Non-owner app role for archive/fraud/audit table write containment (real remedy, migration 100 is hygiene-only)

PLUTO-670 pluto Backlog high

fn_restorePaciente + sentineled in-place correction: the remedy for a document number trapped on a soft-deleted pacientes row

PLUTO-764 pluto Backlog high ↳ PLUTO-437

Real-time error tee: appEvents AFTER-INSERT pg_notify trigger on Pluto Supabase (error→PM DM, warn stays in digest). GATED on nw-venus's exact spec (channel name, WHEN-clause, payload — byte-identical channel+payload across 3 apps; host listener LISTENs + DMs PM). Pluto level vocab = error|warn|info (NO fatal) so WHEN-clause = level='error'. Pre-apply audit review per DDL discipline. Additive/reversible. Do NOT start until spec lands + 112 done.

PLUTO-116 pluto Backlog high

EVO-123: convert 4 UPDATE OF invariant guards to AFTER/no-column-list

PLUTO-780 pluto Backlog

Restore soft-deleted users with explicit role regrant decision

PLUTO-783 pluto Backlog ↳ PLUTO-639

Applied Pluto migrations missing from registry can be skipped by registry-driven rebuild

PLUTO-779 pluto Backlog

Archive-reason content rule: ban call expressions inside a reason interpolation (shape validator cannot reach it)

PLUTO-771 pluto Backlog

mig 130 primaryRoleId guard is advisory: app.allow_primaryroleid_write is caller-settable, and the wording calls it enforcement

PLUTO-765 pluto Backlog

Flip NOTFOUND_PAGING_ENABLED once fleet gates clear (mirrors VENUS-27)

PLUTO-762 pluto Backlog

Email rail lacks cross-rail dedup of one render's alerts

PLUTO-749 pluto Backlog

Retro cross-vendor review queue: 10 unreviewed pushes since audit-pluto-ca went dark

PLUTO-636 pluto Backlog

Email-identity SSOT campaign: users.emailCanonical generated key + getUserByCanonicalEmail chokepoint (absorbs PLUTO-61 display-write fix + PLUTO-36 JS/DB parity fix as acceptance criteria)

PLUTO-154 pluto Backlog

Scheduled GoTrue config-drift check (cron/applog rail, alerts not blocks)

PLUTO-634 pluto Backlog

Stats glossary: footnote + tooltip explaining stat abbreviations in user-facing text

PLUTO-495 pluto Backlog

Fleet appEvents schema standardization (mirror MARS-411) — DESIGN-HOLD

PLUTO-533 pluto Backlog

Pluto fly-solo-kill execution brief (bs-mqpzo3ly470 / EVO-26) — execute on next Elazar-launched team session, do NOT act between sessions. (A) COMMONS/DOC: delete fly-solo/autonomy doctrine + flip log-review=work-order to report-only-Elazar-decides + add Agent-Boundary PM-never-spawns-hands-brief. Pluto-repo files (pluto-commons.md, pm-pluto-role.md) = Pluto coder; shared evolutiva-commons/evolutiva-pm-commons deletes route via bin-whey-cc (whey-canonical, mem shared-commons-edit-routing), NOT Pluto coder. (B) PROBE NOISE (Pluto app code, coder): port venus X-Audit-Probe demotion + internal-probe UA marker so scanner/probe traffic self-classifies to security/info and emits NO page_not_found warn row (source = not-found.tsx capture, mem pluto-notfound-capture-redirect-overfire); + downstream expected-signal allowlist: /wp-* & CMS-scanner paths, apple-touch-icon* 404s, pm-triage NOTIFY probe, gate-correct login-unknown, mobile fetch-abort. (C) RAIL RE-POINT (nw-owned venus daemons = Elazar-launched nw edit, NOT Pluto coder): applog-listen/pull@pluto + pluto-pm-triage-listen.service (EVO-32) -> REAL-severity DM Elazar only, everything else log/queue row no PM DM. (D) DEFERRED per decision pt7: headless sendWelcomeEmail(userId) path (the Agustina exhibit) - policy stands, conversion not scheduled yet.

PLUTO-201 pluto Backlog

LEG-2 aro-retarget: applog-listen alert DM pm-pluto-cc -> POST aro:pluto (aro tag) so Elazar sees in-room + PM runs error-incident troubleshoot IN aro:pluto. DEPS: nw-venus daemon target change + keepalive restart 60cf5e6; pm-llmmsgsrv re-enable fan-out aro:pluto. Pluto verified Elazar in aro:pluto.

