URGENT: fix quoted search_path in mig 099/102 -- 33 functions broken, prod outage since 13:03 UTC

PLUTO-673 pluto Done urgent

fn_getInformesBundle: include 0-practica JTPs (Opt A) across jtpStats + comparativaJtp + jtpBenchmark

PLUTO-144 pluto Done urgent

URGENTE 2h: post-login redirect a form de auto-asignación para alumnos sin comisión/JTP — auto-aprueba selección

PLUTO-346 pluto Done urgent

SECURITY: rotate pm_triage_reader DB password (committed literal in git history, PLUTO-191 GRANT migration)

PLUTO-194 pluto Done urgent

Access regression: students who previously logged in are now blocked (agujero negro / blocked-user landing) - PROD, real users

PLUTO-69 pluto Done urgent

URGENTE 2h: email a alumnos huérfanos con link a /completar-asignacion

PLUTO-347 pluto Canceled urgent

URGENTE 4h: /solicitar-acceso para estudiantes incluye pulldown comisión + JTP + datos esenciales

PLUTO-348 pluto Done urgent

URGENTE 4h: comisión + JTP REQUIRED en /solicitar-acceso (rama estudiante) — submit bloqueado si faltan

PLUTO-349 pluto Done urgent

Live 500 on /informes — fn_getInformesBundle returns porAnestesia (and likely sibling array keys) undefined for sparse/zero-row scope; client .map crashes. PLUTO-97 regression. Fix fn to COALESCE every array key to [] + client null-guard. PTD must GET /informes for the failing scope, not log-tail.

PLUTO-112 pluto Done urgent

Grading authz audit: práctica-grade permission scope vs Puia rule (comisión-wide adjunto/jtp/ayudante + titular-all)

PLUTO-141 pluto Done urgent

pg_net EXECUTE to PUBLIC: measure whether this ref grants net.http_post to every login role

PLUTO-736 pluto Blocked high

PLUTO-782 app refusal for deleted roleless student target

PLUTO-784 pluto Done high

Deleted users retain active-role grants in view and teacher validator

PLUTO-782 pluto Done high

Non-owner app role for archive/fraud/audit table write containment (real remedy, migration 100 is hygiene-only)

PLUTO-670 pluto Backlog high

Treat 404 as error: emit level=error on 404 + email+DM + feed auto-fix protocol (Elazar 404-directive, kpi-n-optimization)

PLUTO-158 pluto Done high

Mobile-first refactor (Elazar all-app directive): audit + base-up redesign of layouts/nav/forms/touch-targets/breakpoints

PLUTO-40 pluto Done high

serverError + systemBannerQueryFailed bursts on 09-17 and 09-18 have no work item - PLUTO-742 covers only the 09-11/12 window

PLUTO-745 pluto Done high

Retroactive audit-PASS verification: 21 Class-A commits with uncited self-noted verdicts

PLUTO-646 pluto Done high

an operator alert was LOST on 09-17: operatorAlertTimeoutFallback enqueue_failed, and the firing count is not on PLUTO-688/743

PLUTO-746 pluto Done high

statement_timeout proconfig on bundle fns never fires; enforce via SET LOCAL

PLUTO-747 pluto Done high

PostgREST empty-schema crash loop: apply the 3-statement fix, record before/after cycle count

PLUTO-754 pluto Done high

Extend /api/internal/support-action: access/participant/user/assignment ops (Elazar GO 2026-09-22)

PLUTO-753 pluto Blocked high

Operator-alert attempt ceiling (3.5s) sits below the SMTP transport's own connect timeout (10s) — races away connections that would have succeeded

PLUTO-688 pluto Done high

└─ PLUTO-688 fallback telemetry: detail.serverErrorEventId is null exactly when the fallback fires, because it comes from the appEvents write that the outage broke

PLUTO-743 pluto Done

Supabase instance-level slowness 2026-09-11 22:34Z - 2026-09-12 01:54Z (3h20m continuous): 42 slow queries incl. 'SELECT now()' at 35s, AT LEAST 4 user-facing 500s on /mi-cursada (3 logged + 1 whose own serverError INSERT left no row), one operator alert LOST

PLUTO-742 pluto Blocked high

Unpinned authz-scope functions need explicit search_path design (pg_temp fleet finding)

PLUTO-666 pluto Done high

lastPractica/inactiveStudents: persisted-attribution scope-gate

PLUTO-575 pluto Done high

fn_getInformesBundle: studentRanking + opAsistBalance apply LIMIT 200 BEFORE ORDER BY - /informes shows an arbitrary 200 sorted, not the top 200

PLUTO-717 pluto Done high

Support-ticket API parity - create/triage/status ops + list read, no UI-only actions

PLUTO-700 pluto Done high

Supabase Disk IO Budget depleting on evolutiva-pluto - triage IO consumers before considering a compute upgrade

PLUTO-708 pluto Done high

Disable Supabase Email provider (external_email_enabled:false) + committed authconfig.json + diff-on-push assertion

PLUTO-630 pluto Done high

auth/callback email-auto-link-at-login policy (per Elazar login-link re-decision)

PLUTO-621 pluto Done high ↳ EVO-79

/informes '#51 Realizada por docente' card is a dead metric — always 0/0% (queries dificultadPercibida for a label that can't exist)

PLUTO-513 pluto Done high

CR 33: 10 items de Diagnóstico clínico radiográfico (obligatorios): 1) Enfermedad periodontal avanzada; 2) Fractura dentaria vertical/horizontal; 3

PLUTO-259 pluto Done high

P0: fn_insertSupportTicket ambiguous id column broke all support-ticket creation

PLUTO-677 pluto Done high

isUuid rejects legacy deterministic seed UUIDs (non-RFC version/variant nibbles), false-404s comisión/other routes

PLUTO-578 pluto Done high

6 userRoles call sites bypass soft-delete check -- role grant/revive + last-admin-guard defeat on deleted users

PLUTO-640 pluto Done high

userRoles last-admin trigger missing ENABLE ALWAYS (replica-mode bypass, same class as mig 101)

PLUTO-671 pluto Done high

getStudentsWithoutAssignment missing ur.deletedAt IS NULL -- 6 of 7 rows on the live student-assignment picker are reclassified docentes/admins, not students

PLUTO-667 pluto Done high

Land PLUTO-641 orphaned app-side refactor (admin fn_* calls)

PLUTO-665 pluto Done high

EVO-86: pluto applog rail — real error pages self-addressed to scrp-applog-pluto, never reached pm-pluto-cc

PLUTO-652 pluto Done high

auth/callback 42P08: raw bind-placeholder in accessRequestMatchExpr blocks real logins

PLUTO-647 pluto Done high

support-actions.ts stamps persona id instead of realUserId in actor/archive/log fields

PLUTO-645 pluto Done high

support-actions.ts stamps persona id instead of realUserId in actor/archive/log fields

PLUTO-644 pluto Canceled high

Land or discard dangling postgres-boundary WIP (migrations 089-094)

PLUTO-641 pluto Done high

Postgres-boundary WIP: tree calls 4 DB functions that do not exist live; migrations 089-094 unapplied

PLUTO-642 pluto Canceled high

getAcademicDropdownData anonymous-callable, same roster-PII leak class as PLUTO-635

PLUTO-638 pluto Done high

Retire fn_lifecycleInactivity date-auto-disable path + clear inactivity flags (live-incident remediation)

PLUTO-627 pluto Done high

└─ Remove inactivity-lifecycle source refs (auth/callback reset + poll-security-alerts user email routing) — PLUTO-627 code tail

PLUTO-628 pluto Done high

└─ Drop 3 orphaned inactivity lifecycle columns from users

PLUTO-629 pluto Done

Eradicate demo-data concept residue to zero (bs-mrteu5nvtt6)

PLUTO-624 pluto Done high

Access-request dedup PREVENTION: attach Google identity to pre-created account on confident match

PLUTO-617 pluto Done high ↳ EVO-79

EVO-71 pluto leg: supautils PUBLIC-EXECUTE sweep + object-class probe + fn-migration REVOKE policy

PLUTO-614 pluto Done high ↳ EVO-71

Explicit Google identity check in auth/callback (EVO-68 tail)

PLUTO-610 pluto Done high ↳ EVO-68

Replace email-domain login gate with genuine-Google-identity gate

PLUTO-609 pluto Done high ↳ EVO-68

Fix /perfil upload double-submit (button not disabled during await)

PLUTO-599 pluto Done high

Fix ERR_DLOPEN_FAILED sharp crash on POST /perfil

PLUTO-596 pluto Done high

getStudentsForTeacher/getStudentsForTeacherPage: fact aggregates computed before roster scope

PLUTO-576 pluto Done high

Adopt fleet no-silent-failure lint (scripts/lint-no-silent-failure.mjs) — net-new for Pluto, not a re-vendor

PLUTO-570 pluto Done high

Sharp native module (libvips) fails to load on Vercel linux-x64 at /perfil — ERR_DLOPEN_FAILED, breaks image optimization/serving

PLUTO-569 pluto Done high

Approving docente_ayudante_primera access requests never inserts jtpAyudantes row

PLUTO-566 pluto Done high

SOP support-api: add ticket CRUD (close/status/notify) + private stakeholder comments

PLUTO-563 pluto Done high ↳ EVO-52

Extend support-api to full ticket CRUD (status, private comments, notify-list) - EVO-52

PLUTO-564 pluto Canceled high

Support ticket: /mi-cursada issue (registered user)

PLUTO-543 pluto Done high

Create vOpenSupportTickets view (fleet-wide open-ticket view standard)

PLUTO-542 pluto Done high

No-silent-failure contract: audit + enforce try/catch→appEvents+friendly toast, required-field validation toasts, swallowed-catch elimination, error→live-PM DM

PLUTO-529 pluto Done high

Pluto IDOR: createNotification + markComentarioNotificationsRead unauthenticated, client-forgeable userId

PLUTO-530 pluto Done high

Operador may create práctica with 'Sin asistente' (null asistente); null-safe all KPIs/queries/reports/filters

PLUTO-528 pluto Done high

Comisiones grid UX: row-click opens existing detail page + relocate rename + hide delete unless empty (A+B)

PLUTO-525 pluto Done high

No-roles real-time aro:pluto alert channel (part 3 of 518)

PLUTO-519 pluto Done high

Assign active docente_jtp role to elazar+jtp test persona

PLUTO-521 pluto Done high

No-roles login denial: instrument silent page.tsx path + raise ARO alert

PLUTO-518 pluto Done high

/informes 'En esta página' TOC card: rename to 'Secciones en esta página' + fix title/description run-together wrapping bug

PLUTO-512 pluto Done high

Entity cross-linking sweep: make named practica/comision/teacher/student references clickable, discoverable links

PLUTO-493 pluto Done high

Runtime ReferenceError: SupportActionResult is not defined at /practicas (system/serverError)

PLUTO-491 pluto Done high

Tidy sort core for portability + mark canonical SSOT (fleet sortable-table primitive)

PLUTO-484 pluto Done high

/informes fn_getInformesBundle 25s exec + pg-pool connection exhaustion (469 perf regression)

PLUTO-471 pluto Done high

Server-error email from instrumentation.ts onRequestError never delivers (8x SMTP ETIMEDOUT since 2026-06-10; SMTP healthy, instrumentation-hook teardown timing)

PLUTO-161 pluto Done high

P-2: email-domain allowlist gate + deactivate 8 non-allowlist users (db-pluto-cc-30353/30429)

PLUTO-426 pluto Done high

Sidebar link directo a /admin/inactividad (Puia lo necesita visible, no enterrado en /admin dashboard)

PLUTO-355 pluto Done high

Asistente picker en /practicas/nueva no permite seleccionar — cliente reporta no poder cargar ayudantes/asistentes

PLUTO-222 pluto Done high

Speed Insights removal — drop @vercel/speed-insights import from src/app/layout.tsx + uninstall package (Pluto-driven 11K/10K event overage)

PLUTO-363 pluto Done high ↳ EVO-36

Backup pluto DB + delete practicas test data — testing phase ended, client wants test data wiped. Order: (1) pg_dump backup to /gdrive/backup/, (2) delete practicas test rows + dependent FKs, (3) report counts.

PLUTO-388 pluto Done high

P1: Vercel git integration silent — 22h+ backlog, no auto-deploy since b18312b (2026-05-15-0258)

PLUTO-411 pluto Done high

Approval flow crea alumnos huérfanos: approveAccessRequest no inserta studentAssignments — orphan estudiantes no pueden cargar prácticas porque getClassmates retorna vacío. Fix: requerir comisionId+jtpId al aprobar (mismo patrón que /admin/usuarios manual create) e insertar studentAssignment en la misma tx. Backfill: 10 alumnos sin asignación en periodo actual.

PLUTO-345 pluto Done high

getSolicitudAnalysisContext: identity-match false negative — claimed 'no users row' for solicitud aa4ff295 despite pre-existing user veronica1994rios@gmail.com

PLUTO-385 pluto Done high

P-3: assign 'bedelia' rol to lorena.salomone (asesora pedagógica per client; needs full-view + change comisión cap). per Elazar -31043

PLUTO-432 pluto Done high

Practicas list+detail page-ready views (P1 perf)

PLUTO-362 pluto Done high

P0 BUG: /practicas/<uuid> 500 crash on detail view — broken for all approvers. researcher report agents/researcher-pluto/reports/ux-audit-2026-05-16.md item 1.

PLUTO-416 pluto Done high

Auto-send welcome email on app-driven access grant/reactivation/login-email-change (no agent intervention)

PLUTO-203 pluto Done high

Real-time error tee: appEvents AFTER-INSERT pg_notify trigger on Pluto Supabase (error→PM DM, warn stays in digest). GATED on nw-venus's exact spec (channel name, WHEN-clause, payload — byte-identical channel+payload across 3 apps; host listener LISTENs + DMs PM). Pluto level vocab = error|warn|info (NO fatal) so WHEN-clause = level='error'. Pre-apply audit review per DDL discipline. Additive/reversible. Do NOT start until spec lands + 112 done.

PLUTO-116 pluto Backlog high

Archive-reason gap: require typed reason on silent human soft-deletes (periodo + comision soft-delete, access-request reject) via promptReason; no-double-ask (compliant paths untouched)

PLUTO-108 pluto Done high

R1 cross-audit app fixes: send-email err.message leak + UserFacingError class + perfil ImageApiError + completar-asignacion actor + bulk-ops batched UPDATE

PLUTO-106 pluto Done high

R1 cross-audit db fixes: appEvents retention auth/session >=365d floor + notifications prune cron (read >30d)

PLUTO-107 pluto Done high

Replace native window.prompt/confirm with app-styled promise-based dialog primitive (promptReason/confirmAction)

PLUTO-105 pluto Done high

Email subject format: BMF 1 / Pluto / <subject> — centralized prefix

PLUTO-104 pluto Done high

F-1 LIVE crash: clientError:global-error @ /mi-cursada (alumno landing), 4 hits 2026-06-12, no stack in appEvents. React global error boundary firing on student landing. Pull Vercel runtime logs for today's hits to get exception; fix root fetch/render.

PLUTO-74 pluto Done high

404 classifier mis-routes bot-probe paths (.env harvest) as [warn] operator DMs - should be security-log-only per Elazar 2026-06-20 rule

PLUTO-182 pluto Done high

F-6/voice-note: jefe-de-TP cross-linking via ayudante role drags wrong roster. Real teacher (Ale): sees his own ~8-10 alumnos OK, but ALSO sees ALL alumnos of ANOTHER jefa from a different group/day, because he is ayudante of that jefa on Wednesday -> the vinculation links him to the Wed jefa and surfaces her students in his correction view (~20+ total -> confusion). PROD real user. Same class as PLUTO-70 (resolveTeacherFilterIds dual-role); investigate the jtpAyudantes->jefa linking path - is this a PLUTO-70 gap (ayudante path uncovered) or new. He CAN evaluate his own; the bug is the extra roster bleed-in.

PLUTO-77 pluto Done high

F-2 LIVE crash: serverError+clientError @ /administrar/alumnos/[id] (digest 3278366549), 26 hits Jun 9-11. Server crash on GET student detail; paired 7 sendEmailFailed ETIMEDOUT are the alert-emails for this crash. Pull Vercel logs for digest, fix render/server-action.

PLUTO-75 pluto Done high

Two-layer concurrent-push guard — EVO-26 descend, decision bs-mqoxiw8ptby (2026-06-22), Pluto HIGHEST urgency. Adopt mars's proven guard. LAYER 1 (content): drop pluto/.gitpush-strict so gitpush refuses 'git add -A'; every push MUST pass --only <paths>. LAYER 2 (sequence): wrap every spawned-worker push in 'flock -w 600 ~/.cache/evolutiva/pluto-push.lock gitpush.sh --only <paths> msg' — serializes the non-atomic bump-stage-commit-rebase-push pipeline (stops dup version-bumps + rebase-onto-half-state; git index.lock does NOT cover these). WHY Pluto highest: widest push lane (coder+coderhelp+db all bump the SAME package.json) + LIVE clinical app so a sequence collision = botched deploy. PER-ROLE --only LANES: coder=feature paths; db=its 4 ratified exception paths (db/migrations/applied/*, db/schema.md, db/reference-data.sqlite, package.json). gitpush v4.0 auto-includes the bumped package.json alongside --only, so versioning still works. CUTOVER GOTCHA: the moment pluto/.gitpush-strict lands, EVERY push without --only ABORTS (fail-safe) so the marker + ALL push call-sites (coder/coderhelp/db) must cut over in ONE coordinated step. gitpush.sh stays bin-owned/UNCHANGED (guard = repo-marker + per-repo lockfile, zero fleet blast radius). flock must be BAKED INTO the spawn/push path so an ephemeral worker CANNOT omit it — coordinate wiring with nw/bin (own spawn scripts; pluto spawn = tmux-ccs.sh per EVO-26). Execute in aro:pluto. mars = reference impl (bwi#298 + .gitpush-strict). mem:evolutiva-fleet-aro-topology mem:pluto-ondemand-worker-model mem:shared-tree-push-hazard

PLUTO-192 pluto Done high

CR 64: Client issues 2026-04-20 (Gabriela Sánchez + M.M. Boussebayle): root cause común = primaryRoleId SSOT desalineado con userRoles. (A) Gabriel

PLUTO-290 pluto Done high

error-tier appEvents digest (mars MARS-81 port): daily error-digest email cron + internal relay-claim routes

PLUTO-71 pluto Done high

/administrar/alumnos/[id] throws 500 (Sin permisos) instead of graceful 403 for docente_titular w/ viewStudents but not manageUsers; list shows links into a detail page the user can't enter (list<->detail cap mismatch) — fix 500-handling + resolve cap shape

PLUTO-43 pluto Done high

Option A: drop domain gate at login callback + allow non-allowlisted domains on access-request/approval path (Elazar decision 2026-07-02)

PLUTO-465 pluto Done high

Pluto: audit email normalization for non-gmail dot-stripping bug (gmail dots-ignored rule is gmail/googlemail-only; Workspace custom domains treat dots as significant)

PLUTO-35 pluto Done high

Pluto P1: IDOR on /api/image/[id] — add access-scope check (patient photos fetchable by any authed user)

PLUTO-16 pluto Done high

Pluto P1: vActiveStudentAssignments + vActiveRoster missing isDemo=false (demo bleed into teacher views)

PLUTO-17 pluto Done high

CR 44: Renombrar anestesia: Troncular → Infiltrativa Troncular, Infiltrativa → Infiltrativa Terminal

PLUTO-270 pluto Done high

EVO-12 Pluto leg: server-side 404 capture + error-tier on own-route (closes Elazar wrong-URL silent test)

PLUTO-165 pluto Done high

LEG-1 harden onRequestError instant error-email: try/catch never-throw + in-memory 1/route/10min throttle; catch=log+bounded in-memory retry NOT enqueue (DB-down safe); recipient=work email env-driven not gmail

PLUTO-166 pluto Done high

/informes Anomalías detectadas: clickable Práctica ## + student name

PLUTO-474 pluto Done high

/practicas Resumen de Comisiones + per-comision cards: same KPI treatment as PLUTO-142

PLUTO-143 pluto Done high

/informes 'Practicas por JTP' KPI refinement + fix Comparativa por Adjunto

PLUTO-142 pluto Done high

Soporte parity P2: server actions postSupportReply(staff) + closeAndNotify — reuse P0/PLUTO-203 shared email leg (sendAdminEmail, verified soporte-evolutiva-pluto@ From, idempotency, rate-limit); KEEP manageSupport-EXCLUSIVE gate (no fullAccess/manageUsers/adminConsole escape). Audit design-ping on email+gate before impl.

