must capture in repo SSOT + sweep for other stale refs

MARS-50 mars Done

docentes/[id]: add 'Equipo a su cargo' section showing supervised JTPs/ayudantes under an Adjunto (split from MARS-6 defect 1). No supervisor FK exists — derive supervision as: teachers (role jtp/ayudante) sharing a comisión where THIS user has role=adjunto. Active-periodo scoped (teacher-views-active-periodo convention). Repro: Belén Montoya must appear under Nicolás Alfie in comisión F. Design ratified by PM: new nested section, same-comisión adjunto→jtp/ayudante derivation, active-periodo only. Open Q for Elazar: adjunto-only supervisor, or also titular?

MARS-85 mars Done

Email outbox: persist + cron-retry user-facing sends so SMTP timeouts never block the user or drop mail

MARS-59 mars Done

Solo-agent push-gate lints (WARN-tier): archive-context PRESENCE (flag INSERT/UPDATE/DELETE on an audited table in src/ with no setArchiveContext in the same fn - the real blind spot; today's lint only validates the reason string IF setArchiveContext exists) + soft-delete-filter (flag FROM/JOIN on a soft-deletable table without deletedAt IS NULL / active-view). Both are grep/AST heuristics = high false-positive -> ship WARN-tier with curated audited-table + soft-delete-table maps + allowlist-comment escape; hard-fail only once maps curated. isUuid-guard presence deliberately NOT a static lint (too many query shapes, fragile) - left to auditsolo negative-assertion. Source: 3-lane solo-agent design review 2026-07-02.

MARS-373 mars Done

Schema cleanup drops — accessRequests.correoAlternativo (100% null), helpArticles+helpArticleTags+vHelpArticles (0-row never-used), vErrorsLast5/10/20 (keep vErrorsLast25), dead tickets+ticketEvents (16 closed rows/0 events vs live supportTickets). Verify zero src refs before each drop.

MARS-39 mars Done

Unauthenticated /practicas/[id] click → notFound() (bare 404) instead of /login?returnTo; MARS-89 friendly branch is session-gated so logged-out email-clicks bypass it

MARS-90 mars Done

Codex audit — MED quick-wins: lang es-AR + image-route private cache + AR-tz format trio

MARS-37 mars Done

sa-teachers-cascade over-flags needsManualReview on unresolvable ayudante (recurring warn). Scope needsManualReview to JTP slot only — ayudante is informational per JTP-only-grading rule; + make the cascade warn idempotent (skip re-emit when SA already needsManualReview) so one batch \!= N pager hits

MARS-93 mars Done

/practicas redesign (Elazar brainstorm 2026-06-06): unify list+grading into one role-aware page

MARS-32 mars Done

└─ Implement sidebar regroup from /sidebars-preview (Elazar 06-06): adopt the previewed per-role nav as the LIVE app-sidebar, preserving MARS-33/34 /practicas changes (merged Prácticas, no Por-calificar link, Nueva-práctica as button). Shares app-sidebar.tsx with MARS-34 -> coder-mars owns, sequence AFTER MARS-34. coderhelp to define concrete current->proposed diff first.

MARS-36 mars Done

└─ /practicas (b) role-aware JTP sectioned view: 1-line KPIs (getJtpStats), Por revisar tuyas, Por revisar en tus comisiones (NEW excludeJtpUserId param), Prácticas en tus comisiones (default scope); filters collapse to flat list; simplify BACKLOG_LANDING_ROLES landing. Builds on a/c/d

MARS-34 mars Done

└─ /practicas a/c/d quick patch: (a) Nueva-práctica header button + drop teacher sidebar link; (c) drop Fecha-de-Carga col, student-name first; (d) inline Calificar button on sin-calificar rows -> /practicas/[id]#calificar, gated canReview(reviewPractica|fullAccess)&&noRevisado; graded rows show reviewedAt (Calificada el…)

MARS-33 mars Done

Profile-image IDOR: /api/image/[id] open-proxies profile blobs when no practicaImages row matches; gate on profileImageId ownership (self+admin) else 404

MARS-115 mars Done

Disable SupportReplyForm submit while pending (double-submit guard)

MARS-57 mars Done

Data-min hardening of client-env viewport telemetry: drop raw userAgent + exact px + session_id, store fine width buckets + dpr bucket + orientation + deviceType + OS-family, keep actorUserId for role tie

MARS-130 mars Done

Scanner-probe 404 classifier — adopt PLUTO-453 canonical infra/cloud/backup/profiler probe family (docker/azure/gcloud cred dotdirs, cloud-cred JSON, .ya?ml, .tf(state|vars), .sql(.gz), profiler/heapdump/threaddump/configprops, archives .zip/.tgz/.tar.gz, whole-path dump|trace|logfile). 07:32 UTC sweep paged 87x Dockerfile/k8s/docker-compose + 87x backup.tar.gz — NOT envfile so canonical C misses them, warn-page. Demote-only to silent security/info forceSync-retain. MUST re-prove anchor discipline on Mars manifest: cred dotdirs stay (^|/) any-segment; bare-ext yaml/sql/tf/zip/tar.gz safe ONLY if public/+handlers serve zero such files (confirm); .json STAYS filename-anchored (442 ban). Cross-fleet: PLUTO-453 live canonical, VENUS folds in. Reversible.