PLUTO-167 pluto Backlog

Real-time error reporting + auto-heal — Pluto leg (ratified protocol bs-mqn2ze006f7)

PLUTO-164 pluto Backlog

Verify applog error→aro:pluto live-PM routing survives EVO-5 rail rename (kpi-n-optimization migration bs-mqmr47bwkk4)

PLUTO-157 pluto Backlog

KPI-rework /informes (gathering inputs, do NOT implement yet): teacher-scoped report quality pass. Inputs so far: (a) wrap bare CohortAndProcedureCards grid (teacher-report.tsx:818) in titled ReportSection; (b) Moda operador/asistente cards mislabeled (modal per-student count, not most-frequent person) + redundant beside Promedio -> cut or relabel; (c) EPI RE-WEIGHT: Puia wants MORE epidemiology on pluto+venus -> KEEP/EXPAND porSexo/porProvincia/etc (REVERSES earlier generic-remove rec; do NOT cut epi buckets). Grounding: judge on ACTUAL teacher-scoped values via audit-venus KPI->source-view map + db-pluto value pull, NOT admin-proxy shape. Awaiting full KPI->view map (~20-30min from audit-venus) + Elazar per-item rulings before WI splits into coder/db work.

PLUTO-121 pluto Backlog

Duplicate practicas: operador + asistente each create the SAME clinical event picking each other as counterpart -> 2 mirror practica rows for 1 real práctica. Need duplicate-detection + canonical-record rule (natural key candidates: fecha+comision+paciente/tratamiento+the operador/asistente pair). Design WITH Elazar; covers (a) prevent new dupes at create, (b) reconcile existing dupes in prod. Cross-team lessons-learned for mars/venus.

PLUTO-78 pluto Backlog

Vercel log-drain setup: Elazar greenlit (2026-06-12) true 24h+ runtime-log retention (currently logs are point-in-time only via Vercel MCP). Scope: pick drain destination (log service/endpoint), configure Vercel log-drain, implementer is infra (nw-whey/nw-venus) not coder. PM owes Elazar the concrete scoped plan before dispatch.

PLUTO-46 pluto Backlog

Soft-deleted-user restore + identity-attach explicit two-step design

PLUTO-620 pluto Backlog ↳ EVO-79

Fleet deliverable: draft BACKTEST SPEC + TRIAGE-CODIFICATION CHECKLIST template (Pluto-owned)

PLUTO-524 pluto Backlog

EVO-12 deploy-skew guard leg (b): daemon-side skew suppression (nw-venus + audit-pluto)

PLUTO-722 pluto Backlog

PLUTO D8 compute-placement remediation (self-scan)

PLUTO-98 pluto Backlog

supautils force-grant census: public functions holding EXECUTE outside their allowed set (R6 forbidden-set read, inventory only)

PLUTO-785 pluto Backlog low

no demo/seed exclusion mechanism exists - vPracticaParticipantFacts cannot exclude demo prácticas from scoped teacher stats

PLUTO-103 pluto Backlog low

Add value/codigo machine-key column to lookupOptions

PLUTO-551 pluto Backlog low

Audit + sync prod public-fn DDL drift to checked-in migrations (search_path pins) — pluto mirror of venus EVO-8

PLUTO-153 pluto Backlog low

PLUTO-139 outcome: add 6 scope-join FK indexes, drop 2 zero-scan indexes, retire the dead isUserRowSafeToSupersede fn

PLUTO-724 pluto Backlog low

Port Terra's participant-dispute mechanism to Pluto (replaces building a removal kind)

PLUTO-763 pluto Backlog low ↳ PLUTO-744

Google has been fetching /.well-known/assetlinks.json 1275 times over three months and getting a 404 every time: an Android App Links association is declared against pluto and has never verified

PLUTO-757 pluto Backlog low

Alert email bodies show 12-hour clock without AM/PM

PLUTO-750 pluto Backlog low

practicas.numeroHistoriaClinica non-blank + trimmed CHECK, and clean the one untrimmed row

PLUTO-738 pluto Backlog low

Solicitudes: evaluate+fold net-new features into Pluto from mars/venus (brainstorm bs-mr4h5azsk3g)

PLUTO-477 pluto Backlog low

Adopt curated repo-visible knowledge .md for Pluto agent team (bs-mr3bt2c0vgy consensus)

PLUTO-470 pluto Backlog low

Investigate stray uncommitted .agent-name change in solo-pluto team tree

PLUTO-562 pluto Backlog low

Proxy viewport tooling: chrome-devtools-mcp (CDP) for Pluto needs an auth path — Pluto is OAuth-only

PLUTO-51 pluto Backlog low

Advisory (low pri): enable auth_leaked_password_protection (HaveIBeenPwned check) in Supabase auth — currently disabled. Low value for Pluto (allowlist-only, no open signup) but a free defense-in-depth toggle. From PLUTO-123 security sweep.