PLUTO-218 pluto Done high

DB-health one-shot inspect sweep (Supabase inspect-db via MCP): outliers/cache-hit/unused-indexes/seq-scans/bloat/vacuum-stats/locks-blocking/long-running + get_advisors(performance). Triage real findings, keep/drop to PM. Fleet inspect-db monitoring rollout (bs-mqg1357zx6m). Caveat: pg_stat_statements recently reset (PLUTO-134), lookback thin.

PLUTO-138 pluto Done high

bug: pluto-lifecycle-inactivity cron FAILED nightly since 2026-06-09 — fn_lifecycleInactivity() UPDATEs users without SET LOCAL app.user_id GUC, so fn_archive_users() trigger rejects (line 21). 7+ days silent-dead, prod. Fix: set archive-context (app.user_id sentinel + app.archive_reason) in-txn before the users UPDATE per archive discipline; audit pre-apply review (fn + trigger-archived users table).

PLUTO-135 pluto Done high

Surface visible JTP filter on /alumnos (backend ?jtp= already wired; add the selector like /informes)

PLUTO-204 pluto Done high

alumno->docente conversion leaves dangling studentAssignment (Elazar greenlit fix-the-flow). When a user is converted alumno->docente (alumno role soft-deleted + docente role added), the conversion does NOT soft-delete the user's active studentAssignment (enrollment) — so they remain a 'current student' of a comisión while being a docente. Found via Mariano Trigo (c8fe9bcb): active F-Sábado studentAssignment persists post-conversion. FIX: (1) coder — conversion code path must ALSO soft-delete the studentAssignment (archive-context, studentAssignments is trigger-archived); (2) db — clean existing stale stubs (all users with active studentAssignment + active docente role + no active alumno role) with archive-context+reason. SCOPE FIRST (db read-only): conversion code path + count/list inconsistent-state users.

PLUTO-130 pluto Done high

PROD bug (Elazar blocked): no UI affordance to assign a teacher to a comisión. On /admin/usuarios/c8fe9bcb-03ac-45d1-8241-6e5d1420afe4 (a docente) there is NO button/link to add him to a comisión, nor to assign a comisión to him. Investigate: is the teacher->comisión assignment UI shipped anywhere (comisionJtps/comisionAdjuntos/titular write path) or absent (Stage 4 / PLUTO-133/136 blocked)? Missing-link vs missing-capability? Fix so an admin can assign. WRITE TARGET = fraud-sensitive assignment tables: soft-delete only + archive context + role-aware (titular/adjunto/jtp) + capability-gated. Likely unblocks PLUTO-61 (3 real unassigned docentes). Audit design-ping before implement (fraud-table write path).

PLUTO-128 pluto Done high

CR 7: Renombrar a Complicaciones Intraoperatorias

PLUTO-233 pluto Done high

CR 11: ayudante no hace carga

PLUTO-237 pluto Done high

CR 49: Boussebayle (D-Lunes jtp / E-Martes adjunto) no puede ingresar: cambiar mail a maria.boussebayle@odontologia.uba.ar

PLUTO-275 pluto Done high

CR 12: sacar kpi de cantidad de HC porque tiene que ser obligatorio

PLUTO-238 pluto Done high

CR 14: Varias piezas en un mismo acto operatorio VER CR3

PLUTO-240 pluto Done high

CR 20: tipo de anestesia que sea OBLIGATORIO

PLUTO-246 pluto Done high

Informes filter by jefe-de-TP returns wrong/doubled student set (cross-jefe contamination) - was working before, regression

PLUTO-70 pluto Done high

EVO-12 not-found capture two-sink fix: pull captureServer404 out of not-found.tsx boundary; catch-all [...notFoundPath] + instrument 15 notFound() throw sites; preserve PLUTO-171 skew telemetry; subsumes PLUTO-179

PLUTO-180 pluto Done high

CR 21: importante: primero debe figurar cronológicamente en la carga Diagnóstico clínico radiográfico (te debo pasar los 5 items más clásicos) desp

PLUTO-247 pluto Done high

fn_getInformesBundle primary rosterScope CTE has the IDENTICAL adjunto AND-intersection (migration 036 ~line 65) -> mixed JTP+adjunto teacher /informes aggregates (jtpStats/comisionStats/KPIs) break the same way as PLUTO-456. The fn's RANKING sub-scopes are already OR-correct; only the primary rosterScope CTE needs the adjunto branch turned into an OR-union mirroring the ranking-scope. db-lane migration (CREATE OR REPLACE fn). Sibling of PLUTO-456 (coder fixed the TS query side: getStudentsForTeacher/Page + getTeacherKpis). authz-scope predicate -> audit pre-apply review before psql. Surfaced by coder-pluto-cc.

PLUTO-457 pluto Done high

JTP+adjunto 'mixed' teacher roster collapses to empty: adjuntoComisionIds AND-intersected onto JTP pair-gate instead of OR-unioned. getStudentsForTeacher (src/db/queries.ts:2418-2419) + getStudentsForTeacherPage (queries.ts:2564). Any teacher who is JTP of one comision AND adjunto of a DIFFERENT comision gets 0 roster rows -> /acceso-denegado on /alumnos list + detail. Repro: Maria Boussebayle (users c231db69), JTP comision-001 (10 students) + adjunto comision-002; AND comisionId=ANY([002]) nukes her 10 JTP students. Fix: turn the adjunto filter into a DISJUNCTIVE branch (mirror getPracticas:371-372 OR-union; keep JTP pair-gate per PLUTO-77). Auth/identity verified clean (db); audit cause-confirmed.

PLUTO-455 pluto Canceled high

JTP+adjunto 'mixed' teacher roster collapses to empty: adjuntoComisionIds AND-intersected onto JTP pair-gate instead of OR-unioned. getStudentsForTeacher (src/db/queries.ts:2418-2419) + getStudentsForTeacherPage (queries.ts:2564). Any teacher who is JTP of one comision AND adjunto of a DIFFERENT comision gets 0 roster rows -> /acceso-denegado on /alumnos list + detail. Repro: Maria Boussebayle (users c231db69), JTP comision-001 (10 students) + adjunto comision-002; AND comisionId=ANY([002]) nukes her 10 JTP students. Fix: turn the adjunto filter into a DISJUNCTIVE branch (mirror getPracticas:371-372 OR-union; keep JTP pair-gate per PLUTO-77). Auth/identity verified clean (db); audit cause-confirmed. (Renumbered from the cancelled PLUTO-455 which collided with the scanner commit family.)

PLUTO-456 pluto Done high

CR 50: Heredia (A-Viernes y F-Sábado jtp): mail correcto es gonzalo.heredia@odontologia.uba.ar

PLUTO-276 pluto Done high

Deactivated students: segregate via VIEWS (visible to owning JTP + admin for reactivation, excluded from active roster) - Puia case

PLUTO-206 pluto Done high

CR 59: userRoles sin archive + sin trigger. Crear userRolesArchive (misma forma que archives CR57: archiveSeq/archiveOp/archivedAt/archivedBy/archi

PLUTO-285 pluto Done high

SECURITY: isActive=false students NOT blocked — auth/callback + render path lack isActive gate; disabled+roled user with live session loads app

PLUTO-149 pluto Done high

CR 58: practicas archive trigger es permisivo (archivedBy nullable via NULLIF). Hardenear fn_archivePracticaChange a RAISE EXCEPTION cuando app.use

PLUTO-284 pluto Done high

Informes jefe-filter narrowing: KPIs/practicas count + roster must narrow to selected JTP (fn_getInformesBundle filterJtpIds param + page wiring) — Elazar video feedback 2026-07-02

PLUTO-467 pluto Done high

CR 57: Historial de Cambios real en /administrar/* (docentes, alumnos, comisiones, periodos) + /admin/usuarios/[id]. Crear archive tables con trigg

PLUTO-283 pluto Done high

Soporte parity P1: DDL — supportTicketMessages table + vSupportTicketMessages view + archive trigger; add to supportTickets: ticketNumber(sequential), assignedAgent, urlPath, urlSearchParams, userAgent, resolvedAt, resolutionNote; backfill ticketNumber (NOT-NULL/default vs archive-fn to_jsonb expand-only trap). Audit pre-apply review gates APPLY.

PLUTO-217 pluto Done high

deletedBy+deleteReason on all soft-deleted tables + forced-motivo delete dialogs (shared softDelete helper)

PLUTO-215 pluto Done high

CR 43: Agregar tipos de anestesia: Intrapulpar e Intraligamentosa

PLUTO-269 pluto Done high

Data fix: revert erroneous Puia-as-JTP (7 studentAssignments + 1 práctica snapshot) + soft-delete Puia comisionJtps pairs (all 6)

PLUTO-210 pluto Done high

CR 45: Adjunto Pablo Giovacchini (viernes) no figura en DB

PLUTO-271 pluto Done high

CR 41: Los ayudantes asignados a un JTP no pueden ver sus alumnos. Los ayudantes no figuran en el sistema, solo figuran los JTP. Los ayudantes debe

PLUTO-267 pluto Done high

Práctica JTP should reflect corrected assignment, not stale frozen snapshot (systemic: live-join vs propagate-on-edit)

PLUTO-211 pluto Done high

CR 2: Relacionar día, comisión y adjuntos a cargo

PLUTO-228 pluto Done high

CR 3: Varias piezas en un mismo acto operatorio

PLUTO-229 pluto Done high

CR 5: Agregar diagnóstico clínico radiográfico

PLUTO-231 pluto Done high

CR 6: Agregar técnica quirúrgica

PLUTO-232 pluto Done high

Add teacher Agustina Diamante (ayudante) — email agusdiamante@gmail.com, DNI 40382867, tel 1164371660; JTP Gonzalo Heredia, Comisión VIERNES (Elazar 2026-06-22). Verify comision+JTP+email/DNI dedup BEFORE write; user admin_manual + docente_ayudante_primera role + jtpAyudantes link

PLUTO-200 pluto Done high

CR 8: Campos obligatorios en complicaciones

PLUTO-234 pluto Done high

CR 9: Agregar antecedentes personales faltantes

PLUTO-235 pluto Done high

CR 10: Campos obligatorios en antecedentes

PLUTO-236 pluto Done high

d1cb337d: duplicate práctica 87729, asistente Tabatha Ivanovich

PLUTO-786 pluto Done

EVO-123: convert 4 UPDATE OF invariant guards to AFTER/no-column-list

PLUTO-780 pluto Backlog

pluto general archive-reason validator: the candidate regex rejects the .gitpush-pre.sh L204 mandated 'system:migration:<slug>' form

PLUTO-767 pluto Done

BUILD (dispatch-ready, Elazar-launched per bs-mqpzo3ly470 — do NOT act between sessions): Pluto admin "Cambiar email de acceso" server action (canonical change-login-Gmail, decision bs-mqq2v3r1802). New action in src/lib/admin-actions.ts, gate withCap(manageUsers) NOT fullAccess (reportes-trap, mem pluto-view-as-architecture). Input targetUserId+newEmail. In ONE txn w/ setArchiveContext (users is trigger-archived): (1) isAllowlistedEmail(new); (2) dedup-reject if canonicalizeEmail(new) belongs to another live user (id!=target, deletedAt IS NULL); (3) UPDATE users.email=new (emailCanonical GENERATED auto-regens, mem pluto-stored-generated-column-no-recompute) + SET users.authId=NULL so new Google identity re-links next login; (4) cleanup stale auth.users row for OLD identity via service-role admin deleteUser so old account cannot log back in; (5) userAuditLog email delta old->new; (6) optional fire welcome email to new address. Re-login on new gmail = proof-of-control (auth/callback matches by canonicalizeEmail(users.email)==canon(auth email), stamps new authId, same row -> roles/practicas intact). UI: "Cambiar email de acceso" in admin-user-detail.tsx with AlertDialog confirm (account-takeover-shaped). Touches auth/identity -> pre-impl audit design-ping + pre-push audit diff review per push-to-done.

PLUTO-202 pluto Done

Catalog census of Pluto migration effects absent from production

PLUTO-774 pluto Done

Applied Pluto migrations missing from registry can be skipped by registry-driven rebuild

PLUTO-779 pluto Backlog

reactivateInactive motivo has no persistence other than the truncated archive-reason slice

PLUTO-769 pluto Blocked

accessRequests rejection motivo: route it in full to reviewNotes, coded suffix only in the archive reason

PLUTO-778 pluto Done

EVO-115 step 2: Joomla /media/<component>/ scanner-probe alt + 6 append-only vectors

PLUTO-775 pluto Done

export-db.py undercounts functions: information_schema.routines is privilege-filtered, so hardening grants erases functions from the schema.md SSOT

PLUTO-772 pluto Done

supabase_migrations registry row missing for migration 131 (PLUTO-437)

PLUTO-773 pluto Done

Archive-reason content rule: ban call expressions inside a reason interpolation (shape validator cannot reach it)

PLUTO-771 pluto Backlog

CR-67 archive_reason prefix lint parses the reason by line position and can read a word out of a comment

PLUTO-768 pluto Done

mig 130 primaryRoleId guard is advisory: app.allow_primaryroleid_write is caller-settable, and the wording calls it enforcement

PLUTO-765 pluto Backlog

Plan: paciente DNI + HC central store — autocomplete, dedup warning, estadísticas

PLUTO-437 pluto Todo

└─ fn_restorePaciente remedy path for soft-deleted-row document trap

PLUTO-766 pluto Canceled high

└─ fn_restorePaciente + sentineled in-place correction: the remedy for a document number trapped on a soft-deleted pacientes row

PLUTO-764 pluto Backlog high

weeklyReport es un kind sin fila: el reporte KPI semanal solo existe en vuelo y catchUp() no puede re-barrerlo — perdida silenciosa e indistinguible de una semana tranquila

PLUTO-682 pluto Done

EVO-93: move this app's email-outbox drain off Supabase pg_cron onto a venus systemd timer

PLUTO-733 pluto Blocked

Why fn_getInformesBundle takes 5-30 s for some users; tighten bundle cap from measured p99

PLUTO-748 pluto Blocked

Flip NOTFOUND_PAGING_ENABLED once fleet gates clear (mirrors VENUS-27)

PLUTO-762 pluto Backlog

Normalize trailing whitespace in pasted page URLs

PLUTO-761 pluto Done

DB backup: no restore ever tested, no failure alerting

PLUTO-714 pluto Done

Supabase logs.all deprecation breaks db-pluto-cc query_logs 2026-09-23

PLUTO-713 pluto Done

support-action accepts only ticketId (uuid): nothing resolves a ticketNumber or SOP-PLUTO-N ref to an id

PLUTO-756 pluto Done

support-action: accept ticketRef/ticketNumber alongside ticketId

PLUTO-755 pluto Done

Add egress deliverability classifier at email-transport chokepoint (distinct from allowedEmailDomains admission gate)

PLUTO-674 pluto Done

Migrations 113-117 not in applied/ though their objects are live; 117 is untracked entirely

PLUTO-741 pluto Done

appEvents has no success row for outbox-path email delivery

PLUTO-675 pluto Done

Fleet DB-hardening directive — pluto leg (logging/principals/backups)

PLUTO-684 pluto Done

setPersonaRoles: replace-the-set sin baseline — dos superficies de admin de roles se pisan silenciosamente y la atribución del archive queda mal

PLUTO-680 pluto Done

DB connection scaling: verify Supavisor txn-pooler + query-shape pass (pre-scale)

PLUTO-146 pluto Done

Archive triggers RAISE on a missing app.user_id but silently NULL a missing app.archive_reason, so commons promises loud failure it does not deliver

PLUTO-707 pluto Done

PLUTO-751: FK covering indexes (76, advisor unindexed_foreign_keys)

PLUTO-752 pluto Done

Scanner 404 Block W - structural scanner families (mars twin)

PLUTO-751 pluto Done

Email rail lacks cross-rail dedup of one render's alerts

PLUTO-749 pluto Backlog

Adopt fleet ticket-triage protocol (bs-mr4xk6nnuu2) — Pluto replication

PLUTO-487 pluto Blocked

Comment notification quotes empty-content comments and fires on aprobado practicas

PLUTO-703 pluto Blocked

Retro cross-vendor review queue: 10 unreviewed pushes since audit-pluto-ca went dark

PLUTO-636 pluto Backlog

Email-identity SSOT campaign: users.emailCanonical generated key + getUserByCanonicalEmail chokepoint (absorbs PLUTO-61 display-write fix + PLUTO-36 JS/DB parity fix as acceptance criteria)

PLUTO-154 pluto Backlog

Scheduled GoTrue config-drift check (cron/applog rail, alerts not blocks)

PLUTO-634 pluto Backlog

Stats glossary: footnote + tooltip explaining stat abbreviations in user-facing text

PLUTO-495 pluto Backlog

Fleet appEvents schema standardization (mirror MARS-411) — DESIGN-HOLD

PLUTO-533 pluto Backlog

Prácticas: sometimes a student is operador with NO student asistente (single-participant práctica) - define canonical rule