MARS-341 mars Done

Delete-own-practica from detail page soft-nav-revalidates the now-deleted [id] URL before navigating away - fires spurious soft-deleted-resource error-404 + leaves user on a dead page; redirect to list after delete instead. 2 confirmed users 2.5h apart

MARS-172 mars Done

Allow JTP (docente) reassignment on a non-graded práctica — student or teacher initiates, both old+new docente emailed, changelog

MARS-184 mars Done

Add 'Estado' filter to /practicas list: Todas / Aprobadas / Desaprobadas / Sin calificar / Devueltas para rectificar. MUST include prácticas even when no teacher (JTP) was picked — the filter and list cannot drop teacher-less prácticas (esp. relevant to Sin calificar / Devueltas). Map options to the práctica review-state SSOT. Elazar 2026-06-30. Reversible UI+query.

MARS-361 mars Done

fn search_path pin drift + missing-migration source-sync (mirror venus EVO-8)

MARS-153 mars Done

Enrich /estadisticas page to email-report richness + client transcript ask: A premolares/molares (x.4-x.7) vs B demás dientes comparison + participación/tasa-corrección/por-sexo/top-5/maxilar-lado, grado-default, all client-side from cached matview (widen matview to all teeth); anatomical labels, no emails (Elazar 2026-06-26)

MARS-192 mars Done

alumnos/[id]:56 authed capacity-denial logs BOTH logEvent(info/denied) AND captureServer404()+notFound() - extra error-tier 404 row over the info denial; align to friendly-200 'no disponible' pattern (MARS-89) or single-log, not double

MARS-171 mars Done

Friction telemetry expansion (MARS-351 follow-up): (a) record a 'practica-opened' UX event when a user opens a práctica detail; (b) record an 'editar-clicked' UX event when the editar button is clicked (distinct from the existing modal-shown). Both via the existing /api/log-ux-event sink, category=ux level=info, actorUserId server-derived, include actor role in detail so events are filterable by student vs teacher. Modal shown/accepted/dismissed already shipped (MARS-351). Completes the funnel: practica-opened -> editar-clicked -> modal-shown -> accepted|dismissed|abandoned. Elazar 2026-06-30. Reversible.

MARS-360 mars Done

Anon/expired no-session at 3 protected [id] pages (practicas/mi-cursada/soporte) logs spurious error-tier auth-denied 404 - EVO-12 cousin; switch notFound()+capture to redirect(login) to match comisiones/editar siblings

MARS-170 mars Done

Show solicitud id (SOL-N) on /administrar/solicitudes like prácticas/tickets

MARS-183 mars Done

Admin 'change login email' server action (Google-OAuth identity re-point) — bs-mqq2v3r1802. Mars layer-2 = pure email-bind (auth/callback resolves by normalizedEmail, no authId/no id=uid link), so action is lightest: update users.email (normalizedEmail regenerates) + service-role delete stale old auth.users row. Gate by Mars user-mgmt cap (NOT bare fullAccess), allowlist-check new domain, dedup-guard reject if canonical(new) is a live user, setArchiveContext + audit email delta. Proof-of-control = student re-login on new Google account. No app has this today; Elazar-launched build.

MARS-182 mars Done

Glow spotlight on 'Mi propia práctica' toggle at /practicas/nueva for one week, self-expiring after 2026-07-02 ART (cutoff 2026-07-03T03:00:00Z). Date-gated glow class, no env var / no DB flag — auto-disables July 3 with zero intervention. Elazar new-feature spotlight for the dual-role fix.

MARS-197 mars Done

Práctica detail /practicas/[id] Comentarios: prefix each comment author with a role label — 'Docente:' before a teacher's name, 'Alumno:' before a student's name — so it's clear who wrote each comment. Resolve role via the live-DB role helper (userRoles), not a JWT claim. Elazar 2026-06-30. Reversible UI.

