Lezama telemetry repoint: DSN still targets dead whey-tunnel 172.30.0.1; decide venus-PG repoint vs retire. Step 1 (nw-lezama): test TCP 91.99.136.171:5432 from lezama (GCABA egress 80/443-only suspected). Open->repoint DSN + nw-venus pg_hba grant for lezama egress (IP rotates - needs range or hostssl). Blocked->Elazar governance call (retire lezama telemetry writes vs spool-sync) per Lezama-RESTRICTED policy. Interim: JSONL spool = no data loss; nw-lezama stops sys-check.timer if erroring hard. Also: whey pg_hba:136 dead 172.30.0.2/32 telemetry_rw line - nw-whey pulls it whichever branch wins.

ONEDB-15 one-db Done high

No dual-write: cutover = flip reporter (netreport.sh) to pg + drop sqlite writes after parity. Per Elazar 2026-06-06.

ONEDB-2 one-db Done high ↳ ONEDB-1

└─ GATE#1 step iv: drop sqlite writes in 6 collectors after readers repointed+proven — pg-primary, JSONL-spool = resilience cache (Elazar: NO sqlite write-ahead). cc-context-monitor keeps LOCAL rolling cache for its own over-cap loop + pg mirror

ONEDB-11 one-db Done high

SELECT * views: one wide view per table (+rollups) so agents never guess columns - default SELECT *, not named fields.

ONEDB-4 one-db Done ↳ ONEDB-1

Telemetry collector registry: lazy-load .md - per source list systemd unit/timer -> collector script -> what data -> which reporter DMs Elazar+aro.

ONEDB-3 one-db Done ↳ ONEDB-1

kpi-web MANIFEST: add Track A views (usage.v_kpi_tokens_7d + context.v_kpi_compact_7d) to server.mjs allowlist + restart

ONEDB-14 one-db Done ↳ ONEDB-5