PLUTO-511 pluto Done

Pin search_path on the three project-owned public functions PLUTO-666 did not cover

PLUTO-740 pluto Done

Prácticas: enforce operador/asistente role separation once rosters are curated (students can't pick a docente as asistente)

PLUTO-510 pluto Done

togglePeriodoActiveRoster clears isCurrent/isActive on EVERY periodo with no server-side guard - a direct call leaves the app with no current periodo

PLUTO-718 pluto Done

conform appEvents to fleet SSOT (categoryId FK, promoted cols, append-only+GUC, appEventRelays sidecar, retention guard, logger, views)

PLUTO-73 pluto Canceled

CR 39: Crear una sección interna accesible para usuarios autenticados con manual de uso, SOP operativos y ayudas de carga/revisión. Debe poder crec

PLUTO-265 pluto Deferred

CR 30: utilizar varias direcciones de correo para mensajes diferentes que envía la app: noreply@pensatna.com soporte@pensanta.com, notificación@pen

PLUTO-256 pluto Deferred

Audit-trail schema plan (Pluto, EVO-57 child)

PLUTO-583 pluto Deferred ↳ EVO-57

└─ Actor backfill, provable-only (PLUTO-583D)

PLUTO-587 pluto Deferred

└─ Write-path actor-field population (PLUTO-583C)

PLUTO-586 pluto Deferred

└─ Additive lifecycle-column migration (PLUTO-583B)

PLUTO-585 pluto Deferred

└─ Lifecycle contract + sensitivity matrix (PLUTO-583A)

PLUTO-584 pluto Deferred

└─ Phase 3: backfill + NOT NULL tightening where safe (DDL)

PLUTO-593 pluto Canceled

└─ Phase 2: app-code population of actor columns

PLUTO-592 pluto Canceled

└─ Phase 1: additive nullable actor columns on sensitive tables (DDL)

PLUTO-591 pluto Canceled

└─ Audit-column naming convention SSOT (583 phase 0)

PLUTO-590 pluto Canceled

└─ Historial mapping update + regression + drift checks (PLUTO-583F)

PLUTO-589 pluto Backlog low

└─ DB enforcement for future rows (PLUTO-583E)

PLUTO-588 pluto Backlog low

└─ Phase 5: entity-history.tsx field-mapping update

PLUTO-595 pluto Canceled low

└─ Phase 4: naming outlier renames (studentDeletedAt, bare reason)

PLUTO-594 pluto Canceled low

Pluto fly-solo-kill execution brief (bs-mqpzo3ly470 / EVO-26) — execute on next Elazar-launched team session, do NOT act between sessions. (A) COMMONS/DOC: delete fly-solo/autonomy doctrine + flip log-review=work-order to report-only-Elazar-decides + add Agent-Boundary PM-never-spawns-hands-brief. Pluto-repo files (pluto-commons.md, pm-pluto-role.md) = Pluto coder; shared evolutiva-commons/evolutiva-pm-commons deletes route via bin-whey-cc (whey-canonical, mem shared-commons-edit-routing), NOT Pluto coder. (B) PROBE NOISE (Pluto app code, coder): port venus X-Audit-Probe demotion + internal-probe UA marker so scanner/probe traffic self-classifies to security/info and emits NO page_not_found warn row (source = not-found.tsx capture, mem pluto-notfound-capture-redirect-overfire); + downstream expected-signal allowlist: /wp-* & CMS-scanner paths, apple-touch-icon* 404s, pm-triage NOTIFY probe, gate-correct login-unknown, mobile fetch-abort. (C) RAIL RE-POINT (nw-owned venus daemons = Elazar-launched nw edit, NOT Pluto coder): applog-listen/pull@pluto + pluto-pm-triage-listen.service (EVO-32) -> REAL-severity DM Elazar only, everything else log/queue row no PM DM. (D) DEFERRED per decision pt7: headless sendWelcomeEmail(userId) path (the Agustina exhibit) - policy stands, conversion not scheduled yet.

PLUTO-201 pluto Backlog

LEG-2 aro-retarget: applog-listen alert DM pm-pluto-cc -> POST aro:pluto (aro tag) so Elazar sees in-room + PM runs error-incident troubleshoot IN aro:pluto. DEPS: nw-venus daemon target change + keepalive restart 60cf5e6; pm-llmmsgsrv re-enable fan-out aro:pluto. Pluto verified Elazar in aro:pluto.

PLUTO-167 pluto Backlog

Real-time error reporting + auto-heal — Pluto leg (ratified protocol bs-mqn2ze006f7)

PLUTO-164 pluto Backlog

Verify applog error→aro:pluto live-PM routing survives EVO-5 rail rename (kpi-n-optimization migration bs-mqmr47bwkk4)

PLUTO-157 pluto Backlog

KPI-rework /informes (gathering inputs, do NOT implement yet): teacher-scoped report quality pass. Inputs so far: (a) wrap bare CohortAndProcedureCards grid (teacher-report.tsx:818) in titled ReportSection; (b) Moda operador/asistente cards mislabeled (modal per-student count, not most-frequent person) + redundant beside Promedio -> cut or relabel; (c) EPI RE-WEIGHT: Puia wants MORE epidemiology on pluto+venus -> KEEP/EXPAND porSexo/porProvincia/etc (REVERSES earlier generic-remove rec; do NOT cut epi buckets). Grounding: judge on ACTUAL teacher-scoped values via audit-venus KPI->source-view map + db-pluto value pull, NOT admin-proxy shape. Awaiting full KPI->view map (~20-30min from audit-venus) + Elazar per-item rulings before WI splits into coder/db work.

PLUTO-121 pluto Backlog

└─ /informes immediate UI fixes (Elazar GO now): (a) wrap bare CohortAndProcedureCards grid (teacher-report.tsx:818) in a titled ReportSection matching sibling sections; (b) CUT 'Moda operador/asistente' cards (mislabeled modal-per-student count, redundant beside Promedio) + remove now-dead computeMode/opCounts plumbing ~1199-1201, keep Promedio. UI-only, post-push audit PTD. Rest of KPI-rework held under parent 121.

PLUTO-124 pluto Done high

└─ /informes top summary cards grouping (Elazar GO now): wrap the bare top-of-report totals cards — Total prácticas, Como operador (%), Como asistente (%), Alumnos activos — in a single titled ReportSection matching the sibling pattern (same as PLUTO-124's 'Resumen de cohorte y procedimientos'). Wrapper/title only, values+logic unchanged. teacher-report.tsx. UI-only, post-push PTD.

PLUTO-127 pluto Done high

Duplicate practicas: operador + asistente each create the SAME clinical event picking each other as counterpart -> 2 mirror practica rows for 1 real práctica. Need duplicate-detection + canonical-record rule (natural key candidates: fecha+comision+paciente/tratamiento+the operador/asistente pair). Design WITH Elazar; covers (a) prevent new dupes at create, (b) reconcile existing dupes in prod. Cross-team lessons-learned for mars/venus.

PLUTO-78 pluto Backlog

Vercel log-drain setup: Elazar greenlit (2026-06-12) true 24h+ runtime-log retention (currently logs are point-in-time only via Vercel MCP). Scope: pick drain destination (log service/endpoint), configure Vercel log-drain, implementer is infra (nw-whey/nw-venus) not coder. PM owes Elazar the concrete scoped plan before dispatch.

PLUTO-46 pluto Backlog

Soft-deleted-user restore + identity-attach explicit two-step design

PLUTO-620 pluto Backlog ↳ EVO-79

Fleet deliverable: draft BACKTEST SPEC + TRIAGE-CODIFICATION CHECKLIST template (Pluto-owned)

PLUTO-524 pluto Backlog

Bearer compare on /api/cron/drain-email-outbox is a plain !== where Mars uses timing-safe

PLUTO-734 pluto Done

Segment error boundaries drop the client error payload PLUTO-83 added

PLUTO-735 pluto Done

Block U follow-up: assistant-name dotfiles and /ai.json residuals

PLUTO-732 pluto Done

Down-tier the AI-assistant-config + shell-history scanner family (Block U)

PLUTO-731 pluto Done

Down-tier the AI-assistant-config + shell-history scanner family

PLUTO-730 pluto Done

Audit sweep: which 'use server' exports are reachable unguarded by anonymous POST (PLUTO-27 found three; the surface is much larger and needs a real analysis, not a grep)

PLUTO-729 pluto Done

Extend SCANNER_PROBE_RE with archive-probe family (/backup.tar|.7z|.rar|.zst|...) — 294 unsuppressed scanner 404s in one window

PLUTO-661 pluto Done

EVO-12 deploy-skew guard FAST-FOLLOW (dormant, flag-OFF + Q3-held): (a) APP manifest-oracle — replace interim KNOWN_SEGMENTS with a prebuild codegen that walks src/app and emits a BUNDLED TS route-pattern module (Vercel-safe, rot-free, not a hand-allowlist); shared cross-fleet helper coordinated w/ coder-mars + coder-ayudarg per pm-llmmsgsrv. (b) DAEMON skew-suppression — nw-venus updates applog daemon to consume detail.isSoftNav/routeResolves + deploy-timing window so a stale-build soft-nav of a valid route downgrades ERROR->WARN and does NOT DM; audit-pluto specs the daemon-side predicate. Both are flag-ON PREREQUISITES (part of the Q3-enable gate), not live bugs. Canonical predicate: downgrade ONLY when RSC-soft-nav AND path in build-time route manifest; hard-nav/curl/bot ALWAYS page.

PLUTO-169 pluto Done

EVO-12 deploy-skew guard leg (b): daemon-side skew suppression (nw-venus + audit-pluto)

PLUTO-722 pluto Backlog

UI Button lint misses className overrides when <Button and className are on different lines

PLUTO-719 pluto Done

PLUTO-133 follow-up (Elazar 5b, sequenced AFTER the main toast sweep ships): should-be-required / data-integrity candidates needing a verify pass then fix — (1) periodo date-range fechaFin<=fechaInicio unvalidated client+server; (2) practica rejection comentario not required; (3) destructive activo toggles (periodo/comision) no confirm dialog → toggle-off cascades; (4) admin create-user with no role → primaryRoleId NULL → blank-redirect login. Verify each path first (2nd-sweep agent guessed some), then fix. Do NOT start until PLUTO-133 main sweep is shipped.

PLUTO-136 pluto Done

PLUTO-77 v1 LOW followup: comision-day secondary list capped at limit-200 first-page (no cursor pagination); add cursor paging if an ayudante's assisted-comision roster exceeds 200

PLUTO-81 pluto Done

Accent-insensitive search (tilde): 'matias' must match 'matias'/'matias'

PLUTO-505 pluto Done

Prácticas rectificar: gate student comment-WRITE to rectificar state only (D2)

PLUTO-440 pluto Done

Declare maxDuration on /api/image, then set fetchImage timeout bound from sampled data

PLUTO-697 pluto Done

fetchImage needs AbortSignal.timeout, bound picked from Pluto's own latency data

PLUTO-696 pluto Done

resolveFrom honra cualquier SMTP_FROM_* seteado sin validar — Gmail re-estampa el From y el mail sale mal atribuido (ambas vars seteadas en prod)

PLUTO-681 pluto Done

getAnomalyReport: nested 3-wide raw Promise.all bypasses DB_POOL_MAX limiter (residual pool-acquire class)

PLUTO-151 pluto Done

CLAUDE.md cites a 6-prefix archiveReason policy that is defined nowhere in the repo

PLUTO-706 pluto Done

OAuth redirectTo pinned to validated canonical origin (was window.location.origin)

PLUTO-699 pluto Done

vFrictionByUser/vFrictionDigest structurally empty - group by COALESCE(effectiveUserId, actorUserId), migration 112

PLUTO-715 pluto Done

Generalize known-benign 404 suppression (extends PLUTO-182/184 template, app-side classifier per Elazar bs-mqoruy0m32e). All currently page at warn; reclassify at the write path (not-found-classify.ts / not-found-log.ts) so the row persists at info and never enters the warn page path. Candidates: (1) phantom redirect over-fire PLUTO-165/169 residue: empty requestedPath + classifiedReason=genuine-bad-route -> info (~1.9/day); (2) /apple-touch-icon.png + -precomposed.png iOS/Safari auto-requests -> WELLKNOWN_BENIGN_RE -> info/navigation (~1.3/day); (3) /robots.txt -> WELLKNOWN_BENIGN_RE -> info (~0.5/day; optionally serve real robots.txt separate); (4) credential-JSON scanner burst ~15 variants currently mis-tagged navigation NOT security (gcp/firebase/secrets/config/service-account .json, /api/env, /actuator/env) -> extend SCANNER_PATH_RE -> info/malicious (these are 182-class probes that slipped the regex); (5) /practicas/<non-uuid-slug> malformed -> non-UUID on UUID route -> info/malicious (~0.3/day). INVESTIGATE-FIRST sub-point: anonymous-no-referer-unknown old-schema warn rows (~0.9/day) -> suppress ONLY if all pre-date PLUTO-169 deploy; if any post-date, find the un-upgraded code path. ~7/day of ~14/day page_not_found warn volume.

PLUTO-187 pluto Done

PLUTO D8 compute-placement remediation (self-scan)

PLUTO-98 pluto Backlog

└─ D8: move the canonical-pieza 23505 recovery compare from JS into SQL now that migration 117 is applied

PLUTO-781 pluto Done low

logCaughtError drops error.cause — every caught fetch failure is un-attributable

PLUTO-691 pluto Done

Grading-path notification+email both lost on pool timeout (Class-A)

PLUTO-693 pluto Done

GoTrue/Supabase Auth config mirror doc (§Unverifiable State)

PLUTO-631 pluto Done

isDemo column/view/fn drop (DESIGN HOLD)

PLUTO-600 pluto Done

Solo-gate: scope verdict-hash to --only pathspec (shared-checkout collision fix)

PLUTO-475 pluto Canceled

Implement vActive<Table> views + migrate call sites per soft-delete policy

PLUTO-434 pluto Done

/a-solucionar: admin data-health dashboard — non-allowlisted active users, unassigned teachers, orphan records. Auth-required. Per Elazar -30391/-30393 + 3-PM §Auth ratification.

PLUTO-430 pluto Done

/a-solucionar: landing page for non-allowlisted users who attempt login — explains issue, prompts email update. All roles, all projects.

PLUTO-429 pluto Done

KPI weekly email report: JTP/Adjunto/Titular sinCalificar% stats via vPracticasHierarchyRollup cron

PLUTO-428 pluto Done

CR 42: 3 docentes reales sin asignación a comisión: gonzalo.oviedo, lorena.salomone, cirugia1 (@odontologia.uba.ar). Necesitan ser asignados a comi

PLUTO-268 pluto Done

CR 34: Los items que están antes en Diagnóstico clínico radiográfico, dejarlos bajo un nuevo título: Otras características de la pieza dentaria (qu

PLUTO-260 pluto Done

CR 29: agregar notas de docente a alumnos en práctica

PLUTO-255 pluto Done

CR 28: Agregar diagrama dentadura

PLUTO-254 pluto Done

Support-ticket surface + ticket triage leg (NET-NEW) — sibling of PLUTO-191, Elazar GO 2026-06-22 (Pluto gets BOTH triage legs since LIVE; venus deferred). Pluto has NO support-ticket surface today. BUILD: (a) net-new ticket surface — clone source = mars's /administrar/soporte module (per-app COPY; coder picks Pluto path + adapts to Pluto schema/primitives); needs a supportTickets table (db lane, trigger-archived per archive doctrine since user-facing CRUD) + server actions + the operator UI. (b) ticket triage leg — on ticket CREATE, app emits a PM-addressed aro:pluto DM with the ticket DB row-summary (REUSE the applog NOTIFY->listener->hub-DM rail, EVO-28 piece-1 ebb593b live; new category/action e.g. category=user/action=supportTicketSubmitted, per-app COPY). OPERATIONAL (PM behavior, no code): PM reads the ticket row from DB (never URL) -> classify/fix/draft visible in aro:pluto; routine solicited replies PM sends; material/sensitive outbound = Elazar-gated. DEPS: applog rail (live). T2 build (new schema = DDL) per on-demand model: db builds supportTickets (pre-apply audit review of the .sql, Elazar DDL gate UNCHANGED) + coder builds surface + triage emit; INDEPENDENT audit. Pre-impl audit DESIGN ping before build (touches new schema + auth-adjacent operator gate + email/outbound path). Execution in aro:pluto per descend; generalpm holds the EVO umbrella. Sibling: wi:PLUTO-191 (access leg). mem:pluto-pm-triage-loop

PLUTO-193 pluto Done

Access-request PM-triage loop (DB-fed) — adopted bs-mqotdmmk6b5 2026-06-22, Pluto access-leg only (no support-ticket surface exists in Pluto). GOAL: on access-request submit, app DMs pm-pluto-cc in aro:pluto a DB row-summary so PM triages from the DB (never the URL) before Elazar sees a cold email. BUILD (piece 1, coder + applog lane): on accessRequests INSERT (createdVia=access_request, via /solicitar-acceso → access-request-status-sql.ts / auth-actions.ts / admin-actions.ts), emit a PM-addressed aro:pluto DM carrying {requestId, requester name, email, requested role/context, institutional domain} — REUSE the applog NOTIFY→listener→hub-DM rail just extended for EVO-28 (new category/action, e.g. category=user/action=accessRequestSubmitted; per-app COPY). OPERATIONAL workflow (PM behavior, no code): PM reads the accessRequests row → runs canonicalizeEmail/emailCanonical dedup (NEW vs DUPLICATE-of-existing-user Z under gmail-dot/+tag/googlemail/institutional variant — capability already BUILT via PLUTO-152) → checks isAllowlistedEmail domain → hands Elazar a verdict: 'requester/email / NEW vs DUPLICATE-of-Z / domain ok? / recommend APPROVE|REJECT|MERGE — go?'. GATES: approveRequest GRANT (users/userRoles INSERT + sendAccessRequestApproved email) = Elazar-gated (hits both auth/allowlist-grant + real-audience email; Pluto=LIVE clinical users since 2026-06-09, erroneous grant/denial hits a real person). reject/requestMissingInfo (real-audience email) → PM drafts, sends if routine, escalates exact text if material. Upstream read/dedup/classify = PM-autonomous, visible in aro:pluto (show-work-in-aro). DEPS: applog rail (EVO-28 piece-1 ebb593b live). Pre-implementation audit ping (touches accessRequests trigger-archived table + auth-adjacent path) before coder builds.