MARS-359 mars Done

Email drift: users.email != auth.users.email (dot/canonicalization mismatch) for 9 active users via supabaseAuthId FK; preRegistered/email lookups likely use lower(trim) not gmail-canonicalizeEmail. Analog of PLUTO-152. MARS-146 was immune (FK-join predicate, not email-join), but the data-quality gap exists: any email-based join/dedup/lookup can mis-match these 9. Audit the email match-key paths; align to gmail-canonical comparison key (never mutate stored address). Investigate-first, no mass write

MARS-151 mars Done

Support-reply button stuck on 'Enviando…' at /administrar/soporte/[id] (+ reporter /soporte/[id]) — SupportReplyForm useActionState isPending pinned by revalidatePath-aborted RSC re-render (same class as a85db9a comentario fix). Fix: manual onSubmit + useState submitting + try/finally reset + double-submit guard; keep revalidatePath (thread list not co-located). Covers both staff + reporter ends.

MARS-196 mars Done

SOP-22 (2nd occurrence): alumno+ayudante dual-role users can't file their own posgrado prácticas — /practicas/nueva treats viewStudents cap (granted by ayudante) as hard isTeacher binary, locking 4 dual-role posgrado students out of self-creation. Fix: decouple teacher/student, explicit creationMode self-vs-forStudent, mode toggle for dual-capable only, single-role unchanged, forStudent stays viewStudents-gated. No DB change. Audit pre-impl review (auth/role path).

MARS-195 mars Done

Edit-rules ACK modal: remove the checkbox; consent is the button click. Relabel primary 'Aceptar'->'Leí y acepto' (records editRulesAckAt), keep 'Cancelar' secondary, button always enabled (no checkbox-gated disable). Removes the friction that trapped 41 students (MARS-351 follow-up). Elazar 2026-06-30. Reversible UI.

MARS-358 mars Done

Fix not-found.tsx false-capture (EVO-12/EVO-19): pull 404 capture out of the eagerly-serialized not-found boundary into two-sink — catch-all [...notFoundPath] + instrument [id] notFound() throw sites; preserve skew telemetry

MARS-169 mars Done

Make patient sexo REQUIRED on práctica create+edit (both planes): client required marker + server reject-null with Spanish error; existing 109 NULL rows left for student edit (Elazar 2026-06-26)

MARS-191 mars Done

Snapshot client-env telemetry dataset, then stop screen-size collection (drop dprBucket)

MARS-156 mars Done

Fix practica-link-dead (stale notification bell links to soft-deleted prácticas): root cause CONFIRMED — when a student self-deletes a práctica after submit, the in-app notification (practicaToReview, link=/practicas/<id>) is NOT scrubbed, so it stays in the recipient's bell; clicking it 404s (practica-link-dead, readAt matches the dead-link hit exactly). 14 hits/7 users/14 days. Three-part fix: (1) on práctica soft-delete, scrub/invalidate the related notification rows (cascade or mark invalid + setArchiveContext); (2) bell UI should not render a clickable link to a práctica with deletedAt set (join notifications→vPracticas, grey out if no match); (3) /practicas/[id] shows a friendly 'práctica eliminada' state instead of a 404 — also covers the stale-direct-URL case (1 of 7 had no notification row, likely browser history). Reversible. Auth/notification-adjacent → audit pre-impl design ping.

MARS-204 mars Done

Triage: 3 practicas have an aprobado review row but current state noRevisado (approved-then-reset data integrity)

MARS-4 mars Done

estadisticas efficiency: vMultiradicularStats → MATERIALIZED VIEW + unique index + pg_cron daily REFRESH CONCURRENTLY 03:00 UTC (db) + route ISR revalidate=86400 drop force-dynamic (coder); caps DB to 1 refresh/day regardless of traffic (bs-mquhv9lyu5t)

MARS-190 mars Done

Standardize 'no respondas a este email — respondé en la app' banner + in-app CTA across ALL Mars outbound emails

MARS-48 mars Done

EPIC active-view-by-default (Elazar directive 2026-06-26): every soft-deletable table (deletedAt column) must have a canonical active-view filtering deletedAt IS NULL; the app reads the view BY DEFAULT and the raw table only for admin/restore access. Root structural fix for the practica-link-dead class (soft-deleted prácticas still rendering as clickable links to teachers) and any future see-the-deleted-row bug. Scope: (1) db inventory tables-with-deletedAt vs existing active-views + the gap + ONE canonical naming convention (existing views fork camelCase vStudentAssignments vs proposed v_<table>); (2) coder map app read-paths hitting raw tables that must switch to the view, and the admin/restore paths that keep raw access; (3) create missing views; (4) migrate app reads; (5) audit each read-path swap. Staged, reversible per-view+per-path. Cross-project pattern candidate (mirror to pluto/venus). Plan-first; do not build until Elazar sees scope.

