Lezama telemetry repoint: DSN still targets dead whey-tunnel 172.30.0.1; decide venus-PG repoint vs retire. Step 1 (nw-lezama): test TCP 91.99.136.171:5432 from lezama (GCABA egress 80/443-only suspected). Open->repoint DSN + nw-venus pg_hba grant for lezama egress (IP rotates - needs range or hostssl). Blocked->Elazar governance call (retire lezama telemetry writes vs spool-sync) per Lezama-RESTRICTED policy. Interim: JSONL spool = no data loss; nw-lezama stops sys-check.timer if erroring hard. Also: whey pg_hba:136 dead 172.30.0.2/32 telemetry_rw line - nw-whey pulls it whichever branch wins.

ONEDB-15 one-db Done high

one-db: 5 telemetry sqlite -> Postgres17 consolidation (umbrella)

ONEDB-1 one-db Backlog high

└─ DECISION (Elazar): make ~/Documents/terminal/one-db its own git repo? bin (PM) owns the call

ONEDB-7 one-db Backlog high

└─ No dual-write: cutover = flip reporter (netreport.sh) to pg + drop sqlite writes after parity. Per Elazar 2026-06-06.

ONEDB-2 one-db Done high

└─ GATE#1 step i: add reporter-set pg views to schema.sql (network v_history/v_report/v_by_wifi; kpi 3-day window) — distinct from coder's dashboard views; back the 5 sqlite readers

ONEDB-8 one-db Backlog high

└─ GATE#1 step ii: repoint 5 sqlite readers to pg telemetry_ro — netreport.sh, testnetwork --report, ccusage-daily-kpi.sh, llmmsg-kpi-report.sh, memory-lint.sh

ONEDB-9 one-db Backlog high

└─ GATE#1 step v: remote-monitor ingestion — venus/lezama write whey-pg DIRECTLY per-host (NO ssh-pull). Transport: venus=ZeroTier 172.27.178.27 or Tailscale; lezama=ssh -w L3 tunnel only (GCABA blocks ZT+TS), pg client→172.30.0.1. whey: listen_addresses + pg_hba for both + telemetry_rw role. nw co-owns

ONEDB-12 one-db Backlog high

└─ GATE#1 step iii: flip venus-kpi-collect.sh to pg-write (telemetry_rw via metrics_write) — kills kpi.sqlite split-brain co-writer; nw lane (cross-host)

ONEDB-10 one-db Blocked high

└─ GATE#1 step iv: drop sqlite writes in 6 collectors after readers repointed+proven — pg-primary, JSONL-spool = resilience cache (Elazar: NO sqlite write-ahead). cc-context-monitor keeps LOCAL rolling cache for its own over-cap loop + pg mirror

ONEDB-11 one-db Done high

└─ SELECT * views: one wide view per table (+rollups) so agents never guess columns - default SELECT *, not named fields.

ONEDB-4 one-db Done

└─ kpi.pensanta.com dashboard on whey (chat-duo-web model): single-file Node .mjs reads telemetry views -> static KPI pages.

ONEDB-5 one-db Todo

└─ DECISION (Elazar): kpi.pensanta.com exposure - Tailscale-only (team rec: bind whey tailnet IP, no TLS/cert ops, no public attack surface) vs public-TLS

ONEDB-6 one-db Backlog high

└─ kpi-web MANIFEST: add Track A views (usage.v_kpi_tokens_7d + context.v_kpi_compact_7d) to server.mjs allowlist + restart

ONEDB-14 one-db Done

└─ Telemetry collector registry: lazy-load .md - per source list systemd unit/timer -> collector script -> what data -> which reporter DMs Elazar+aro.

ONEDB-3 one-db Done

Lezama context/token telemetry -> venus canonical store

ONEDB-16 one-db Backlog

cc-context-monitor v3.0 M1 sys.exit(1) aborts MANUAL venus/lezama runs before pg-mirror write when CCM_HUB_URL=127.0.0.1 default. Unattended unaffected (service unit exports LLMMSG_HUB_URL ZT/tunnel). Fix post-ONEDB-12: document manual-run env requirement (export LLMMSG_HUB_URL) over per-host CCM_HUB_URL remap. Bump VERSION.

ONEDB-13 one-db Backlog low