PLUTO-191 pluto Done

Analyze visitor screen-size/device cohort (Vercel Web Analytics) → optimize Pluto layout/breakpoints to dominant cohort, VERIFIED vs actual distribution (telemetry directive bs-mqmscr4k3wh)

PLUTO-159 pluto Done

Alerting hardening: daily heartbeat-appEvent (cron writes pulse + checker alerts on silence) so dead applog-listener is detected not assumed-healthy — adopt MARS-148 pattern; + rail watermark/catch-up gap (nw-venus/pm-venus own rail leg)

PLUTO-150 pluto Done

Per-agent git worktree / path-scoped add for coder-pluto + db-pluto on venus (end shared-checkout git-add-all race)

PLUTO-145 pluto Done

Inactivity-warning baseline floor: don't count dormancy before 2026-06-09 clinical go-live

PLUTO-137 pluto Done

Demo-data UI+route gating behind SHOW_DEMO_TOOLS flag (server-side, default FALSE, byte-identical fleet-wide). Conditional-render not CSS-hide (no DOM/view-source leak) for ALL roles incl admin; gate demo UI surfaces AND seed/teardown server actions/routes (403/404 when off — seal the injection path, not just the button). Keep code: flag-gated in main, CI typecheck touch so demo path compiles, one-line README. Pluto surfaces: createdVia='demo_seed', demo teardown route, @demo.pluto allowlist (email-allowlist.ts), seed-demo script, any isDemo/demo badge/filter/nav. Existing demo ROWS = separate db-op, Elazar's call (Pluto LIVE → purge demo-labeled only w/ archive-context, or leave hidden). BLOCKED on Elazar greenlight + nw-whey's cross-app enumeration checklist.

PLUTO-118 pluto Done

UX-pain-digest recipient was hardcoded to Elazar's personal Gmail, not work address

PLUTO-710 pluto Done

Four DB functions set app.user_id but never app.archive_reason, so archiveReason falls through to the caller or NULL

PLUTO-705 pluto Canceled

Participant-change panel unreachable from the student surface (/mi-cursada/[id])

PLUTO-702 pluto Done

Friction dashboard: scanner 404s at warn tier were 45% of user friction

PLUTO-689 pluto Done

Edge-Instrumentation bundle pulls email.ts's node:crypto — operator alert leg cannot run on an edge-runtime 500

PLUTO-685 pluto Done

OPERATOR_EMAIL || default hardening (email.ts:22)

PLUTO-676 pluto Done

pm-triage daemon silently drops kind=weeklyReport from pluto kpi-report

PLUTO-520 pluto Done

SOP-11: práctica de Maximiliano Otero cargada con nº de ficha incorrecto (real 86416), no le aparece ni puede editarla

PLUTO-678 pluto Done

Defense-in-depth: render-path requireCapForAction throw should render graceful acceso-denegado, not 500 + admin error-email storm (generic error-boundary / convert render-path cap checks to redirect variant). Surfaced by PLUTO-43 (dead-fetch was the trigger; this guards the class).

PLUTO-44 pluto Done

Historial de cambios rows appear duplicated (~4x) on practica change history; investigate root cause (view join fan-out / archive double-write / query) and fix at source - data should not be stored 4x

PLUTO-82 pluto Done

PLUTO-664 follow-up: REVOKE design for archive/fraud/audit table grants

PLUTO-668 pluto Done

SECURITY DEFINER pg_temp shadowing audit (fleet finding, enamel/terra)

PLUTO-664 pluto Done

Solo-lane gate: targeted content-sniff for inline page.tsx authz gates

PLUTO-473 pluto Canceled

Percent-encoded fixtures for not-found-classify (MARS-586 prerequisite, 3 pre-probe patterns)

PLUTO-657 pluto Done

Shared applog category-vocabulary mismatch: category-keyed filters inert on pluto

PLUTO-653 pluto Done

Signed resume-link 404s under malformed /n/ base path (solicitar-acceso/completar)

PLUTO-654 pluto Done

Retire solo-pluto-cc/auditsolo-pluto-cc doc + config residue tree-wide

PLUTO-648 pluto Done

Resuelto via status dropdown skips resolvedAt + reporter resolution email

PLUTO-643 pluto Done

supportTickets: add category+priority (lookup-backed) + vSupportTicketFull view

PLUTO-625 pluto Done

Unauthenticated server actions in lookup-actions.ts leak internal roster PII

PLUTO-635 pluto Done

Enumerate every session-establishing path, confirm isGenuineGoogleUser enforcement fleet-wide (not just auth/callback)

PLUTO-632 pluto Done

Commit authconfig.json (asserted expected auth-config values) + diff-on-push drift assertion for GoTrue config

PLUTO-633 pluto Done

lookupOptions: add updatedAt + touch-trigger (sweep-found hygiene)

PLUTO-626 pluto Done

Admin pending-items digest: support tickets + access requests + correcciones

PLUTO-618 pluto Done ↳ EVO-75

EVO-70 Tier 1: trigger-wake for emailOutbox (pg_net)

PLUTO-613 pluto Done ↳ EVO-70

EVO-70 Tier 0: guard drain-email-outbox cron with EXISTS check

PLUTO-612 pluto Done ↳ EVO-70

Add createdAt to systemSettings (EVO-69)

PLUTO-611 pluto Done ↳ EVO-69

EVO-67: add 'No especificado' opt-out to sexo lookup

PLUTO-608 pluto Done

a11y: friction-flash lacks prefers-reduced-motion guard

PLUTO-607 pluto Done

Friction telemetry re-scan: preventive visual cues for intake form

PLUTO-606 pluto Done ↳ EVO-66

Friction-fix campaign: mine + fix top FRICTION-tier UI sources

PLUTO-604 pluto Done ↳ EVO-62

SCANNER_PROBE_RE: add /.linode-cli (cloud-cred dotfile gap)

PLUTO-603 pluto Done

SCANNER_PROBE_RE: consolidate 2026-07-17 46-path sweep (Block M)

PLUTO-602 pluto Done

SCANNER_PROBE_RE gap: /.flaskenv not covered (single observed hit)

PLUTO-601 pluto Done

Pluto: adopt Mars DB-editable domain allowlist (EVO-59 child)

PLUTO-597 pluto Done ↳ EVO-59

Feature gap: no way to edit participants on an already-created practica

PLUTO-544 pluto Done

Inventory + retire demo-data gates/rows

PLUTO-579 pluto Done ↳ EVO-54

Per-agent Postgres login roles (adopt Mars reference)

PLUTO-581 pluto Done ↳ EVO-56

Audit createdBy/At + deletedBy/At + changelog/archive coverage

PLUTO-580 pluto Done ↳ EVO-55

/administrar/comisiones spreadsheet grid — Stage 4 editable comisión/day rows por período

PLUTO-339 pluto Deferred

Stop writing dot-stripped gmail form to users.email (commons Email-Norm violation, cosmetic)

PLUTO-61 pluto Canceled

PLUTO-101 follow-up: wire fn_getASolucionarBundle into app

PLUTO-577 pluto Done

.gitpush-pre.sh solo Class-A gate silently dies (exit 1, no output) on clean changeset with no leftover untracked file

PLUTO-497 pluto Done

Telemetry minimization cull: stop persisting ip+userAgent on NON-security INFO events (toast + navigation-info ONLY) in logger.ts; KEEP on auth/authz/malicious AND on 404 (see note) (telemetry decision bs-mqmscr4k3wh)

PLUTO-160 pluto Done

logger isCritical exempts only auth/authz, not malicious/session/user - a malicious/info security event silently drops at prod LOG_LEVEL<3 unless forceSync; latent, surfaced by PLUTO-182

PLUTO-183 pluto Done

Code sweep: retire stale eventType-based appEvents queries (pre-migration schema paths still running, 35-37ms × 112-257 calls/day). Surfaced in PLUTO-115 EXPLAIN. Find + update to the current level/category/action schema. Coder sweep.

PLUTO-119 pluto Done

/practicas/nueva form: lay fields side-by-side to save vertical space (currently stacked one-below-the-other)

PLUTO-68 pluto Done

Flatten vPracticasAuditEntries — per-row correlated subqueries at LIMIT 250 drive the /practicas 188-249 statement count

PLUTO-483 pluto Canceled

studentFacts card: persisted-attribution scope-gate (audit-corrected from live-rosterScope pair-gate)

PLUTO-508 pluto Done

getMyPracticas uses mutation guard, crashes /mi-cursada view-as reads

PLUTO-573 pluto Done

404: /notificaciones dead route — UI link points to nonexistent page (active Jun 3+9)

PLUTO-53 pluto Done

Soft confirm when creating práctica as operador with no asistente selected (companero field left empty)

PLUTO-571 pluto Done

approveAccessRequest: docente_jtp/docente_adjunto approvals miss comisionJtps/comisionAdjuntos membership + wrong role (same defect class as PLUTO-566)

PLUTO-567 pluto Done

approveAccessRequest silently FORKS identity for a soft-deleted existing user (data-integrity bug; surfaced restoring Augusto Montoni df340604, a PLUTO-147 dormancy-swept stub). Two coupled gaps: (1) the existing-user probe (admin-actions.ts ~2168) filters deletedAt IS NULL, so a soft-deleted stub is invisible and the flow falls through to the net-new INSERT branch; (2) uq_users_emailcanonical is PARTIAL (WHERE deletedAt IS NULL, migration 005) and there is NO unique on legajo/numeroDocumento, so the fall-through INSERT does NOT raise 23505 — it creates a SECOND active users row (new uuid), orphaning the real soft-deleted identity (legajo/comisión assignment/role/history buried). A bare new stub logs in; real identity stays buried. BONUS gap: the existing-ACTIVE-user branch (~2172) marks the request Aprobado but sends NO sendAccessRequestApproved email. FIX: extend existing-user detection to also match soft-deleted rows and RESTORE in-txn (clear deletedAt/deletedBy/deleteReason, isActive=true, re-assert alumno role, mark Aprobado, fire sendAccessRequestApproved) under the archive sentinel; + add the missing email to the active-user branch. This kills the dormancy-swept-stub-reappears recurrence (every PLUTO-147-swept student who returns hits this). GATING: touches user-create + email path -> audit pre-impl design-ping + pre-push diff review + post-push PTD. NOTE: users has NO restoredBy/restoredAt cols (fraud-tables only).

PLUTO-448 pluto Done

approveAccessRequest hardcodes alumno role/studentAssignment for docente_jtp and docente_adjunto too (same latent defect as PLUTO-566)

PLUTO-568 pluto Canceled

Copy mars soporte -> Pluto ticket system (/admin/soporte)

PLUTO-172 pluto Done

└─ Permission gate: resolve requireCap (manageUsers vs new supportTickets cap) + audit design-ping (schema+authz+email triple-trigger) BEFORE impl

PLUTO-176 pluto Canceled high

└─ UI /admin/soporte (shadcn New York primitives; reuse user-avatar/user-hover-card/section-title; Pluto brand string)

PLUTO-175 pluto Done

└─ Server actions + data layer (ticket CRUD + message thread), email via sendAdminEmail() chokepoint + OPERATOR_EMAIL knob (mars debts pre-baked-out)

PLUTO-174 pluto Done

└─ DB: supportTickets + supportTicketMessages migrations (archive-triggered, lookupOptions vocab grupos for status/category/priority); FK users+lookupOptions only

PLUTO-173 pluto Done

/practicas mobile card is read-only: teachers cannot change practica estado/grade from a phone — handleChangeEstado control is desktop-table-only; add it to the md:hidden mobile card

PLUTO-42 pluto Done

P2: codify triage playbook + auth-gate-first rule into solo-pluto-cc.md

PLUTO-523 pluto Done

Implement converged friction-criteria dedup spec (opt-out base + per-event anti-join + fail-closed classification table)

PLUTO-561 pluto Done

Friction rollup views + indexes (vFrictionDigest/vFrictionTop/vFrictionByUser)

PLUTO-560 pluto Done

/admin/friction page (fleet friction-dashboard decision)

PLUTO-559 pluto Done

Fix NULL effectiveUserId on friction rows (capture-path bug)

PLUTO-558 pluto Done

Create vUserFrictionEvents (fleet canonical dup of vFriction7d)

PLUTO-557 pluto Done

Panel Admin: pinned sidebar-first entry + emoji/numbered card grid

PLUTO-555 pluto Done

Ver como: add per-row action in usuarios list (Elazar spec)

PLUTO-548 pluto Done

Ver como: add global user-picker launcher (discoverability fix)

PLUTO-547 pluto Canceled

Toolchain baseline upgrade: Next/React 19.2.7/Node 24/pnpm 10 + staged deps

PLUTO-546 pluto Done

fn_notify_applog_err: page_not_found signature collapses across all routes

PLUTO-545 pluto Done

UX-friction fixes: /practicas/nueva checkbox hints + submit spinner + DD/MM dropdowns + login OAuth race fix

PLUTO-541 pluto Done

Capture native HTML5 constraint-validation hints into friction telemetry (mirror MARS-412)

PLUTO-534 pluto Done

└─ Drop vFriction7d legacy OR-clauses after companions confirm-emitting 7d clean

PLUTO-539 pluto Done

Fleet-wide defense-in-depth: revoke anon/authenticated grants on views/tables

PLUTO-538 pluto Done

P1: rebind task-router in Pluto commons — Class-S->solo default / Class-A->full-team

PLUTO-522 pluto Done

Optimize Pluto mobile-first for its OWN most-used viewport (act on appEvents data)

PLUTO-537 pluto Done

Stop viewport-size logging to appEvents (data collection complete)

PLUTO-536 pluto Done

Lean recent-events views vAppEvents25/50/100 on appEvents (fleet standard)

PLUTO-532 pluto Done

equipo-academico: surface comision name per Adjunto/JTP (C)

PLUTO-526 pluto Done

error-digest.ts: exclude genuine-bad-route 404s from mis-level (subnivelado) classifier

PLUTO-516 pluto Done

Down-tier clientError:access-denied off the real-time error pager (gate-correct denials should not page)

PLUTO-514 pluto Done

Persona switch should land on the new persona's role-home, not refresh the current URL (kills access-denied false positives)

PLUTO-515 pluto Done

/informes: new section - students-by-practica-count distribution, drill-down to student list

PLUTO-507 pluto Done

Relocate 'Alumnos sin Practicas' from /practicas to /admin/a-solucionar

PLUTO-504 pluto Done

/practicas: add alumno search box (parity with /alumnos deep-link)

PLUTO-502 pluto Done

Comisión detail page + link comisión names to it

PLUTO-494 pluto Done

/informes TOC below 'Resumen general' — section list with explanations + jump links

PLUTO-496 pluto Done

solo-pluto/.mcp.json is git-tracked with an inlined LLMMSG_HUB_BEARER (no-inlined-secrets violation)

PLUTO-490 pluto Done

Harden getInformesBundle fn-output↔consumer contract (durable fix beyond the 112 runtime guard). Root lesson: Pluto's fn emits UNTYPED jsonb (jsonb_build_object) that TS only CASTS — a key rename (porLookup vs porAnestesia) compiles clean and crashes at runtime. A bare 'as' cast gives FALSE confidence (compiles while runtime JSON lacks the key). Fix: zod-parse (or equivalent runtime validate) the RPC return at the queries.ts:3897 boundary so fn↔consumer key drift fails LOUDLY at the boundary with a clear error, not a deep .map crash. Contrast venus: its reshapes build typed objects in TS code, so key drop fails COMPILE — Pluto's SQL-built JSON can't be compile-checked that way, hence runtime validation.

PLUTO-117 pluto Canceled

Native agent/PM-triggerable ticket reply: new secret-gated POST /api/internal/support-reply (Bearer INTERNAL_EMAIL_KEY, mirror /api/internal/send-email) so the PM/operator can post a support-ticket reply programmatically -> user gets it as in-app staff comment (supportTicketMessages authorRole=staff) AND email (sendSupportReplyEmail), 'as if a human operates the app'. Impl: extract postSupportReply core into a shared helper taking explicit actorUserId; both the existing manageSupport server action AND the new endpoint call it. DESIGN Q (resolve w/ audit): actor identity for the realUserId stamp + archive sentinel — dedicated system 'Soporte' operator user vs Elazar's id. GATED: email-send + auth path -> audit pre-impl design-ping + pre-push diff review before push. Optional add closeAndNotify endpoint too.

PLUTO-444 pluto Done

449-C follow-up: 'copiar enlace' (copy ticket URL) button alongside SOP-NNN ref copy

PLUTO-488 pluto Done

Unit-A frontend image-normalize for profile-photo upload (HEIC/HEIF/PNG/WEBP->JPEG + downscale before upload)

PLUTO-485 pluto Done

Hardening: roster-add forms allow adding a fraud-table membership into a NON-current/closed period — isPeriodoValid checks only deletedAt IS NULL, not isCurrent. Affects BOTH the new docente-detail add-form (PLUTO-128) AND the already-shipped list-page dialog (docentes/page.tsx) — PARITY, not a 128 regression. If cross-period roster-add is NOT an intended workflow (pre-stage future / correct past period), gate both forms on isCurrent. PENDING Elazar's intent call (is cross-period add a feature?). Surfaced by audit on PLUTO-128 pre-push review.

PLUTO-129 pluto Done

Investigate serverError cluster on /practicas (matias.garciablanco@odontologia.uba.ar, 2026-06-18 20:28, concentrated single-session): 5x /practicas render (digest 163624117) + 2x /practicas/[id] action (1630870042) + 1x /practicas/[id] render + 1x / action. GENUINE 500s, real user, one tight window. Also note older /administrar/alumnos/[id] render 500 digest 3278366549 (8 hits 2026-06-10/11, stopped) - look up that digest too. Find root cause.

PLUTO-189 pluto Done

Investigate recurring clientError crash at /informes (~0.9/day, last 14d) hitting MULTIPLE real users: matias.garciablanco, andrea.ochotorena, royursino15, grafilandino, elazar.pimentel. GENUINE (NOT a suppress candidate per the known-benign sweep). Multiple distinct digests (1994195443, 4199147826, 1051002312, 1177967776...). Consistent client-side crash on the /informes route across users -> real defect. Find root cause + fix.

PLUTO-188 pluto Done

Atomic-remove committed db/reference-data.sqlite binary (fleet decision bs-mr4mjr68vld, 4/4)

PLUTO-480 pluto Done

Add appEvents append-only immutability trigger (fixed §5.1 semantics)

PLUTO-476 pluto Done

Mobile layout tweaks on /practicas/nueva (sexo, nacionalidad, dificultad percibida)

PLUTO-479 pluto Done

Email retry/failure backstop gap (pre-existing, exposed by PLUTO-38 cron-drop): after dropping the dead drain-email-outbox cron, Pluto has NO email retry and NO failure alert. A failed send (SMTP timeout) strands the row 'pending' forever — no retry, no operator alert (the alert-after-5-attempts only ever fired from the now-dead drain, which never functioned anyway). Invisible today (0 pending). Live happy-path = Next.js after()-hook send. Restore options: (a) pg_net+pg_cron */5 GATED drain (sanctioned path; vercel.json CANNOT host sub-daily cron — fails the whole build); (b) external scheduler; (c) minimum cheap win = alert-on-strand observability (appEvents warn when a row sits pending > N min). Disposition: reliability vs cron-cost — Elazar's call. Not urgent.