MARS-202 mars Backlog

informes: attribute JTP/ayudante stats by who GRADED (reviewedBy), not who was assigned

MARS-3 mars Done

Evidence-route grading: auto-assign stuck noRevisado practicas off zero-review JTPs to active graders (resolver + daily cron + heal)

MARS-2 mars Done

/estadisticas public stats route: live teeth-statistics page (multirradicular x.4-x.7 counts + totals + breakdowns from the 25-Jun report), available to all roles, programa filter Grado-default / Postgrado / Ambos. Compute in PG (programa-scoped view), render with app primitives.

MARS-189 mars Done

Serve full apple-touch-icon set (fleet 404-cleanup): add real PNGs to public/ — /apple-touch-icon.png + -120x120/-152x152/-167x167/-180x180, each with -precomposed alias, downscaled from Mars logo. iOS/Safari 404 cleanup. Reply SHA to pm-pluto-cc (management ARO tracker).

MARS-194 mars Done

Reassign Costadoni students (maternity leave): split half to Schmer + half to vicdavid92; report her prácticas involvement

MARS-7 mars Done

BUG: teacher-stats list Nicolas sees (GRADO/getJtpStats) drops ayudantes — Belen Montoya missing, only 6 JTPs render; pasted numbers are pre-MARS-3 (Tapia 97 vs deployed 50)

MARS-8 mars Done

└─ weekly-KPI digest: un-suppress ?jtp= drill link for ayudante rows (stale after 7fc2ec3 widened the filter to jtpUserId OR ayudanteUserId)

MARS-20 mars Done

Investigate Mars exposure to the PLUTO-145/EVO-6 pool-acquire-timeout class: does getPracticaLookups-equivalent + /practicas//reportes filter-lookup loaders fire ~N concurrent pool.query on hot student paths (claiming a big share of pool max=8 under concurrent students)? If so, scope json-CTE bundling (venus's fix: ~10 conns -> 1) as complement to MARS-145 pool sizing

MARS-150 mars Done

Accept .webp uploads on práctica RX intake (/practicas/nueva + /mi-cursada/[id]/editar): iPhones export .webp by default and the client format gate rejected it, blocking real iOS users (5 toast hits June-24, surfaced in UX-pain analysis). Fix = client-only widen: add webp to both image-client.ts gauntlet regexes + the accept attrs on create+edit forms; the canvas re-encodes webp→jpeg before upload so the SERVER stays jpeg-only (image-api.ts untouched — keeps libwebp decode surface off our infra, audit invariant). Shipped 6727a52 / v2.22.7, coder+audit 2-way consensus, Elazar pre-authorized. Closing on PASS.

MARS-201 mars Done

Server-enforce role-required access-request fields: submitAccessRequest only hard-validates 6 always-fields; legajo/programa/comision/jtp rely on browser-only required (latent direct-POST bypass). Add server-side detectMissingFields(role) reject in submit. + add audit .md rule: any client-required field must be server-enforced (front/back contract).

MARS-188 mars Done

/alumnos renders raw UUIDs in Comisión + JTP/Ayudante columns instead of names — violates evolutiva-commons no-raw-IDs-in-UI rule. Surfaced by Elazar 2026-06-30 (Diana duplicate screenshot). Fix the /alumnos render path to resolve comisiónId->comisión name and jtpUserId->teacher name via existing name lookups/views. Reversible UI fix.

MARS-356 mars Canceled

Fix Safari <15.4 dialog.showModal crash — central feature-detect + fallback overlay in shared dialog primitive

MARS-180 mars Done

classifyNotFound route manifest omits real /login → mislabels transient /login 404 as genuine-bad-route; also blocks skew-guard resolvesToCurrentRoute downgrade

MARS-168 mars Done

One-time heal: clear all unread practicaToReview bells fleet-wide (14761 across 100 users)

MARS-10 mars Done

/notificaciones card UI fix (Option A: full-width, left-aligned, selectable text, even rows; title-click navigates)

MARS-11 mars Done

DataTable migration: tickets, solicitudes, comisiones, periodos, usuarios, docentes/[id]

MARS-216 mars Done

Support: replySupportTicket — mid-thread reply-to-reporter action (email free-text + log appEvent, no status change)

MARS-46 mars Done

Alumno-primary-with-teacher-membership sidebar edge case

MARS-211 mars Done

BAUTISTA cross-comisión JTP anomaly

MARS-210 mars Done

Migrate ~132 raw inputs/selects to Field primitives

MARS-209 mars Done

└─ Migrate raw <select> × 16 → shadcn Select primitive

MARS-232 mars Done

└─ Cleanup raw <button> × 22 → Button primitive

MARS-233 mars Done low

└─ postgrado-progression date inputs → DateDmyField

MARS-307 mars Done low

SCANNER_PROBE_RE gap: vendor appliance path /access/api/v1/system/ping pages on mars and pluto, 3 hits from 3 IPs

