support-admin: no way to close an access request that duplicates an account the person already uses - access-reject emails a false denial

MARS-776 mars Blocked high

/practicas list query hit the 10s statement_timeout twice for a real user: CTEs aggregate all practicas' teeth and images per call

MARS-736 mars Blocked high

Safeguard forced práctica unlock with student save grace period and teacher confirmation

MARS-738 mars Blocked high

EVO-12 mars leg: server-side 404/error capture replacing the client-only rail (filed because the leg lived only in an event body for 82 days)

MARS-724 mars Blocked high ↳ EVO-12

SOP support-api: stakeholder-pair-only private comments (CRUD + notify shipped)

MARS-467 mars Blocked high ↳ EVO-52

Support API: restrict internal-note visibility to Elazar plus ticket stakeholder

MARS-732 mars Blocked high

Disk used-vs-provisioned alarm: unreachable from SQL, and autoscale reports configured while inert below LARGE compute

MARS-711 mars Blocked high

statement_timeout errors spreading beyond MARS-736 scope: /practicas/[id] POST actions, /comisiones/[id], /alumnos

MARS-743 mars Blocked high

pg_net EXECUTE to PUBLIC: measure whether this ref grants net.http_post to every login role

MARS-712 mars Blocked high

Supabase saturation: instance-wide execution stalls (Oct-5 class) + PostgREST retry loop + Nano tier - root cause and fix plan (planning cost UNMEASURED: track_planning off)

MARS-769 mars Blocked high

Monitor WAL file count + archiver failures - 34h of failed archiving went completely unseen

MARS-703 mars Blocked high

resolutionNote goes to the reporter verbatim as the email body, with nothing warning the author or screening internals

MARS-779 mars Blocked

administrar-actions.ts: "use server" file exports roster getters with no in-function gate (getDocenteMemberships, getAlumnoAssignments, getAlumnoAssignmentsForPeriodos, getComisionesWithCounts, getPeriodoDetail...)

MARS-748 mars Blocked

Endodoncia I comision LETTER CONFLICT (SOP-MARS-58): Mars follows the client 209-x-es-y mapping 6/6 and the catedra attendance sheet uses the other letter - client decision, not a data repair

MARS-728 mars Blocked

Review-depth pilot close: reconciliation is unverifiable by construction - Elazar decides keep classifier / drop pilot

MARS-705 mars Blocked

Nota/concepto-final grading column — spec needed from Elazar before build

MARS-444 mars Blocked

Queryable not-xray image view: count + % of uploaded práctica images flagged as NOT a real radiografía. Elazar 2026-06-26: he has not seen one real x-ray — ~99% are photos of a monitor screen, not actual radiographs. The image-analysis path already produces a flag (a 3-letter code/word per Elazar) that marks an image as not-an-xray. Build a DB view (db + coder) over the existing image-analysis data (likely imageUploadAnalysisEvents) that reports total images vs flagged-not-xray count and percentage, queryable any time (overall + optionally by periodo/comisión/recent-window). FIRST identify the actual flag field + its not-xray value. Read/analysis surface only, no enforcement/blocking. Build deferred — tracking only.

MARS-200 mars Blocked

Mars appEvents conform to fleet standard (evolutiva-appevents-standard.md): add categoryId uuid FK->lookupOptions + seed appEventCategory group (16 canonical + practica/studentAssignment/assignment) + backfill 18 free-text values w/ mapping; add 4 promoted cols (httpStatus/durationMs/path/failureCode); add logError/logWarn/logInfo wrappers + pickKnown + isCritical sync-bypass; append-only trigger (GUC-bypass) AFTER appEventRelays sidecar cutover (replace detail.relay.delivered UPDATE pattern); replace level-only prune with 5-cat-security tiered retention; canonical v_appEvents_* views; legacy_events sink. Staged db+coder. BLOCKED on committed SSOT + Elazar priority call.

MARS-107 mars Blocked

Two Mars access requests pending 4-5 days, triaged and approvable - need an admin in the UI (approveRequest is session-bound)

MARS-746 mars Blocked

mars appEvents stores a raw client ip on exactly one rail - the 404 capture - and nowhere else: 19 of 14276 rows in 30d

MARS-796 mars Blocked

EVO-58 admin storage tile (Hostinger 25GB) — /administrar ambient panel

MARS-513 mars Blocked

EVO-57 Mars: audit-trail schema normalization plan (coverage + naming)

MARS-492 mars Blocked ↳ EVO-57

Audit PTD render-GET tooling: enable exercising authed routes (dedicated test-user + stored session, OR a server-side render-self-check route) — Mars leg of the cross-project gap that let Pluto's /informes 500 ship unexercised (audit unauth render-GET -> 302/login, authed routes never actually rendered in PTD)

MARS-118 mars Blocked

SCANNER_PROBE_RE gap: vendor appliance path /access/api/v1/system/ping pages on mars and pluto, 3 hits from 3 IPs

MARS-790 mars Blocked low

bedel can write: updateImageRotation reachable by any read-only-all bedel via canViewPractica

MARS-747 mars Blocked low

Review-depth pilot: measure audit token burn and shallow-sample quality

MARS-802 mars Blocked low

No surface can add conductos to an existing practica, so a tipo change into endo costs the student their practica

MARS-785 mars Blocked low

Remaining agent ops on the internal support surface: roles/user/flags/jtp-reassign + access-request trio (blocked on Elazar)

MARS-777 mars Blocked low

Rotate Mars Supabase DB (postgres) password — leaked in git history

MARS-135 mars Blocked low