PLUTO-126 pluto Done

Comunicar a Puia que /admin/inactividad existe (lista usuarios sin ingreso + inactivos ≥4d con contador)

PLUTO-353 pluto Canceled

audit-actions resolver-fanout fold (LATERAL JOIN consolidation)

PLUTO-379 pluto Canceled

academicHierarchy missing archive — titular cascade rewires leave no trail. Add academicHierarchyArchive + AFTER INSERT/UPDATE/DELETE trigger (JSONB before/after pattern).

PLUTO-389 pluto Done

practica multi-select join tables ×6 missing archive — anestesias/antecedentes/caracteristicas/complicaciones/diagnosticos/tecnicas. Per-table archive + trigger (column-per-field row-snapshot pattern, RETURN OLD on DELETE).

PLUTO-390 pluto Done

appEvents INSERT failed with 'DB read-only' error during one-off email script (coder tag 1631)

PLUTO-357 pluto Done

Pluto commons §Agent Boundaries amendment — grant db-pluto-cc narrow push scope (db/schema.md + db/reference-data.sqlite + db/migrations/applied/*) per R4 mandate; ratified post-hoc audit-pluto-cc-30497

PLUTO-427 pluto Done

personas-actions.ts:128 getPersonaDetail UNION ALL fold — 4 parallel queries with same shape collapse into single UNION ALL with rowSubtype discriminator (mirrors getDocenteMemberships).

PLUTO-378 pluto Done

audit-actions resolver-fanout fold — 6 functions in src/lib/audit-actions.ts collapse archive→Set→resolver-fanout→JS-merge into single LATERAL-JOIN query each (per pluto-db audit 5902). 4→1 RTT per call site.

PLUTO-377 pluto Done

Invalid URL params (?jtp=all) cause 500 instead of graceful empty state. UX audit item 2.

PLUTO-417 pluto Done

Stale appEvents schema in 3 admin-actions queries — getRecentLoginEvents/getOldestUserLastLogins/getInactiveUsers still use legacy eventType/eventDetail; migrate to canonical category/action/actorUserId shape.

PLUTO-393 pluto Done

manageComisiones cap referenced by createComision/updateComision/softDeleteComision but not granted to any role in lookupOptions — all comisión CRUD currently denied. Add to administrador + bedelia caps, or replace withCap('manageComisiones') with managePeriodos/manageRoster (WI#128 audit finding)

PLUTO-394 pluto Done

resolveDataAccessScope → fn_resolveDataAccessScope SQL fn + React cache() — collapse 3-4 round trips per protected render to 1; src/lib/access-scope.ts

PLUTO-365 pluto Done ↳ EVO-36

/practicas/[id] detalle: agregar 'Pendiente hace' (sólo si Sin Calificar) + agregar 'Fecha de Práctica' y 'Fecha de Registro' al bloque Participantes debajo de Comisión, lado a lado

PLUTO-356 pluto Done

Replace 'horrible red buttons' across pluto UI — audit destructive/red Button variants, replace with shadcn defaults or Pluto-tuned palette per Elazar UX feedback (5711)

PLUTO-375 pluto Canceled

Error page — add 'Volver' option so user doesn't have to restart workflow. UX audit item 8.

PLUTO-423 pluto Done

Middleware matcher: exclude /api and /_vercel to cut invocation count

PLUTO-435 pluto Done

[shipped v1.57.1 / 62819ab] /practicas perf bundle: vPracticasHierarchyRollup view (237→24 rows, ~27× wire), pendienteHaceDias view col (BA-cal-day, drops Date.now hack), getAuditLog LIMIT 100, lookup unstable_cache + revalidateTag, /practicas/[id] Promise.all parallelize

PLUTO-369 pluto Done ↳ EVO-36

Chromium → @react-pdf/renderer swap — replace src/lib/export-actions.ts renderPdfFromHtml (puppeteer-core + @sparticuz/chromium) on /informes export; CPU 5-15s → 50-200ms per render

PLUTO-364 pluto Done ↳ EVO-36

Observability gap: no Vercel drains configured, no DRAIN_SECRET — log collection blind spot

PLUTO-413 pluto Done

Date input shows mm/dd/yyyy in AR/UY context — find any remaining native <input type='date'> sites and replace with DateDmyField per evolutiva-commons §Date Handling. UX audit item 6.

PLUTO-421 pluto Done

isUserRowSafeToSupersede ignora userAuditLogLegacy frozen — la función bloquea merges válidos por referencia legacy frozen (CR 66). Modificar la función para excluir userAuditLogLegacy de los chequeos.

PLUTO-352 pluto Done

Soft-delete active-view audit: inventory pulldown-source tables vs vActive<Table> policy

PLUTO-433 pluto Done

Vercel CLI scope mismatch — 'vercel ls' resolves to elazar-pimentels-projects, project.json says elazar-pimentel-portfolio (team_WG6Gxa6RLXDjS2DFj3Tp99RV)

PLUTO-415 pluto Done

Historial shows raw archiveReason codes (user:practica:created etc.) instead of human-readable labels. Add label map + render via formatter. UX audit item 10.

PLUTO-425 pluto Done

/practicas/nueva — no abandonment protection; nav away silently discards form. Add beforeunload guard + AlertDialog on route change with dirty state. UX audit item 4.

PLUTO-419 pluto Done

/practicas: mostrar 'Pendiente hace' (días desde que la práctica está sin revisar) y permitir sort por ese campo (referencia: mars /practicas?sort=pendienteHace&dir=asc)

PLUTO-354 pluto Done

Supabase legacy JWT key migration — anon/service_role → sb_publishable_*/sb_secret_* before late-2026 hard cutoff. Mirror mars WI#197. Audit all uses of NEXT_PUBLIC_SUPABASE_ANON_KEY and SUPABASE_SERVICE_ROLE_KEY across env vars, edge functions, and any --no-verify-jwt paths. Ensure no secret-key leak to browser; Authorization header rules; Realtime 24h cap implications.

PLUTO-374 pluto Done

Análisis integral de irregularidades de asignación: alumnos sin studentAssignment, ayudantes sin jtpAyudantes, JTPs sin comisionJtps, adjuntos sin comisionAdjuntos, roles sin asignación correspondiente. Reporte para revisar y limpiar.

PLUTO-351 pluto Done

/practicas: sección 'Todas las prácticas' para docentes (alcance según rol) con paginación 5/10/15/20/25/50/100 (default 25), client-state, no recarga por click, cap de seguridad con fallo verboso

PLUTO-225 pluto Done

isPrincipal toggle on existing adjunto: today only settable at INSERT; need edit/promote/demote action in /administrar/comisiones row context menu (transactional UPDATE clearing other principals). Follow-up to WI#35+36.

PLUTO-395 pluto Done

DRY: encabezados de tabla ordenables (sortable headers) como componente compartido reusable, aplicar a todas las tablas de la app

PLUTO-224 pluto Done

/administrar tables horizontal overflow on mobile — no scroll affordance. Add overflow-x-auto + visible scroll indicator. UX audit item 9.

PLUTO-424 pluto Done

Ruta para Puia: ver usuarios que no han logueado, y quienes no loguean hace >4 días con contador de días

PLUTO-223 pluto Done

Renombrar label 'Ingresó' — confuso, cambiar a algo más claro (probablemente 'Último ingreso' o similar)

PLUTO-350 pluto Done

Migration policy: future SQL migrations that mutate trigger-archived tables (practicas, userRoles, users, periodos, comisiones, studentAssignments, comisionAdjuntos, comisionJtps, jtpAyudantes, accessRequests if added) must SET LOCAL app.user_id = '<system sentinel UUID>' + app.archive_reason = 'system:migration:NNN' before any INSERT/UPDATE/DELETE. Document in pluto-commons + add lint to gitpush-pre.sh.

PLUTO-361 pluto Done

Custom 404: add LLM-copy block to not-found-client.tsx

PLUTO-436 pluto Done

Admin: vista de errores diaria — appEvents kind=error agrupado por día

PLUTO-438 pluto Done

A-pattern Promise.all([rows, count]) sweep — collapse to COUNT(*) OVER() window col, drop second query. Sites: personas-actions:124, admin-actions:411/1137/1200/1266/1458 (6+). Mirror of Mars audit pattern

PLUTO-370 pluto Done ↳ EVO-36

Standardizar el path de envío de emails desde agentes — diseñar API reusable para que cualquier agent (PM-approved one-off, server action, CLI script) use la misma capa, sin re-inventar SMTP cada vez

PLUTO-358 pluto Done

Pre-approval merge detection: form/submit should normalize-match legajo against users to surface existing-account candidates

PLUTO-386 pluto Done

Cátedra naming — page titles + Layout metadata + app header

PLUTO-381 pluto Done

BUG WI#409 regression: auth/callback signOut before /solicitar-acceso redirect causes redirect loop — page requires session that no longer exists

PLUTO-431 pluto Done

Cleanup Preview/Development env entries on Vercel — violates evolutiva-commons §Project (prod-only policy)

PLUTO-412 pluto Done

personas getPersonaDetail UNION ALL fold (4→1 query)

PLUTO-380 pluto Canceled

Soporte parity P4: user-facing /soporte/[id] thread view (currently submit-only). Reporter reads staff replies; append-only thread per vSupportTicketMessages.

PLUTO-220 pluto Done

Down-tier benign PKCE-verifier-not-found at /auth/callback from error->warn (stop non-actionable listener pages)

PLUTO-461 pluto Done

Informes cascading filter dropdowns: comision list narrows to selected adjunto (auto-select if single), JTP narrows to adjunto+comision combo; clear invalidated child selections — Elazar 2026-07-02

PLUTO-468 pluto Done

CR 16: Docente Adjunto principal es jefe de comisión, que se refleje en la App

PLUTO-242 pluto Done

Applog noise: down-tier vuln-scanner probe 404s warn->info (SCANNER_PROBE_RE). 42% of 7d warn-nav rows are scanner-class (wp-*, cgi-bin, .php[0-9], /.env*, /.git, /admin/controller, credential-json, bare /.well-known) across 3 sweeps; all correctly 404 (Next.js, no PHP/WP surface) but mis-tier as warn/navigation -> alert flood. Existing SCANNER_PATH_RE (not-found-classify ~L146) too narrow, caught 0/8 -> supersede with one evidence-anchored SCANNER_PROBE_RE in the L132 down-tier block (info/security/no-alert, drops row). Mirror ICON_PROBE_RE (3c10bb0). Must-NOT-match robots/sitemap/apple-touch-icon/real /admin/*+/api/* routes; unit-test each shape vs matchesAnyRouteTemplate before ship. Security non-event.

PLUTO-442 pluto Done

SCANNER_PROBE_RE addendum to 462: /debug/default/view (Yii2 debug-panel) missed in block K — add 17th alt + re-sweep ≥12:40 for any other tail gap

PLUTO-463 pluto Done

SCANNER_PROBE_RE broadening: 2026-07-01 12:40 UTC sweep (12 distinct probes) leaking to warn — .ssh keys, .svn/wc.db, config.xml, laravel.log, _vti_pvt, config/production.json

PLUTO-462 pluto Done

CR 26: ver si en informe: según rol que por ejemplo en adjunto que pueda ver la comparativa de los grupos de los JTP y si lo veo como titular ver s

PLUTO-252 pluto Done

CR 24: En corrección figura sí, no y como una opción que significa que el jefe no lo vio. por ejemplo se pone en rojo el sí, que se quede transpare

PLUTO-250 pluto Done

PWA install offer: when a phone opens Pluto and the app is NOT installed (not display-mode:standalone), surface a dismissible 'Instalar app' prompt. Android/Chrome: capture beforeinstallprompt, show custom install button -> prompt(). iOS Safari (no beforeinstallprompt): show Spanish instructions banner (Compartir -> Agregar a inicio). Gate: only on mobile, only when not installed, remember dismissal. Verify/complete web manifest (name/icons/display:standalone/start_url) + reuse existing icons (PLUTO-195/196 192x192 + apple-touch). Mobile-only, no desktop nag.

PLUTO-443 pluto Done

CR 17: puede haber n cantidad de adjuntos en una comisión, uno es el principal y otros son secundarios (buscar otro término que no sea secundario).

PLUTO-243 pluto Done

CR 52: /solicitar-acceso debe mostrar logo, colores de la app, versión y resto del chrome (header) igual que el resto de la app. Hoy es Card centra

PLUTO-278 pluto Done

Wire jefe/comision/date filter into remaining /informes stats aggregates: 13 cards (studentRanking, opAsistBalance, inactiveStudents, procedureTypes, complicationRate, dificultadDistribution, trend, crossDay, latency, correlations, practicasPorDocentes, groupBalance, docenteProductivity) still compute catedra/comision-wide; add post-authz filterJtpIds intersection per aggregate (mirror 467 shape). LEAVE comparativa jtp+adjunto, jtpBenchmark, yoy full-scope by design. — Elazar 2026-07-02

PLUTO-469 pluto Done

Shadow-mode 404 skew telemetry (Q3 evidence): log skewSuspected flag-independently on every 404 appEvents row

PLUTO-171 pluto Done

Residual scope edge (follow-up to PLUTO-456): /alumnos + /informes callers FOLD the ?jtp UI filter into the scoped jtpIds array (getPracticas keeps them separate). So a mixed teacher using the ?jtp selector + adjunto scope gets an ungated extra-jtp OR-branch. PLUTO-456's gate-non-null guard kills the worst case (pure-adjunto), but the mixed+?jtp residual remains. SEVERITY PENDING audit ruling: if it lets a teacher see jtps outside their scope via ?jtp it's an over-permissive leak (bump pri); if merely cosmetic/latent keep low. Fix direction: keep the UI ?jtp filter SEPARATE from the authz scope array (mirror getPracticas), gate it against the teacher's actual jtp scope.

PLUTO-458 pluto Done

CR 53: Pedir info refactor: reemplazar el flujo actual de aprobación con un checklist estructurado. Admin elige qué campos faltan (checklist deriva

PLUTO-279 pluto Done

CR 18: Cada intervención debe mostrar claramente quién fue JTP y docente adjunto

PLUTO-244 pluto Done

Apple-touch-icon full set (152/167/180 + precomposed) served as real PNGs — zero iOS install-icon 404s

PLUTO-212 pluto Done

appEvents category model (OWASP-aligned, NO native enum/CHECK) + retention prune-by-category job

PLUTO-5 pluto Done

CR 15: jtp y ayudante son mismos permisos

PLUTO-241 pluto Done

/admin/soporte list rows fully clickable to detail (drop Ver button), reusing practicas-table pattern

PLUTO-213 pluto Done

Email durable outbox (replicate MARS-76): emailOutbox table + pg_cron */5 drain + exp backoff maxAttempts=10 alert@5

PLUTO-11 pluto Done

CR 13: mostrar claramente qué items son obligatorios en carga de cirugía

PLUTO-239 pluto Done

CR 54: /informes "Prácticas por alumno": los filtros globales arriba ya afectan esta sección y los botones Excel/PDF/Correo de la tab son duplicado

PLUTO-280 pluto Done

CR 55: /administrar/docentes: remover el link "Remover" del row del grid; moverlo adentro del popup Editar como acción secundaria. Los usuarios rar

PLUTO-281 pluto Done

CR 19: si uno carga como asistente, No duplica la info?????? si es que ya la cargo el operador... o solo tiene que cargar el operador

PLUTO-245 pluto Done

CR 35: Creo que con esto estamos para largarlo a rodar en términos de CARGA DE ALUMNOS y empezar a analizar como lo ven los JTP, adjuntos y titular

PLUTO-261 pluto Done

CR 36: sebastian.puia@odontologia.uba.ar en https://evolutiva.pensanta.com/practicas/nueva las cosas que tienen * son obligatorias (o una del grupo

PLUTO-262 pluto Done

CR 40: sebastian.puia@odontologia.uba.ar respecto a item 34, "Otras características de la pieza" está como no obligatorio, a tu solicitud, mas aden

PLUTO-266 pluto Done

feat(toast-telemetry): log guardrail toasts to appEvents as toast/error-shown (bs-mqfa6wg9bi8 (b))

PLUTO-133 pluto Done

CR 4: Mostrar edad del paciente

PLUTO-230 pluto Done

Soporte parity P3: admin UI — thread view + reply form + per-row 'Cerrar y notificar'; list pagination(50) + message preview + ruta + ticket# cols. Reuse shared primitives.

PLUTO-219 pluto Done

Collapse /informes 24-query fan-out into one set-based Postgres query (view/RPC)

PLUTO-97 pluto Done

Hard-purge prelaunch mock practicas surfacing in /practicas Historial de cambios

PLUTO-1 pluto Done

CR 1: Tipografía y logos similares a la facu

PLUTO-227 pluto Done

CR 48: Colores avatares: Cambiar a color por JTP

PLUTO-274 pluto Done

CR 56: Sidebar /admin: dejar solo el link "Admin"; remover sub-links "Usuarios", "Solicitudes", "Opciones", "Registros". La navegación interna se h

PLUTO-282 pluto Done

Real-time pm_triage: add body<=300 to fn_notify_pm_triage supportTicket payload so the generalized daemon composer can render ticket body (accessRequest already carries solicitud<=500); UUID-convergence NOT needed for Pluto (compose backstop per bs-mqp7t8lng66 decision)

PLUTO-199 pluto Done

Gmail dot-canonicalization gap: 51 students users.email (dotless) != auth.users.email (dotted); preRegistered lookup uses lower(trim) not canonicalizeEmail

PLUTO-152 pluto Done

feat(soporte): copy mars soporte into pluto

PLUTO-132 pluto Canceled

Weekly PM triage report: emit open-tickets + open-solicitudes summary on pm_triage (kind:weeklyReport) from practicas-kpi-report cron

PLUTO-198 pluto Done

Disable never-logged-in students (year-end) so they drop from reports + regular screens

PLUTO-147 pluto Done

CR 51: /solicitar-acceso: los docentes completan campos pensados para alumnos (comision/jtp/adjunto), lo cual confunde y demora la aprobación. Move

PLUTO-277 pluto Done

Stage 4: Comisiones + Períodos grids — operational editing en el mismo workspace style

PLUTO-342 pluto Done

CR 46: Mostrar apellidos en vez de nombres en tablas/avatars

PLUTO-272 pluto Done

Notification email: malformed link URL (trailing \n in NEXT_PUBLIC_APP_URL) + label/route mismatch

PLUTO-8 pluto Done

SC 500 on /admin/solicitudes/[id] — getAccessRequestMergeCandidates throws on NULL legajo (untyped $2 IS NOT NULL)

PLUTO-2 pluto Done

Events-table hygiene review (last 24h): labeling correctness, keep-vs-drop per event type, recent-events view

PLUTO-3 pluto Done

appEvents views: add semantic vAppEventsRelevant24h (deduped, all-levels) + consolidate 6 redundant LIMIT-N error views + schema.md; drop import% workaround in vAppErrorsRecent after source fix

PLUTO-4 pluto Done

Solicitud detail: relabel id field to 'ID de Solicitud de ingreso' + make id a self-link (cross-app UI tweak, Elazar via pm-mars)

PLUTO-6 pluto Done

Solicitud form: require comision + adjunto (mandatory pulldowns) for teacher-role access requests — block submit without them (client + server validation)

PLUTO-7 pluto Done

Práctica create: empty-date string reaches DB (invalid input syntax for type date)

PLUTO-9 pluto Done

Audit all DateDmyField required usages: required is inert on hidden input, each caller must validate explicitly

PLUTO-10 pluto Done

Fix timezone hydration flash: replace bare toLocaleString/toLocaleDateString (no timeZone) with formatDateTimeEsAr/formatDateEsAr from date-format.ts across 8 files

PLUTO-12 pluto Done

Fix Gmail Android /n/ prefix: add next.config redirect /n/:path* → /:path* (preserve query params)

PLUTO-13 pluto Done

KPI cron sends N duplicate emails per recipient with multiple comision memberships — deduplicate per recipient before sending

PLUTO-14 pluto Done

Proxy viewport tooling: chrome-devtools-mcp (CDP) for Pluto needs an auth path — Pluto is OAuth-only

PLUTO-47 pluto Canceled

Fix 500 on /informes?adjunto= — getComparativaBundle jtpExtra param pushed unconditionally when wantJtp=false

PLUTO-15 pluto Done

Pluto P2: send-email in-memory rate limiter resets on cold start — persistent store or document dedupeKey as throttle

PLUTO-20 pluto Done

CR 37: ok. Tecnica quirugica, nacionalidad y ciudad debe ser obligatorio., el resto esta perfecto.