MARS-790 mars Blocked low

└─ MARS-790 step 5: SCANNER_PROBE_RE must be assertable directly - tail vectors are green lines in 4 of 5 apps

MARS-791 mars Backlog low

Image-proxy read path does not retry a 20s TTFB abort, so the student gets a 500 even though a fresh connection would likely be served

MARS-792 mars In progress low

bedel can write: updateImageRotation reachable by any read-only-all bedel via canViewPractica

MARS-747 mars Blocked low

Review-depth pilot: measure audit token burn and shallow-sample quality

MARS-802 mars Blocked low

No surface can add conductos to an existing practica, so a tipo change into endo costs the student their practica

MARS-785 mars Blocked low

Post-commit student notification is fire-and-forget: a transient INSERT timeout loses the in-app notice permanently, and its only redundancy is a sibling best-effort email

MARS-793 mars Backlog low

WATCH: post-MARS-799 connection phase evidence

MARS-787 mars Backlog low

SOP-MARS-58 follow-up: awaiting Romina Seron on D - Endo 1 libreta-digital login confirmation

MARS-745 mars Done low

supautils force-grant census: public functions holding EXECUTE outside their allowed set (R6 forbidden-set read, inventory only)

MARS-803 mars Done low

Stamp breaker telemetry with deployment/container identity and a trip generation so opens and closes can be correlated

MARS-783 mars Done low

image-upload rejections are the single largest error-toast family on mars: 14 of 62 in 7 days, 9 of them 400x400 too-small on WhatsApp-forwarded radiographs

MARS-781 mars Done low

practica-date:future is undiagnosable: the feedback row records WHICH validation fired but never the date the student typed, and one student hit it 7 times in 3m14s

MARS-794 mars Done low

Client fetch drop on /practicas/nueva: 48 events, 29 students, and 19 of the 48 show no practica within 24h

MARS-789 mars Backlog low

applog digest re-delivers event ids the real-time and suppressed paths already sent

MARS-786 mars Backlog low

Remaining agent ops on the internal support surface: roles/user/flags/jtp-reassign + access-request trio (blocked on Elazar)

MARS-777 mars Blocked low

Record INTERNAL_EMAIL_KEY in unverifiable-state; close SUPPORT_API_KEY value question

MARS-774 mars Done low

Move root CLAUDE.md content into per-lane seat files (Elazar 3b)

MARS-773 mars Done low

Mars DB hygiene (no IO risk, found in 06-15 Disk-IO self-check): (1) VACUUM ANALYZE teacherComisionMemberships (65d stale, 19.7% dead); (2) lower autovacuum_vacuum_scale_factor on notifications (high churn); (3) drop unused idx_st_createdbyuserid on supportTickets (0 scans, 13 rows); (4) index users.comisionId when query plans warrant. All reversible, audit pre-apply DDL review.

MARS-131 mars Done low

Index cold FK columns deferred from advisor sweep

MARS-67 mars Done low

Staff ticket-notification email has no outbox retry (immediate:true bypass)

MARS-757 mars Backlog low

Retire or explicitly preserve uninvoked legacy mars/db/backup-db.sh

MARS-741 mars Canceled low

Rotate Mars Supabase DB (postgres) password — leaked in git history

MARS-135 mars Blocked low

Retro independent review of MARS-562 / SHA 872495a (migration 091...)

MARS-563 mars Backlog low

Notifications never clear on resolution: 93% of unread access-request pings and 78% of unread practicaToReview pings point at already-decided work

MARS-726 mars Backlog low

Weekly ux-pain digest delivery: move to Vercel-cron→authenticated-POST-to-hub→PM-drains-on-reconnect (remove relay-row/always-on-agent dependency). Blocked on llmmsg-maintainer answers: (1) can Vercel POST to hub from outside the reverse tunnel with an auth key, (2) unread-buffer retention/TTL must exceed weekly digest interval so an offline PM still receives it. Applies to mars (replace MARS-84 relay-row) + venus + pluto toast-ports. db agents are NOT 24/7 so a db-host cron is not viable; only nw agents + maybe PMs run 24/7.