PLUTO-263 pluto Done

Pluto P2: updateEstadoRevision post-commit email-throw → false 'Error' on committed grade + dup review/email — add inner try/catch

PLUTO-19 pluto Done

Pluto P2: isDemo-in-archive-trigger time-bomb (fn_archivePracticaChange + fn_archivePracticaReviewChange) — convert to to_jsonb (MARS-78/88 class)

PLUTO-18 pluto Done

Pluto P2: edit-lock cols (006/007) added to practicas but not practicasArchive/trigger — edit-lock state unarchived

PLUTO-21 pluto Done

Pluto P2: missing indexes practicas.assignmentComisionId + comisiones.periodoId

PLUTO-23 pluto Done

Pluto: logger info-gate drops isCritical events before force-sync + prod LOG_LEVEL=1 = security-observability hole. logger.ts:83-85 early-returns (skips appEvents INSERT) for level=info when logLevel<3, BEFORE the isCritical force-sync block (:119-124, auth/authz+forceSync = must-persist). Prod LOG_LEVEL empty→parseInt=1<3, so ALL info events (incl. info-level auth/authz security signals that pluto-commons retains >=365d) are NOT persisted in prod. Two-part fix: (a) code — exempt isCritical (auth/authz/forceSync) from the info-gate so security events always persist; (b) ops — decide prod LOG_LEVEL>=3 (Elazar/Vercel env, also unlocks PLUTO-24 nav-event queryability). Found via PLUTO-24. Needs audit severity-confirm (how many live security events are info-level vs ERROR per PLUTO-25) before Elazar escalation. logger.ts = coder lane.

PLUTO-33 pluto Done

Pluto P2: accessRequests.status unconstrained text — add CHECK IN (pending/needs_info/approved/rejected)

PLUTO-22 pluto Done

Pluto: Supabase free-plan egress fix (backup 30min→8h + data-only ephemeral excludes) + DB hygiene (notifications TTL, cron.job_run_details prune, drop stray bench schema)

PLUTO-37 pluto Done

Serve /apple-touch-icon.png (Elazar-provided asset) to kill recurring apple-touch-icon page_not_found noise

PLUTO-196 pluto Done

__probe__

PLUTO-48 pluto Canceled

KPI cron (Vercel) silent since 2026-06-08: no kpiCronReport appEvent on Jun 9/10/11 — daily comisión reports missing

PLUTO-39 pluto Done

pg_cron pluto-drain-email-outbox fails 674/674: schema "net" does not exist (pg_net not installed)

PLUTO-38 pluto Done

Investigate clientError:error (101 events / 20 distinct users) + access-denied UI link-leak

PLUTO-55 pluto Done

404: /administrar/docentes/[id] dead link from /admin/solicitudes (live, 3 real-user hits)

PLUTO-52 pluto Done

Blind logging: capture detail in practicaCreateFailed, user-context in serverError, email in loginDeniedNoProfile

PLUTO-54 pluto Done

Onboarding: allowlisted-but-no-profile users (loginDeniedNoProfile) should be routed to request access, not dead-bounced

PLUTO-56 pluto Done

KPI & N-optimization initiative — Pluto participation

PLUTO-156 pluto Canceled

CR 60: accessRequests sin archive trigger. Aprobaciones/denegaciones/ediciones de admin no dejan snapshot histórico. Agregar accessRequestsArchive

PLUTO-286 pluto Done

CR 61: lookupOptions y systemSettings editables en runtime sin archive. Un admin puede cambiar etiquetas de lookup (estadoRevision, tipoDocumento,

PLUTO-287 pluto Done

Suppress operator-alert email for domain-denied login (keep /solicitar-acceso redirect + info/authz audit row)

PLUTO-464 pluto Done

Toast to appEvent UX-friction capture (port Mars pattern + Pluto deltas)

PLUTO-64 pluto Done

Serve a real robots.txt (disallow-all) to kill recurring /robots.txt page_not_found noise

PLUTO-195 pluto Done

fn_detectRateSpike index-starved: add archivedAt indexes to 6 archive tables (32% of DB time)

PLUTO-62 pluto Done

appEvents logging-coverage + severity-correctness remediation (audit-pluto scan)

PLUTO-72 pluto Done

Historial de cambios: full-width component + CAMBIOS column not truncated; audit surveys all change-history tables, coder fixes the set

PLUTO-79 pluto Done

numeroHC edit UI/server permission mismatch: canEditHC UI offers HC-edit to all teachers but server gate always denied non-participant/non-admin teachers (latent assignmentComisionId-never-selected bug); decide intended HC-edit permission (enable graders via canGradePractica vs drop isTeacher from UI canEditHC)

PLUTO-80 pluto Done

F-3: practicaCreateFailed 9 hits Jun 3-4, detail=null (error thrown but not captured into logEvent). Add error-detail capture to the practica-create failure handler, then identify+fix the underlying create failure (check git log ~Jun 3 for practica changes).

PLUTO-76 pluto Done

Page title prefix: 'BMF 1 | <page>' -> 'P | <page>' (layout.tsx template literal; do NOT touch CATEDRA_SHORT which drives email branding)

PLUTO-110 pluto Done

Unauth RSC hit to protected /practicas/<non-uuid> returns 500 instead of 403/redirect/404

PLUTO-177 pluto Done

client-error serializer: global-error.tsx/error.tsx + logClientError discard error.message/name/stack — appEvents clientError rows are opaque ({path,digest:null}), undiagnosable. Forward message/name/stack(trunc ~2KB) like venus VENUS-8 fix. Surfaced by applog: 1 crash @/mi-cursada + 3 @/login (anon, ~28s cluster, possibly stale-deploy Server-Action-not-found).

PLUTO-83 pluto Done

Admin 'Ver como [usuario]' view-as: read-only impersonation of ANY docente (not just owned personas) so admin sees a teacher's exact PLUTO-77-scoped view. Separate viewAsUserId cookie, admin-cap-gated startViewAs/stopViewAs, getCurrentUser resolves target (isViewAs, realUserId=admin), single read-only guard at requireAuthForAction (blocks all writes), benign view-load writes (markComentarioNotificationsRead) no-op under view-as, red banner + Volver a mi cuenta, start/stop audit-logged (authz). No schema change. Scope/grade-gates unchanged. Authz-sensitive: audit design-review + pre-push diff.

PLUTO-84 pluto Done

/alumnos?verComision=N shows '(día)' instead of the comisión name

PLUTO-86 pluto Done

Remove inline grade dropdown from prácticas list; per-row button: Calificar (sin calificar) / Ver detalles (graded), both route to detail view so teachers grade only after seeing content

PLUTO-87 pluto Done

Teacher login landing → /practicas (was /informes) for docente_* roles; default-sort the prácticas list by Pendiente hace (días) desc so oldest-pending surfaces first. Keep reportes→/informes, admin/alumno/bedelia unchanged

PLUTO-88 pluto Done

/alumnos: clicking the student NAME does nothing; clicking elsewhere on the row navigates to /practicas?alumno=<id>. Name click should navigate too (likely hover-card/link swallows the click)

PLUTO-90 pluto Done

createPractica duplicate-prevention guard (2-tier): TIER1 same fecha+operador+asistente+pieza → hard redirect to existing práctica (no override); TIER2 same fecha+same 2 people swapped roles → soft dialog ir-a-existente vs crear-nueva. Idempotent return-existing, not 500

PLUTO-89 pluto Done

App-wide recurrence of PLUTO-90: clicking a student/user NAME in a clickable row does nothing (hover-card trigger stopPropagation+preventDefault swallows the click) while clicking elsewhere in the row navigates. Seen on /practicas?jtp=...&comisiones=.... Audit to enumerate every table/list with name-inside-trigger pattern; coder fixes each to bubble name-click to row onClick.

PLUTO-92 pluto Done

/informes pool-acquire timeout: page fires ~24-query Promise.all (page.tsx:219-346) against deliberate pool max:2 / connectionTimeoutMillis:5s (pool.ts:11-17, WI#194 serverless conn-storm tuning). Heavy comisión (…006) drain >5s → trailing waiters throw 'timeout exceeded when trying to connect'; client echo surfaces Next digest 1177967776. Reproducible on any heavy comisión filter. Fix: bounded-concurrency wrapper on the fan-out (app/coder) and/or modest pool bump (db owns, trades vs conn-storm). 2 events/30d but reproducible.

PLUTO-93 pluto Done

Roster mutations audit trail completion para comisiones/períodos

PLUTO-340 pluto Done

/solicitar-acceso fully broken: every access-request submission 500s. chk_accessRequests_requesterRole CHECK allows only legacy ('estudiante','docente','otro') but PLUTO-7 changed requesterRole to literal DB role names (SELF_REQUESTABLE_ROLES: alumno/docente_adjunto/docente_jtp/docente_ayudante_primera). Constraint never migrated w/ PLUTO-7 → all new submissions violate it. Real user cecilia.tebes blocked+retried (appEvents submitAccessRequestFailed 18:51 UTC). FIX (db): drop the CHECK (commons bans CHECK on enumerated label sets = native-enum-in-disguise; app already validates via isSelfRequestableRole) OR union legacy+new (49 legacy rows must not trip ALTER). Audit pre-reviews DDL. PUBLIC FRONT DOOR.

PLUTO-94 pluto Done

CR 38: Pieza dentaria porque no permite simular la carga.

PLUTO-264 pluto Done

Raw error text in HTTP response/UI — sanitize + log eventId (5 sites: log-404:45, cron/drain-email-outbox:34, api/image/[id]:76, administrar-actions:1527/1648). Return generic message + logged eventId, never raw err.name/message/String(err). From P0 cross-team error-handling audit, rubric #5.

PLUTO-95 pluto Done

CR 65: Crear practicaReviews log table (patrón mars): una fila por evento de revisión (practicaId, reviewerId, oldEstadoRevisionId, newEstadoRevisi

PLUTO-291 pluto Done

CR 66: Agregar campo comentario por evento de revisión en practicaReviews (depende CR 65). Hoy observacionesOperador vive en practicas (un slot mut

PLUTO-292 pluto Done

2 OAuth-completed users (ale98gaete, veronica1994rios) have authId NULL despite successful Google sign-in (Apr-25/May-03 2026) — SEPARATE from PLUTO-152 dot bug (their email is dot-free, raw=canonical). authId-write never reached/failed in the Apr-May callback version; active alumno roles; no appEvents auth errors in their sign-in windows. db heal-check pending: does current callback auto-link on next login (benign) or is it a live stuck-account bug

PLUTO-155 pluto Done

Operational columns en /admin/usuarios — authId linked, lastLoginAt, diasInactivo

PLUTO-331 pluto Done

Detail modal stale-data fix — fetch-on-open

PLUTO-330 pluto Done

/admin/usuarios server-side data model — reemplazar filtering client-only

PLUTO-328 pluto Done

Bridge CTA: from /admin/usuarios/[id] Roles card deep-link to /administrar/docentes/[id] (teaching role) + /administrar/alumnos/[id] (alumno) when that role is present

PLUTO-109 pluto Done

Row-click admin lists: make full row clickable on /administrar/alumnos, /admin/solicitudes, /administrar/docentes (shared admin-table onRowClick/rowHref; soft-deleted alumnos no-nav keep Restaurar; docentes dropdown preserved via stopPropagation; SKIP /admin/usuarios checkbox conflict). Elazar-approved 'all but the checkbox one'. Sibling of PLUTO-213 (soporte row-click, shipped c53d875).

PLUTO-214 pluto Done

Venus R2 findings (fec7fc4, none high): R2-1 send-email 502 path leaks raw err.message (email-admin.ts:156→route.ts:126); R2-2 reviewUserDocumento (admin-actions:318) raw leak + NO logCaughtError (silent); R2-3 reactivateInactiveUser (admin-actions:1211) same; R2-4 LOW consistency (email.ts:483/legacy-export:145/poll-security-alerts:205 logged-first); R2-5 LOW getInactiveUsersPage:1147 bounded per-row subquery. Apply UserFacingError gate + logCaughtError to the MED leaks.

PLUTO-114 pluto Done

Venus R2 Dim-8 perf findings (fec7fc4, read-only — db must EXPLAIN-verify each on live plans before fix; rank by absolute ms/day not label). HIGH: F1 adjuntoNames correlated subquery ×270 (vActiveRoster + vPracticasHierarchyRollup + getPracticasTeamStats queries.ts~1840) → pre-agg CTE/LEFT JOIN; F2 getDocenteProductivity MIN(createdAt) correlated subquery ×118 (queries.ts~1698) → reviewDates CTE; F3 missing btree practicaReviews.practicaId → CREATE INDEX CONCURRENTLY; F4 vUserLastLogin appEvents full-scan every admin page → partial idx (actorUserId,createdAt DESC) WHERE category=auth AND action=login. MED: F5 getCorrelationReport nested correlated (~1785); F6 getYoyComparison 6 scalar correlated → conditional agg. LOW: F7 getAnomalyReport UNION-ALL opportunity (~1450); F8 vUsersWithRoles 3 correlated/user (admin-only).

PLUTO-115 pluto Done

Supabase security+logs analysis sweep (Elazar directive, all 3 apps): db agent pulls Supabase security advisor + logs (postgres/auth/api/storage/edge-function) and ANALYZES them - triage real signals (auth anomalies, error spikes, slow queries) vs known infra noise (JWKS, PostgREST probe, pool churn). Periodic DB-hygiene sweep per evolutiva-commons. Report findings to PM for consolidated report.

PLUTO-123 pluto Done

/alumnos/[id] paginación cursor en lugar de fetch de 500

PLUTO-298 pluto Done

/informes filter dropdowns liviano — getAdjuntosForPeriodo / getJtpsForPeriodo

PLUTO-297 pluto Done

search_path hardening migration: pin SET search_path on all 36 public functions (function_search_path_mutable lint 0011). Behavior-preserving (most ref public -> SET search_path = public; do NOT use '' on any fn referencing public objects unqualified - verify each resolves identically). Additive/reversible. 0 SECURITY DEFINER fns so risk near-zero; Elazar greenlit anyway for a clean advisor. Audit pre-apply (schema DDL) -> apply -> db:export -> push via db exception lane.

PLUTO-122 pluto Done

CR 25: Unificado con 24

PLUTO-251 pluto Done

Email deliverability: Pluto-specific spam deltas vs mars/venus (from-identity noreply-class + 'BMF 1' display, text-only not multipart, Reply-To mismatch). F1 named-from, F2 auto-render html multipart (standing Elazar rule), F3 align Reply-To. Audit report audit-pluto-cc-mqdhup806iis.

PLUTO-131 pluto Done

Capability-aware UI controls — gate toggles por caps reales

PLUTO-336 pluto Done

Supabase Disk-IO budget alert (2026-06-15) disposition: reads clean (99.96% cached). Two analyses diverge on write driver — (1) */2 rate-spike cron churn vs (2) one-time Jun-14 PLUTO-128/130 DDL burst + pg_dump catalog walks. Discriminator = IO graph shape (spike=one-time self-clearing; plateau=cron lever PLUTO-67). GATED on Elazar interval ruling if plateau. No compute upgrade warranted.

PLUTO-134 pluto Done

vPracticasCompletas demasiado ancho para listas — query liviana para tabla /practicas

PLUTO-296 pluto Done

Bedelia role capability audit — capability matrix + verificar implementación

PLUTO-334 pluto Done

DB-perf collector — Pluto app leg (fleet bs-mqg1357zx6m decision): provide Pluto's leg of the evolutiva-dbperf@pluto snapshot+diff collector. (1) dbperfSnapshots table via migration — PARITY with venus's canonical schema (get the DDL + 4-query set from db-venus/pm-venus so all 3 apps match byte-for-byte, like the applog rail); telemetry-table discipline (NO archive-context, short retention prune mirroring appEvents). (2) GRANT the existing applog least-priv reader role SELECT on the snapshot table + the catalog/stat views the 4 queries read (cache / pg_stat_statements top-50 / seq-scans / dead-tuples). (3) hand nw-venus the reader-grant confirmation so it can stand up the systemd timer (daily 04:30 ART → biweekly → monthly). Reversible: drop table + disable timer. Coordinate schema parity with venus BEFORE applying.

PLUTO-140 pluto Done

practicas/[id]: make practica title a permalink + 'Copiar link' button with 'copiado' toast

PLUTO-207 pluto Done

PWA install-completeness: close iOS/standalone gaps so Pluto installs cleanly on iPhone(Safari A2HS), Android/Chrome, Mac(Safari Add-to-Dock + Chrome), Windows/Linux Chrome/Edge. layout.tsx metadata: add appleWebApp{capable,title:Pluto,statusBarStyle:default} + repoint icons.apple to existing public/apple-touch-icon-180x180.png (currently the maskable icon-192 = cropped on iOS) + optional mobile-web-app-capable; verify SW (/sw.js) registration+scope. Additive/reversible, no schema/auth/email. Firefox desktop = no PWA install (Mozilla removed), documented not chased.