MARS-102 mars Todo low

login-email-drift-blocked: consider auto-sync email when supabaseAuthId sub already matches

MARS-602 mars Backlog low

Standing audit: nextjs/nodejs → Postgres pushdown — find Node-side aggregations/filters that should be DB views/functions, refactor opportunistically

MARS-247 mars Backlog low

vUsuariosDirectory: lateral aggregates compute for all 758 users before LIMIT

MARS-681 mars Backlog low

Load-failed class: capture visibilityState + nav-in-flight at throw time

MARS-640 mars Backlog low

Apply MARS-507 #2 decorate pattern to mi-cursada/[id]/editar form

MARS-510 mars Backlog low

MARS-419: browser-mode integration test for native-validation coalescing

MARS-421 mars Backlog low

gitpush-pre lint: block value exports in use-server modules (PLUTO-491/492 class)

MARS-397 mars Backlog low

Consolidate vFrictionEvents 6-way view duplication onto canonical wrapper pattern

MARS-489 mars Backlog low

ALTER DEFAULT PRIVILEGES: decide whether to narrow the agent roles too, after the MARS-707 fence has proven itself on mars_app_runtime

MARS-708 mars Backlog low

Tech-debt sweep: catalog unused DB objects (tables/columns/views, e.g. 0-row #395/#396, redundant text cols #394) + dead app-code fields/exports; file one deletion WI per finding (Elazar 06-05: stop brushing off 'legacy field we dont use')

MARS-13 mars Backlog low

└─ Delete unused DB views (technical debt audit)

MARS-14 mars Done

└─ Delete unused views: vComisionAyudantesByJtp, vPendingAccessRequests, vStudentPostgradoProgression

MARS-17 mars Done

└─ Delete unused health/admin views (vHealth*, vActiveSupportTickets, vAccountSwitchLinks, vHelpArticles)

MARS-16 mars Done

└─ Delete unused error logging views (vErrorsLast5/10/20/25, vAppErrors*, vRecurringErrors, vAppEventsRecent)

MARS-15 mars Done

PARKED until measured: consolidate serial write paths into set-based SQL (practica create/edit, perfil, memberships)

MARS-690 mars Backlog low

vPracticaHistorial repeats lookupOptions Seq Scans across its 4 archive branches

MARS-674 mars Backlog low

usuarios: replace per-user correlated roles/comisiones subplans with set-based CTEs

MARS-555 mars Backlog low

Verify toast/backend-diagnostic dedup pairing on Mars

MARS-464 mars Backlog low

Pruning strategy for append-only growing tables: appEvents (2334 rows), notifications (5202 rows), imageUploadAnalysisEvents (4327 rows) — no TTL/rotation defined; design retention policy + purge job

MARS-294 mars Backlog low

db-mars-cc: correct setArchiveContext GUC key for manual psql writes (app.user_id, not app.archive_actor_id)

MARS-603 mars Done low

Transient fetch failure on practica /editar has no retry or draft; user remedy is delete

MARS-730 mars Backlog low

Enforce that LADDER_EPOCH in profile-photo-nag.ts equals the epoch literal in the migration that defines get_layout_state

MARS-722 mars Done low

get_layout_state carries four EXCEPTION WHEN OTHERS handlers on its nag arm - a privilege or schema error is byte-identical to a user with no exemption and no pending photo request

MARS-715 mars Done low

practicaDailySeq gap-fill needs partial unique index first: uq_practicas_student_date_seq is non-partial, so a soft-deleted práctica keeps its (studentUserId,date,seq) slot. Adding deletedAt IS NULL to the seq-counter MAX (MARS-203 item-1) would let re-mint reuse a taken slot → unique_violation 500. Audit BLOCKED + reverted item-1 (guard comment left documenting the trap). REAL fix (2 steps): (1) db migration — make uq_practicas_student_date_seq PARTIAL (WHERE deletedAt IS NULL), audit pre-apply review; (2) THEN coder re-adds the deletedAt filter to the seq counter so gap-fill is safe. Benign/cosmetic today (folio gap after same-day delete-recreate), low urgency. Same partial-index class as MARS-181.

MARS-206 mars Done low

404 digest count inflation: error-digest reports 11 /mi-cursada 404s but appEvents shows only 2 — reconcile digest aggregation vs raw appEvents rows (possible double-count, window mismatch, or path-glob over-match). Source: audit /mi-cursada triage, de2e960 window. mem: appevents double-render dedupe (not-found-log.ts isDuplicateRender) is one suspect.

MARS-164 mars Backlog low

Re-run pg_stat_statements after a full business day of real traffic - the 2026-09-10 sample is unusable

MARS-702 mars Done low

Retune the connection-acquisition breaker threshold - 5-in-30s was structurally unreachable

MARS-704 mars Done low

Graceful handling of stale server-action-ID (deploy-skew) in global error boundary

MARS-53 mars Done low

Build re-runnable orphan-image reference counter before any sweeper (api-images)

MARS-697 mars Backlog low

Dedupe double-fired rectificar-reminder toast on /mi-cursada

MARS-511 mars Done low

Disambiguate 'rectificar:pending' vs 'rectificar-nudge' feedbackKeys (observability trap)