PLUTO-441 pluto Done

verify live pg_cron appEvents-retention-prune allowlist includes category=malicious in the >=365d security class (commons documents it; malicious is brand-new to appEvents, audit could not confirm the job covers it) - if absent, rows from PLUTO-182 age out at default 90d; fix via migration if drift

PLUTO-185 pluto Done

Adopt fleet viewport/client-env telemetry standard (Elazar directive 2026-06-20): capture ONCE PER LOGIN (not per-page/per-tuple, low volume), store role[] on the row + viewportWidth + orientation to appEvents. Pluto currently has ZERO viewport telemetry (no capture code, 0 rows 30d). Converge on Mars's schema (reference impl). Enables the docente/admin/stakeholder viewport x role cohort number that Pluto could not produce for bs-mqmxqxwop02. Coordinate column/category names with mars+venus so all 3 are uniform.

PLUTO-163 pluto Done

practicas/[id]: show JTP (standard display name) above the Comentario field

PLUTO-205 pluto Done

benign well-known automated probes 404 as [warn] and page Elazar (e.g. /.well-known/assetlinks.json) - down-tier known benign well-known paths to info/navigation/no-alert; distinct from PLUTO-182 malicious-scanner class

PLUTO-184 pluto Done

Floating support button (FAB) cloned from mars, wired to Pluto /soporte support action

PLUTO-197 pluto Done

supautils force-grant census: public functions holding EXECUTE outside their allowed set (R6 forbidden-set read, inventory only)

PLUTO-785 pluto Backlog low

Orphaned active userRoles survive user soft-delete (hygiene)

PLUTO-639 pluto Blocked low

└─ Restore soft-deleted users with explicit role regrant decision

PLUTO-783 pluto Backlog

no demo/seed exclusion mechanism exists - vPracticaParticipantFacts cannot exclude demo prácticas from scoped teacher stats

PLUTO-103 pluto Backlog low

Add value/codigo machine-key column to lookupOptions

PLUTO-551 pluto Backlog low

Audit + sync prod public-fn DDL drift to checked-in migrations (search_path pins) — pluto mirror of venus EVO-8

PLUTO-153 pluto Backlog low

PLUTO-139 outcome: add 6 scope-join FK indexes, drop 2 zero-scan indexes, retire the dead isUserRowSafeToSupersede fn

PLUTO-724 pluto Backlog low

fn_notify_applog_err COALESCEs userAgent to empty string in NOTIFY payload

PLUTO-770 pluto Done low

Practicas teacher-mode scopeCheck asserts roster membership, not role - same hole PLUTO-510 closed on the student path

PLUTO-739 pluto Done low

Harden migration dry-run tooling against embedded COMMIT/BEGIN

PLUTO-582 pluto Done low

PLUTO-184 benign-platform 404 suppression has never worked: assetlinks.json has written 1325 info/navigation rows since 2026-07-08 under a documented zero-row design

PLUTO-777 pluto Done low

pluto-commons.md archive-trigger count: 23 measured as 24, and the literal count removed rather than incremented

PLUTO-776 pluto Done low

Google App Links verification has 404ed on /.well-known/assetlinks.json 1285 times across 91 consecutive days

PLUTO-758 pluto Canceled low

Pluto P3: vPracticas* views don't filter isDemo — demo inflates grader stats (fix at vPracticas base)

PLUTO-29 pluto Done low

Practica: no path to remove an asistente (swap-only participant change)

PLUTO-744 pluto Done low

└─ Port Terra's participant-dispute mechanism to Pluto (replaces building a removal kind)

PLUTO-763 pluto Backlog low

primaryRoleId column-write invariant: remove direct writes + real enforcement

PLUTO-669 pluto Done low

Seed lookupOptions appEventCategory rows for toast/monitoring/input (app-side union fixed in PLUTO-148; seed still at migration 008's 7 values)

PLUTO-727 pluto Done low

PLUTO-91 db half: practicas_live_natural_key_idx must key on the CANONICAL pieza set, not the raw typed string (permuted-order duplicates still win the concurrent race)

PLUTO-728 pluto Done low

fn_detectRateSpike cadence: every-2min cron is 91% of DB-time (frequency-driven, ~7.6s/day absolute) - weigh fraud-detection latency vs cost

PLUTO-67 pluto Done low

Convenience VIEW joining clientError.digest -> serverError.detail (full message+stack) for client-error diagnosis

PLUTO-59 pluto Done low

Pluto P3: cold audit FK cols (createdBy/updatedBy) unindexed — defer to post-go-live advisor run

PLUTO-31 pluto Done low

Pluto P3: periodos.isCurrent no uniqueness constraint — two isCurrent=true rows possible

PLUTO-30 pluto Done low

fn_getInformesBundle comparativaAdjunto missing p_adjunto_comision_ids/p_comision_ids commission filter

PLUTO-572 pluto Done low

Force-red-test PLUTO-714's notify_failure() content-check alert path

PLUTO-760 pluto Done low

sendTeacherReportByEmail sent-count overstates after egress filter

PLUTO-759 pluto Done low

db:export silently depends on unset DATABASE_URL, only DATABASE_URL_DIRECT is populated

PLUTO-701 pluto Done low

Google has been fetching /.well-known/assetlinks.json 1275 times over three months and getting a 404 every time: an Android App Links association is declared against pluto and has never verified

PLUTO-757 pluto Backlog low

Alert email bodies show 12-hour clock without AM/PM

PLUTO-750 pluto Backlog low

EVO-70 Tier 1 follow-up: retire app after() calls (gated on passive prod evidence)

PLUTO-615 pluto Blocked low ↳ EVO-70

practicas.numeroHistoriaClinica NOT NULL - make the eq#61 rule structural

PLUTO-737 pluto Done low

practicas.numeroHistoriaClinica non-blank + trimmed CHECK, and clean the one untrimmed row

PLUTO-738 pluto Backlog low

Solicitudes: evaluate+fold net-new features into Pluto from mars/venus (brainstorm bs-mr4h5azsk3g)

PLUTO-477 pluto Backlog low

Adopt curated repo-visible knowledge .md for Pluto agent team (bs-mr3bt2c0vgy consensus)

PLUTO-470 pluto Backlog low

Investigate stray uncommitted .agent-name change in solo-pluto team tree

PLUTO-562 pluto Backlog low

Proxy viewport tooling: chrome-devtools-mcp (CDP) for Pluto needs an auth path — Pluto is OAuth-only

PLUTO-51 pluto Backlog low

Advisory (low pri): enable auth_leaked_password_protection (HaveIBeenPwned check) in Supabase auth — currently disabled. Low value for Pluto (allowlist-only, no open signup) but a free defense-in-depth toggle. From PLUTO-123 security sweep.

PLUTO-125 pluto Backlog low

Shared push-tree same-file concurrent-edit handoff protocol

PLUTO-683 pluto Backlog low

Consume venus-side applog cursor-age instrument (report pluto's rail age)

PLUTO-651 pluto Backlog low

Applog burst-dedup: duplicate event ID replay within 60s synthesizes x2 burst

PLUTO-650 pluto Backlog low

User-facing self-suggestion surface (is-this-you link-to-existing)

PLUTO-622 pluto Backlog low ↳ EVO-79

Pluto Historial change-history panels: audit gap + build (HOLD for Elazar go)

PLUTO-531 pluto Backlog low

Logging-hardening: clientError:global-error rows persist with EMPTY detail (no digest/errorName/message/route) — un-diagnosable from appEvents alone. Capture digest+message+route at the global-error boundary so future global-error volume is triageable. Low-pri; only escalate if global-error volume rises (currently sparse/benign: 2-4/day transient).

PLUTO-221 pluto Backlog low

Admin landing storage tile (GB-left/% of 25GB)

PLUTO-605 pluto Done low ↳ EVO-58

/practicas global-landing student picker: lightweight id/nombre/apellido-only query

PLUTO-509 pluto Done low

Down-tier callbackMissingCode error→warn at /auth/callback (bare-callback bot/consent-cancel hits, PLUTO-461-class) — only if it recurs at volume; 1 all-time hit as of 2026-07-02

PLUTO-466 pluto Done low

Add close/resolve-via-API support endpoint

PLUTO-501 pluto Done low

Lint guard: forbid non-async-function exports in "use server" modules (gitpush-pre)

PLUTO-492 pluto Done low

appEvents double-logging inflates error-cluster counts ~2x

PLUTO-481 pluto Done low

Gate-correct 403 denials logged at level=error inflate error telemetry

PLUTO-482 pluto Done low

Pluto P3: denyAccess UUID-in-URL + deny-vs-404 — practica-existence probe

PLUTO-28 pluto Done low

Pluto P3: getCurrentPeriodoId + getComisionesForCurrentPeriodo no auth guard — comision enumeration

PLUTO-27 pluto Done low

Quiet well-known-path 404 noise (robots.txt, apple-touch-icon[-precomposed].png) in page_not_found telemetry

PLUTO-181 pluto Done low

PLUTO-89 fast-follow hardening: multi-pieza dup-guard is order-sensitive ('11,12' vs '12,11' evades tier-1 because piezas keep insertion order). Canonicalize the pieza set for the dedup KEY only (sorted), preserving as-entered display/storage order. Needs functional index or normalized key column

PLUTO-91 pluto Done low

Pluto P3 residual: bulkInviteUsers welcome-email loop bypasses the /send-email HTTP rate limiter (PLUTO-20) — uncapped in-process sends on bulk invite. Decide cap (e.g. 100/batch or inter-send delay) vs accept (admin-initiated, low-freq, in-process-mail-undroppable per PLUTO-20 design). From audit round-1.

PLUTO-32 pluto Done low

KPI weekly-cron staleness alert: last-success-timestamp check that pages if no kpiCronReport appEvent in >8 days. Weekly crons (0 9 * * 1) can fail silently for ~7d before anyone notices (PLUTO-39 showed how easily a weekly gap reads as 'dead'). Defensive observability add, NOT a bugfix. Touches email/alert path → audit pre-push.

PLUTO-45 pluto Done low

Pool saturation makes its own telemetry unreliable (partial evidence during incidents)

PLUTO-695 pluto Done low

appEvents off-schema categories: 'toast' (53) + 'admin' (3) not in valid category list; logging hygiene

PLUTO-148 pluto Done low

log-toast ingest: no server-side rate limit (anon-flood appEvents amplification)

PLUTO-66 pluto Done low

Schema-qualify the six unqualified fn call sites landed in orphan slices C and D

PLUTO-686 pluto Done low

Comentario-notification emails: Reply-To header contradicts body copy

PLUTO-711 pluto Done low

Apply standardized nextUrlPresent comment (UNVERIFIED corroboration, KEEP not drop) in 404 skew telemetry - comment-fix only

PLUTO-178 pluto Done low

404 telemetry anomaly: 7-row burst is nextUrlPresent=TRUE with clientBuildId=NULL - the exact inverse of the 12-row confirmation set, unexplained

PLUTO-726 pluto Backlog low

404 telemetry: isSoftNav keys on sec-fetch-dest=empty, which any fetch() sets - scanner traffic confirmed misclassified as soft-nav (5 of 29 rows)

PLUTO-725 pluto Backlog low

UX: pre-filter practica list-row links by viewer scope so out-of-scope rows aren't clickable (avoids working-as-designed scope-deny on /practicas/[id])

PLUTO-57 pluto Done low

Consolidate ELAZAR_RECIPIENT constant (ux-pain-digest.ts / error-digest.ts) into one shared export

PLUTO-709 pluto Done low

DB-health sweep follow-ups (from PLUTO-138, non-urgent): (1) verify practicas.idx_practicas_editlocked query path — drop if genuinely cold; (2) confirm userAuditLogLegacy table is retired → archival candidate (table+idx); (3) FK-usage audit: of 64 advisor-flagged unindexed FKs, identify which appear in live WHERE/JOIN (hot) vs audit/write-path (createdBy/deletedBy/archivedBy — leave cold), index only the hot ones via migration w/ archive-context. Don't index/drop blindly — query-path verify first.

PLUTO-139 pluto Done low

PLUTO-529 client friction-telemetry leg: un-stub notifyFriction + wire checkRequired (post-Jul-10, server-action transport)

PLUTO-535 pluto Done low

Roster CSV import is an unexercised bulk write path against trigger-archived tables - zero prod executions ever

PLUTO-721 pluto Done low

Burn down the 34 baselined Button className overrides (PLUTO-719 follow-up)

PLUTO-720 pluto Done low

Harden intentional info-level appEvents streams against LOG_LEVEL changes (generalizes PLUTO-182's forceSync pattern). Today these persist ONLY because prod LOG_LEVEL=3 disables the logger.ts:98 info-drop gate — none pass forceSync, so lowering LOG_LEVEL (e.g. someone treating 3 as debug noise) would SILENTLY kill the email audit trail + telemetry. Promote to forceSync:true at the call sites so they're LOG_LEVEL-independent: email/email-sent + email/sendAdminEmail (audit trail), client-env/viewport (PLUTO-163), navigation/practica-link-dead, cron audit (pollSecurityAlerts, kpiCronReport, kpiCronSkipRecipient, ux-pain-digest), monitoring/applogListenerHeartbeat. After this, LOG_LEVEL becomes a true verbosity dial (incidental noise only) with no collateral audit-trail loss. EXCLUDE benign well-known + nav page_not_found (we WANT those droppable). Verify with db whether forceSync is a stored appEvents column or purely a logger control flag (affects how to audit coverage).

PLUTO-190 pluto Done low

PLUTO-700 follow-up: live confirmation the retired 10-arg fn_insertSupportTicket shape stays unused - one authenticated browser /soporte submit against the shipped build, then db-pluto-cc reads pg_stat_statements (11-arg queryid rises, 10-arg does not)

PLUTO-716 pluto Backlog low

Benign SEO-crawler sitemap-probe 404 noise: a crawler walks sitemap filename variants (/sitemap_index.xml, /sitemap-index.xml, + a random catch-all-200 test token /_rNd9xZ7kL3) — all correctly 404 (Pluto is auth-gated, no public index surface) but log warn/navigation/page_not_found. Two-part: (1) decide the correct SEO posture — Pluto has nothing public to index, so likely robots.txt Disallow + NO sitemap is right (confirm whether /sitemap.xml exists/should); (2) down-tier benign sitemap/SEO-crawler probe 404s to info, mirroring ICON_PROBE_RE (3c10bb0) / SCANNER_PROBE_RE (PLUTO-442) in not-found-classify. EVIDENCE-GATE the down-tier: audit quantifies frequency over the applog digest/7d BEFORE implementing (per PLUTO-442 discipline + WELLKNOWN_BENIGN_RE caution against speculative benign-matcher broadening). Anchor only to exact sitemap filename shapes; the random token is NOT safely down-tierable. Low-pri.

PLUTO-445 pluto Done low

404 classifier: preview-crawler traffic is a third class, decide handling

PLUTO-690 pluto Done low

User contact profile split — userProfile 1:1 table para campos opcionales

PLUTO-325 pluto Deferred low

Large-screen sales-surface polish: add xl/2xl density tiers (more grid cols / master-detail / side-rail filters), data tables over stacked cards, ~40-48rem line-length cap on prose+forms, persistent sidebar + fluid type >=1280 + responsive imgs. Scope: /informes + KPI dashboards + /admin tables + public landing ONLY. Does NOT touch alumno (PLUTO-159) or docente grading mobile-first paths. Verify via proxy pixel-confirm at 1920/2560. Ship-timing = Elazar's call (low current N). From bs-mqmxqxwop02 decision.

PLUTO-162 pluto Backlog low

db/schema.md omits function bodies, so it cannot answer what is installed for any fn

PLUTO-704 pluto Backlog low

PLUTO-34 contract step: DROP flat columns on 7 archive tables after jsonb expand verified in prod (irreversible)

PLUTO-65 pluto Backlog low

Phase-2 demo cleanup (BLOCKED on demo-row purge): strip the now-unneeded demo filters/labels/tab once Elazar purges demo rows. These are PROTECTIVE while rows exist — removing earlier leaks demo data into real reports. Sites: admin/page.tsx:11 (@demo pendingUsers filter), informes/page.tsx:117-121 + practicas/page.tsx:139-142 ('Demo ' comision filter), admin-user-detail.tsx:68/127 + audit-log.tsx:122 (isDemo/demo_seed label map), complication-rate/dificultad-distribution/procedure-type cards '(no demo)' text, admin/usuarios 'Usuarios demo' tab. Coupled to PLUTO-118 phase-1 + the row purge.

PLUTO-120 pluto Backlog low

PKCE callbackExchangeFailed: add benign-vs-attack discriminator (volume-gated, no action yet)

PLUTO-698 pluto Backlog low

Comisión-remainder section is read-only but canGradePractica permits grading it — affordance and permission disagree

PLUTO-687 pluto Backlog low

Migrate all touch primitives (Button/Select/Input) to uniform pointer-coarse:min-h-11 for 44px touch targets — replaces the 3-way convention (Button h-11 sm:h-9 / Select flat h-11 / Input sm:-gated); keys on input modality not viewport so a narrowed desktop window stays 36px. Ref Venus impl. Do AFTER PLUTO-40 lands.

PLUTO-41 pluto Backlog low

No test script in package.json; vitest unresolvable via pnpm exec

PLUTO-694 pluto Done low

add /cmd_sco to SCANNER_PROBE_RE (down-tier to silent info/malicious)

PLUTO-712 pluto Done low

googleSub UNIQUE partial index (post-EVO-74-dedup)

PLUTO-619 pluto Done low ↳ EVO-79

CR 32: en antecedentes personales agregar item: TRASTORNOS RENALES

PLUTO-258 pluto Done low

CR 31: En mismo espacio donde esta el logo UBA.ODONTOLOGIA ver opciones para agregar cátedra: Cirugía BMF 1

PLUTO-257 pluto Done low

JTP bell notification lost on práctica-create pool timeout

PLUTO-692 pluto Done low

Mirror Lean Lane pointer into pluto-commons.md: one-line pointer to evolutiva-pm-commons.md §Lean Lane (canonical SHA 40b1beb, fleet-adopted 2026-06-30); do NOT fork full text (drift risk). Class-S docs (single-file/reversible/security-inert) -> coder --patch. Bundle into next pluto coder push, or standalone if none within ~24h.