MARS-641 mars Done low

Widen or stop truncating toast feedbackKey so distinct validation messages don't collide

MARS-629 mars Done low

estadisticas: dead outlier-detection rule, never fires (since MARS-193)

MARS-639 mars Backlog low

Migrate call-sites to canonical view names + drop old-named views (vPendingAccessRequests/vAccessRequestsPending, vFrictionEvents1w)

MARS-457 mars Done low

Dead component image-upload-area.tsx + stale provenance comment referencing it

MARS-649 mars Done low

use-action-form + action-form-core are dead code on Mars (zero call sites)

MARS-671 mars Done low

Connection churn: CPU framing disproven, latency question open (get_auth 3.6ms mean / 24ms stddev)

MARS-661 mars Canceled low

image proxy: retry once on upstream connect timeout (UND_ERR_CONNECT_TIMEOUT)

MARS-669 mars Done low

support-action API: address tickets by their human ref (SOP-MARS-N), not only by UUID

MARS-668 mars Done low

Memoize getUserProgramas + collapse per-request lookup fetches (CPU/round-trips)

MARS-658 mars Done low

MSG-309 PM-on-demand: mars-commons.md routing edits

MARS-659 mars Done low

Archive-reason prefix vocabulary is unenforced at the DB: 127 out-of-policy values, incl. 2 written by a migration on 2026-08-15

MARS-653 mars Done low

Fix edit-rejected/toast double-count in friction views

MARS-465 mars Done low

claude-in-chrome on /administrar/alumnos

MARS-218 mars Done low

Drop comisionCode from vTeacherComisiones

MARS-207 mars Done low

Conform Mars error-alerting to fleet standard v1.3 §7 (known-benign suppress)

MARS-173 mars Done low

Friendly retry copy for dropped mobile navigation fetches

MARS-652 mars Done low

Add vUsersFull view

MARS-651 mars Done low

MARS-69 friction digest: id-bearing routes never clear minimum-volume floor

MARS-626 mars Done low

sessionOnce dedup missing on 2 nudge sites (edit-form.tsx:1020, review-form.tsx:305) - remount re-logs same friction key

MARS-625 mars Done low

Disposition 13 unproven ayudante-slot holds (SOP-MARS-41 follow-up)

MARS-622 mars Done low

Reclassify rectificar:pending nudge-shown (mi-cursada/page.tsx) warn->info, MARS-611 gap

MARS-624 mars Done low

WI#431 follow-up: cron digest route.ts:57 JOIN on lookupOptions missing AND lo."deletedAt" IS NULL per §Soft-Delete spec (audit flagged in -36761, non-blocking, 1-line fix)

MARS-313 mars Done low

Sweep for other per-request/standing-condition alerts that should use logEventOnce

MARS-618 mars Backlog low

Restore column sorting on /administrar/usuarios (server-side, post-MARS-615)

MARS-616 mars Backlog low

Make role->capability map DB-owned, or add a cross-layer drift guard (CAPS vs fn_admin_invariant_ok)

MARS-605 mars Backlog low

users email-guard hygiene: normalizedEmail (app normalizeEmail) vs uq_users_email_ci (SQL canonicalizeEmail) disagree on 3 live rows; + duplicate index users_normalizedemail_unique == uq_users_normalizedEmail

MARS-566 mars Backlog low

9 archive tables have zero retention/prune — unbounded growth, fleet-wide pattern (also on venus)

MARS-598 mars Backlog low

edit-form.tsx missing isViewAs dep (view-as correctness) + weekly-kpi.ts unused eslint-disable

MARS-595 mars Backlog low

Disposition MARS-373 archive-context WARN on 2 immutable applied migrations

MARS-594 mars Backlog low

users.displayName NOT NULL DEFAULT '' allows silent empty-name insert (siblings CHECK-reject)

MARS-591 mars Backlog low

Split action='404' into 404 vs 404-advertised-asset for digest resolvability

MARS-589 mars Done low

/api/log-error attributes appEvents to a session with no genuine-Google gate

MARS-572 mars Done low

/api/log-error accepts ungated session, attacker-controlled attribution in appEvents

MARS-571 mars Done low

EPIC: migrate Mars to enamel's shared user DB + one-email-per-user (Elazar fleet directive 2026-07-26)

MARS-564 mars Done low

image-proxy: one-round-trip PG image classifier primitive (replace 2 sequential queries)

MARS-559 mars Done low

usuarios directory: align tier comment with emitted columns, consider programa/período columns

MARS-557 mars Backlog low

Link legacy routes (/alumnos, /docentes, /administrar/usuarios) into the new unified /usuarios directory + eventual consolidation decision

MARS-554 mars Backlog low

Staff hitting reporter /soporte/[id] for a non-owned existing ticket should redirect to /administrar/soporte/[id], not 404