PLUTO-460 pluto Done low

Support ticket short human-readable reference (SOP-###) on /admin/soporte + /[id]. supportTickets has only a uuid today (LEAN schema, no ticketNumber). Add a STABLE, IMMUTABLE short-ref column assigned at insert (NOT row-order-derived — shifts on delete, breaks citability). Scheme TBD by Elazar (rec: SOP-<year>-<per-year seq> e.g. SOP-2026-007; alt: flat SOP-NNN). db: add nullable column (archive-fn to_jsonb expand-only NOT NULL trap — new cols on trigger-archived supportTickets MUST be nullable) + monotonic assignment (sequence or per-year counter) + backfill existing tickets in createdAt order; archive sentinel on the backfill. coder: use the ref as the detail-page title/reference, render as a self-link, add a 'copiar enlace' button copying the full ticket URL (https://evolutiva.pensanta.com/admin/soporte/[id]); also surface the ref as the link text in the /admin/soporte list. GATING: DB schema change -> audit pre-impl design-ping + pre-apply review on the migration + post-push PTD. SEQUENCING: touches support surface shared with PLUTO-444 (uncommitted support-actions.ts) — order to avoid collision. Blocked on Elazar's scheme pick.

PLUTO-449 pluto Done low

SCANNER_PROBE_RE expansion: infra/cloud/backup/profiler probe families (A-F). 07:32 UTC sweep = 98 distinct post-cutover warn paths uncovered by 450/451 (k8s/docker/helm YAML manifests, cloud-cred JSON, terraform state/vars, SQL dumps, archives, profiler/heapdump, cred dotdirs). Audit collision-proven 98/98 coverage, 0 route collision (69 templates), 0 benign false-pos. Down-tier to silent security/info (no page, force-retain). Pluto-canonical; mars/venus inherit. Decisions: ADD families A-F + archives(.zip/.tgz/.tar.gz) + exacts /dump /trace /logfile (whole-path). HOLD /credentials (app-plausible, under-evidenced) + .bak/.backup JSON (under-evidenced). Anchor discipline: cred dotdirs (^|/) any-segment; bare-ext OK ONLY where Pluto serves zero (yaml/sql/tfstate/zip); .json stays filename-anchored (442 ban). Gates: audit pre-push diff + PTD live-probe.

PLUTO-453 pluto Done low

SCANNER_PROBE_RE env-file shape gap: dotless env.* + *.env suffix probes leak to warn (PLUTO-450 sibling). 06:22 UTC 2026-06-29 sweep (27 events) = /env.txt /env.old /env.backup (dotless env. prefix) + /<prefix>/sendgrid.env /backend|src|app|email|mailer/sendgrid.env (env SUFFIX). Current /(^|/)\.env(?:.)/ alt requires (^|/) immediately before .env, so it catches .env + nested /.env ONLY — misses env.<ext> (no leading dot) and <name>.env (suffix). All 404 (benign, no creds served). Fix = evidence-driven broadening for the env-credential-file family; coder+audit design the exact alt(s) keeping anchor discipline + real-404-signal (route-collision test; Pluto has no /env.* or *.env route). Classification-only, security-tier. audit pre-push review (regex broadening = real-404 signal risk) + PTD.

PLUTO-451 pluto Done low

SCANNER_PROBE_RE: ROOT-anchored .git (and .aws) alts miss NESTED credential-dir probes -> leak to warn (446-sibling anchor asymmetry). Audit-confirmed: 03:38 UTC 2026-06-29 scanner burst = 26 distinct <prefix>/.git/config probes (/admin /api /app /assets /backend /blog /build ... /www) ALL warn/navigation; only root /.git/config + /wp-content/.git/config caught. Cause: not-found-classify.ts has /^\/\.git(?:$|\/)/ (root-anchored ^\/) while the correct sibling .env alt is (^|\/)\.env. FIX (one-char-class each, mirror .env): (1) /^\/\.git(?:$|\/)/ -> /(^|\/)\.git(?:$|\/)/ ; (2) ALSO /^\/\.aws\b/ -> /(^|\/)\.aws\b/ — structurally identical root-anchor gap on an existing credential alt; same scanner class nests .aws identically, so fix it in the same pass (PM call: structural-consistency, not speculative broadening). The (?:$|\/) boundary keeps .git to the DIRECTORY (still won't match /.gitignore). Collision test (audit pre-verified): zero — no Pluto route has a .git or .aws path segment; leading-dot segment is never an app/api route. Do NOT add .svn/.hg/.bzr (no alts exist, zero data — speculative). Benign-impact, all 404'd, no repo/creds served. Security-tier classification fix. gitpush --patch -> audit PTD (audit will fire a live nested-.git probe to confirm the down-tier).

PLUTO-450 pluto Done low

PLUTO-442 follow-up: SCANNER_PROBE_RE misses /.dev.vars (Cloudflare Workers/Wrangler local-secrets file) -> logs warn instead of the silent info/malicious tier. Confirmed by audit as the ONLY current-regex cred-probe gap (the 08:46 sweep's ~18 other cred shapes — .env+12 variants, .aws/credentials, secrets.json, config.json, .git/config|HEAD — all classify correctly). Add ONE anchored alt to the SCANNER_PROBE_RE array in not-found-classify.ts, mirroring the .env alt shape: /(^|\/)\.dev\.vars(?:$|[./~0-9_-])/ (covers .dev.vars + .dev.vars.production/.local siblings; NO speculative broadening per 442 discipline). Collision-test vs real routes (audit pre-verified zero — leading-dot segment matches no app/api route). Security-tier, benign-impact (all 404'd, zero exposure). Standard push->audit PTD.

PLUTO-446 pluto Done low

Investigate not-found capture-leg bypassing the scanner down-tier: at 06-28 01:28 paths that DO match SCANNER_PROBE_RE (/wp-content, /cgi-bin, /.well-known, /admin/controller/extension, /zup.php73, /randkeyword.PhP7) logged at warn/navigation, while IDENTICAL paths logged info/malicious at 01:40 + in the 08:46 sweep (same deploy, ~12 min apart). tierForNotFound down-tiers these path-only/any-referer BEFORE reason logic, so a warn outcome means those rows did NOT pass the SCANNER_PROBE_RE branch — consistent with a different persist leg (PLUTO-182 not-found capture-on-redirect emitting phantom rows that bypass the classifier). Coder read: does the capture leg run not-found-classify's down-tier, or persist warn directly? Benign-impact (rows retained) but a sliver of scanner hits intermittently page at warn. Relates to the routeResolves discriminator (pluto-notfound-capture-redirect-overfire). Low-pri.

PLUTO-447 pluto Done low

Harden práctica create/update/HC-fix actions against silent save failure (uncaught pool.connect + missing client try/catch)

PLUTO-679 pluto Done low

userRoles_lookupOptionId_fkey accepts non-role lookupOptions (data pollution, not priv-esc)

PLUTO-672 pluto Done low

Wire pluto PTD probes to the fleet UA wrapper (--app pluto) — wrapper exists with zero callers, probes ship untagged

PLUTO-662 pluto Done low

Over-match check: pluto's 3 shipped pre-probe benign patterns vs real user-facing traffic

PLUTO-658 pluto Done low

Broken admin-detail links: comisiones/usuarios/alumnos 404 on real records

PLUTO-655 pluto Done low

No reachable contact channel on /solicitar-acceso or /acceso-denegado

PLUTO-649 pluto Backlog low

Extend SCANNER_PROBE_RE for 2026-07-20 config-file scanner sweep (.bashrc/.envrc/deploy.sh/WEB-INF/info.txt)

PLUTO-623 pluto Done low

Extend SCANNER_PROBE_RE for 2026-07-19 secret-file scanner sweep (7 shapes)

PLUTO-616 pluto Done low

Pluto P3: canonicalizeEmail JS/DB parity edge — JS lastIndexOf('@') vs DB SPLIT_PART first-'@'; diverge only on malformed multi-@ input (dedup-parity, not dot-strip). Align the @-split semantics.

PLUTO-36 pluto Canceled low

Retire residual /login?error=no-profile UI path

PLUTO-60 pluto Done low

Table convergence: drop server page-size oddball 15 (->[10,25,50,100] fleet baseline); later adopt Mars-style column-config API over Pluto server stack

PLUTO-58 pluto Done low

Observability: log /api/image 401/403 auth-denials to appEvents (category auth/authz, level info) so denial-storms are diagnosable; route currently logs only proxy-failures, not the gate denials

PLUTO-111 pluto Done low

Clean up dead additive totalPracticas computation in getStudentProfileSummary

PLUTO-540 pluto Done low

public/formulario-practica.pdf rides unrelated commits — byte re-touch (identical size, no content change) re-touches in the push window, not present in pre-push git status. Recurring since PLUTO-77, again on PLUTO-84. Find what regenerates it (build step / file watcher) and either .gitignore it or normalize so it stops riding unrelated commits. Harmless but persistent noise.

PLUTO-85 pluto Done low

fn_getInformesBundle: add a PARALLEL ?jtp narrowing param (intersection-only filterJtpIds, mirror the 3/ param coder added to the TS roster fns in PLUTO-456) so /informes adjunto AGGREGATES re-narrow by the selected JTP in the UI. SECURITY-SAFE: intersection-only, never widens authoritative scope (the PLUTO-457/043 OR-fix already establishes correct scope). Deferred from the 456/457 push by coder: today mixed-teacher aggregates are EMPTY via the AND-clamp so there's no new regression; after 043 applies they populate but ignore the ?jtp selector until this lands = UX-completeness gap, not a leak. Separate db migration after 043 is live. Follow-up to PLUTO-456/457/458.

PLUTO-459 pluto Done low

Dup id sec-observaciones on /practicas/nueva

PLUTO-478 pluto Done low

Delete dead soft-delete exports softDeletePeriodo + softDeleteComision (admin-actions ~455/~546, zero callers; live paths = administrar.removePeriodo/removeComision)

PLUTO-216 pluto Done low

Dead-code removal: softDeletePeriodo + softDeleteComision (admin-actions.ts:443/534) are exports with ZERO callers; live paths are removePeriodo/removeComision. Remove the dead exports.

PLUTO-113 pluto Done low

Durable email outbox (mirror MARS-76): emailOutbox + enqueueEmailTx + pg_cron drainer

PLUTO-565 pluto Canceled low

Migrate call-sites off vFriction7d, drop old view after vUserFrictionEvents dup ships

PLUTO-554 pluto Done low

SOP ref: add pluto slug prefix (display-only, dual-accept parser)

PLUTO-556 pluto Done low

Fix stale 'no real users' line in pluto-commons.md

PLUTO-552 pluto Done low

tmp

PLUTO-553 pluto Done low

Add vOpenAccessRequests curated view

PLUTO-550 pluto Done low

Support ticket: linkify body/reply URLs + capture & surface reporter's page URL

PLUTO-549 pluto Done low

Add fouba-institucional.md lazy-load trigger line to pluto-commons.md (with non-authoritative caveat)

PLUTO-517 pluto Done low

/practicas cards: show % inline next to number on Aprobadas + Sin Calificar

PLUTO-503 pluto Done low

/informes: reposition + restyle 'En esta pagina' card

PLUTO-506 pluto Done low

system-banner.tsx: downgrade transient connect-timeout catch error->warn (stops non-actionable real-time pager)

PLUTO-500 pluto Done low

not-found-classify: down-tier sourcemap (*.js.map/*.css.map) 404s to silent - /sw.js.map flooding warn x294

PLUTO-499 pluto Done low

SCANNER_PROBE_RE: down-tier backup-archive filename probes (/backup.tar,.tar.xz,.7z,.rar,.tar.bz2,.gz,.zst,.bz2,+more)

PLUTO-498 pluto Done low

Fold getJtpComparativa+getAdjuntoComparativa+getPracticasHierarchy into single query with kind discriminator (UNION ALL or grouping sets). Audit detail in coder-pluto-cc-25603.

PLUTO-399 pluto Done low

chore: gitignore agents/*/memory/ — prevent accidental agent memory inclusion in commits (parity with venus WI#507)

PLUTO-439 pluto Done low

/admin/usuarios stale-login badges (e.g. '30d') need legend/tooltip explaining the color thresholds. UX audit item 7.

PLUTO-422 pluto Done low

/practicas/nueva — long form (8+ sections, ~10 mobile screens) needs stepper or progress indicator. UX audit item 3.

PLUTO-418 pluto Done low

Document: Speed Insights intentionally OFF (memory project_vercel_runtime); add note in pluto-commons

PLUTO-414 pluto Done low

fn_resolveDataAccessScope: expose accessibleComisionIds union directly to drop JS dedupe in access-scope.ts:72. DB function + app swap. WI#201 audit.

PLUTO-409 pluto Done low

Move audit-actions:407 getPersonaHistory summary string from JS switch to SQL CASE WHEN. WI#201 audit.

PLUTO-408 pluto Done low

Materialize PRACTICA_LOOKUP_UNION as vPracticaLookups view — drop 30 lines of inline SQL concatenated module-scope. WI#201 audit. DB-shaped.

PLUTO-407 pluto Done low

admin-actions:1691 PendingUser: return array_agg(role nombre) instead of string_agg + JS split. WI#201 audit.

PLUTO-406 pluto Done low

Fold practicas-team-stats reduce sums to SQL — 5 reduce() over rollup rows in practicas-team-stats-data.ts:10-14 should be SUM() OVER () or final agg row. WI#201 audit.

PLUTO-405 pluto Done low

Alumnos grid polish phase-2: dialog-friction merge (collapse confirm steps where safe) + audit-row ergonomics (timestamp + actor on hover/tooltip). Follow-up to WI#138.

PLUTO-404 pluto Done low

Bulk actions phase-2: bulk role assign + bulk invite (welcome re-send) on /admin/usuarios. Infra (multi-select + toolbar) from phase-1 in place. Follow-up to WI#126.

PLUTO-403 pluto Done low

/admin/documentos-pendientes filter or page: surface users with documentoEstado=pendiente for bedelia review. Skipped in WI#97 push.

PLUTO-402 pluto Done low

Promote lastLogin CTE to vUserLastLogin view — 4 dup sites: getRecentLoginEvents, getOldestUserLastLogins, getAdminUsersPage CTE, getInactiveUsers. Single source of truth + indexable. Audit detail in coder-pluto-cc-25603.

PLUTO-401 pluto Done low

Fold getPracticasTrend(week) + getPracticasTrend(month) into single UNION ALL with bucket label. Audit detail in coder-pluto-cc-25603.

PLUTO-400 pluto Done low

Fold /informes hierarchy/team/kpi queries into single CTE — getPracticasHierarchy + getPracticasTeamStats + getTeacherKpis overlap on vPracticasHierarchyRollup/vPracticasTeam. Audit detail in coder-pluto-cc-25603.

PLUTO-398 pluto Done low

Dialog → AlertDialog sweep: periodos-admin delete, comisiones-admin delete, admin-user-detail deactivate. Confirm-style destructive flows still on Dialog. Follow-up to WI#358.

PLUTO-397 pluto Done low

Pluto missing shadcn AlertDialog primitive — pluto-commons says use AlertDialog for destructive confirmations, but pluto has only Dialog. Install via shadcn skill, then audit destructive flows (delete, demote, soft-delete confirmations) and migrate from Dialog → AlertDialog.

PLUTO-396 pluto Done low

Security alerts phase-2: 3 detectors (businessHoursEdit via server-action wrapper checking Argentina wall clock; rateSpike via pg_cron 2min job querying archive tables; adminAccountEdit via AFTER UPDATE trigger on users checking actor != target + admin role). Designs in db-pluto-cc-25529. Phase-1 (bulkDelete) already live via WI#82.

PLUTO-392 pluto Done low

Filter inconsistency: /practicas uses instant chips, /informes uses 'Aplicar filtros' button. Standardize on instant chips (matches admin UX). UX audit item 5.

PLUTO-420 pluto Done low

Drop practicas.observacionesOperador column (read paths off, writes removed in CR-65/66 pass-2)

PLUTO-391 pluto Done low

approveAccessRequest existing-user branch: backfill numeroDocumento from solicitud

PLUTO-387 pluto Done low

/solicitar-acceso/completar still uses free-text adjunto/titular inputs (parity with #243 cascade)

PLUTO-384 pluto Done low

Solicitud de acceso: form acepta titular/adjunto = '.' (placeholder vacío)

PLUTO-383 pluto Done low

Cátedra naming — URL strategy (subdomain vs path prefix) decision

PLUTO-382 pluto Done low

Audit Pluto for nextjs/nodejs work that should be moved into Postgres (views, functions, triggers). Standing audit role per Elazar 5711-b — surface candidates each pass.

PLUTO-376 pluto Done low

Pool tuning post-Fluid: src/db/pool.ts max 6→2, idleTimeoutMillis 20s→5s. Rationale: traditional serverless = 1 active req/container, no intra-instance concurrency; Fluid-sized values cause connection storms on burst

PLUTO-373 pluto Done low ↳ EVO-36

gitpush-pre.sh doc-skip investigation — Pluto has no per-project pre-script (only PATH gitpush.sh guard). Determine whether doc-skip lands in PATH gitpush.sh (llmmsg-srv-ca scope) or a new pluto-local pre-script

PLUTO-371 pluto Done low ↳ EVO-36

/practicas: TOC dinámico arriba con anclas a las secciones (página muy larga)

PLUTO-226 pluto Done low

vUserRolesActive view — auth-actions.ts:29-115 repeats userRoles+lookupOptions JOIN across getCurrentUser/getUserById; fold into view returning roleName + caps[]

PLUTO-368 pluto Done low ↳ EVO-36

vStudentPracticaStats fact view — getStudentsForPracticaForm CTE+candidateStats per-form-open aggregation → reusable fact view (queries.ts:165-235)

PLUTO-367 pluto Done low ↳ EVO-36

vPracticasAuditEntries view — consolidate getStudentPracticasAuditLog + getJtpPracticasAuditLog + getPeriodoPracticasAuditLog (queries.ts:1626/1754/1870) into one view; per-call WHERE only

PLUTO-366 pluto Done low ↳ EVO-36

Sweep raw <button> + button-class usage outside src/components/ui/ — replace with Button primitive (~16 hits flagged by shadcn audit, coder tag 1917)

PLUTO-360 pluto Done low

Install missing shadcn primitives: alert-dialog + tooltip + skeleton + scroll-area

PLUTO-359 pluto Done low

__probe__

PLUTO-49 pluto Canceled low

Audit logs lazy-load en /practicas, default colapsado

PLUTO-299 pluto Done low

Pluto P3: global-error.tsx leaks raw error.message + internal appEvents SQL to end-users

PLUTO-26 pluto Done low

Pluto P3: bare notFound() on missing practica (MARS-89/90 class) — port friendly not-found, /practicas/[id]:27 + /mi-cursada/[id]:30

PLUTO-24 pluto Done low

CSP header — Content-Security-Policy not yet added

PLUTO-295 pluto Done low

CR 68: Cleanup src/lib/review-state.ts: eliminar labels y colores hardcodeados. El schema ya expone label/color/orden vía lookupOptions.params; vPr

PLUTO-294 pluto Canceled low

Reason capture para cambios sensibles — reason obligatorio en role removal/deactivate

PLUTO-333 pluto Done low

Salomone docente_adjunto role decision — quitar adjunto (solo bedel) o mantener ambos

PLUTO-335 pluto Done low