MARS-551 mars Backlog low

vGraderMonthlyTrend grading time-trend read view (mig 081, retroactive record)

MARS-549 mars Done low

userNotificationPrefs missing all timestamps: add createdAt + updatedAt (sweep-found hygiene)

MARS-545 mars Done low

Broaden skew auto-reload classifier to chunk-load TypeErrors (Load failed / Failed to fetch / ChunkLoadError / dynamic-import errors) so stale-chunk refs self-recover via one-shot cache-bust — gated on recurrence; error-report-block.tsx isVersionSkew currently matches only the exact RSC stale-bundle string. Low risk (bounded by sessionStorage one-reload-per-session + __rscRetry guard). Do NOT ship for a single transient; revisit if Load-failed/chunk-load warns recur with volume.

MARS-123 mars Done low

Migrate Mars lookup-key columns from uuid-FK to value-code-text per §Lookup-Backed (deferred strict-compliance from MARS-544 exception)

MARS-546 mars Backlog low

resume-link.ts empty-env robustness: align ??->|| so empty-string NEXT_PUBLIC_APP_URL falls to prod host, not a hard URL() crash

MARS-543 mars Backlog low

export-db.py never renders indexes into schema.md (dead query_indexes assignment) — schema.md has understated indexes since always

MARS-540 mars Done low

solicitar-acceso/actions.ts:84 CREATE path stores normalizeEmail(rawEmail) into BOTH email + normalizedEmail columns — email col gets normalized value (should be raw); sibling of MARS-536

MARS-541 mars Done low

completar/actions.ts:259 writes accessRequests.normalizedEmail = RAW email instead of normalizeEmail(email) — column misleading; surfaced during MARS-532 drift investigation

MARS-536 mars Done low

MARS-526 fast-follow: focused action tests for updateAlumno hardening — null-JTP orphan (vs MARS-29), stale-updatedAt lost-update rejection, closed-periodo/period-scope guard. Audit noted as coverage gap, non-blocking.

MARS-535 mars Backlog low

EVO-75 mars leg: admin pending-items digest — open support tickets + access requests + correcciones to admins (Elazar)

MARS-533 mars Backlog low

Warn-tier friction (nudge-shown) real-time-pages PM — should be digest-only per friction-vs-error standard

MARS-529 mars Backlog low

EVO-70 tail: retire redundant after() email-outbox enqueue now that T1 trigger-wake is live

MARS-528 mars Backlog low

Calificación backfill — teacher-tendency model (deferred, data-gated)

MARS-504 mars Done low

└─ Grader x verdictBucket grade-tendency views to drive MARS-504 backfill coverage trigger

MARS-530 mars Done

Nueva-práctica form: noValidate + drop reportedPracticeDate required + numeric conducto-field app checks

MARS-509 mars Done low

Function default-ACL exposure - pg_default_acl grants anon/authenticated EXECUTE on future public functions

MARS-486 mars Done low

CR-8 informes/calificaciones

MARS-215 mars Done low

Dual-column status antipattern: accessRequests (status text + statusOptionId) and notifications (type text + notificationTypeOptionId) are synced by triggers — assess dropping redundant text columns in favour of UUID FK only

MARS-298 mars Done low

supportTickets.statusOptionId is uuid-keyed, not value-code (fleet standard gap)

MARS-487 mars Backlog low

Archive/other sequences expose anon/authenticated rwU via Supabase default privileges

MARS-485 mars Done low

Remove vestigial surrogate/account-switcher scaffolding: activeSurrogateId cookie was scaffolded but NEVER set in git history (dead switcher UI); getSession still carries realUserId/isSurrogate/surrogates/canSwitchAccounts + SURROGATE_COOKIE-delete leftovers. NOTE users.surrogateOfUserId is a LIVE column (~19 files + surrogate emails) — that DATA model is real and must stay; only the dead cookie/switcher-UI scaffolding is removable. Split out of MARS-352 view-as (which uses a new viewAsUserId cookie, never touches surrogate rows). Low priority cleanup, reversible.

MARS-353 mars Done low

Animated/moving notification badge: make the notification bell badge pulse/animate to draw attention to unread notifications

MARS-31 mars Done low

Fix: appEvents(actorUserId,createdAt) composite index — correlated MAX(createdAt) subquery regression in teacher-report query

MARS-463 mars Done low

EXPLAIN ANALYZE teeth_agg practica report query (1661ms mean, /informes teeth aggregation)

MARS-132 mars Done low

NEXT_REDIRECT false-positive error-tier alert — filter Next internal control-flow signals at client sink

MARS-445 mars Done low

vOpenSupportTickets view

MARS-438 mars Done low