PLUTO-125 pluto Backlog low

Shared push-tree same-file concurrent-edit handoff protocol

PLUTO-683 pluto Backlog low

Consume venus-side applog cursor-age instrument (report pluto's rail age)

PLUTO-651 pluto Backlog low

Applog burst-dedup: duplicate event ID replay within 60s synthesizes x2 burst

PLUTO-650 pluto Backlog low

User-facing self-suggestion surface (is-this-you link-to-existing)

PLUTO-622 pluto Backlog low ↳ EVO-79

Pluto Historial change-history panels: audit gap + build (HOLD for Elazar go)

PLUTO-531 pluto Backlog low

Logging-hardening: clientError:global-error rows persist with EMPTY detail (no digest/errorName/message/route) — un-diagnosable from appEvents alone. Capture digest+message+route at the global-error boundary so future global-error volume is triageable. Low-pri; only escalate if global-error volume rises (currently sparse/benign: 2-4/day transient).

PLUTO-221 pluto Backlog low

404 telemetry anomaly: 7-row burst is nextUrlPresent=TRUE with clientBuildId=NULL - the exact inverse of the 12-row confirmation set, unexplained

PLUTO-726 pluto Backlog low

404 telemetry: isSoftNav keys on sec-fetch-dest=empty, which any fetch() sets - scanner traffic confirmed misclassified as soft-nav (5 of 29 rows)

PLUTO-725 pluto Backlog low

PLUTO-700 follow-up: live confirmation the retired 10-arg fn_insertSupportTicket shape stays unused - one authenticated browser /soporte submit against the shipped build, then db-pluto-cc reads pg_stat_statements (11-arg queryid rises, 10-arg does not)

PLUTO-716 pluto Backlog low

Historial mapping update + regression + drift checks (PLUTO-583F)

PLUTO-589 pluto Backlog low ↳ PLUTO-583

DB enforcement for future rows (PLUTO-583E)

PLUTO-588 pluto Backlog low ↳ PLUTO-583

Large-screen sales-surface polish: add xl/2xl density tiers (more grid cols / master-detail / side-rail filters), data tables over stacked cards, ~40-48rem line-length cap on prose+forms, persistent sidebar + fluid type >=1280 + responsive imgs. Scope: /informes + KPI dashboards + /admin tables + public landing ONLY. Does NOT touch alumno (PLUTO-159) or docente grading mobile-first paths. Verify via proxy pixel-confirm at 1920/2560. Ship-timing = Elazar's call (low current N). From bs-mqmxqxwop02 decision.

PLUTO-162 pluto Backlog low

db/schema.md omits function bodies, so it cannot answer what is installed for any fn

PLUTO-704 pluto Backlog low

PLUTO-34 contract step: DROP flat columns on 7 archive tables after jsonb expand verified in prod (irreversible)

PLUTO-65 pluto Backlog low

Phase-2 demo cleanup (BLOCKED on demo-row purge): strip the now-unneeded demo filters/labels/tab once Elazar purges demo rows. These are PROTECTIVE while rows exist — removing earlier leaks demo data into real reports. Sites: admin/page.tsx:11 (@demo pendingUsers filter), informes/page.tsx:117-121 + practicas/page.tsx:139-142 ('Demo ' comision filter), admin-user-detail.tsx:68/127 + audit-log.tsx:122 (isDemo/demo_seed label map), complication-rate/dificultad-distribution/procedure-type cards '(no demo)' text, admin/usuarios 'Usuarios demo' tab. Coupled to PLUTO-118 phase-1 + the row purge.

PLUTO-120 pluto Backlog low

PKCE callbackExchangeFailed: add benign-vs-attack discriminator (volume-gated, no action yet)

PLUTO-698 pluto Backlog low

Comisión-remainder section is read-only but canGradePractica permits grading it — affordance and permission disagree

PLUTO-687 pluto Backlog low

Migrate all touch primitives (Button/Select/Input) to uniform pointer-coarse:min-h-11 for 44px touch targets — replaces the 3-way convention (Button h-11 sm:h-9 / Select flat h-11 / Input sm:-gated); keys on input modality not viewport so a narrowed desktop window stays 36px. Ref Venus impl. Do AFTER PLUTO-40 lands.

PLUTO-41 pluto Backlog low

No reachable contact channel on /solicitar-acceso or /acceso-denegado

PLUTO-649 pluto Backlog low

FUTURE (recommend, separate from skew fast-follow): enable next.config deploymentId + Vercel Skew Protection (if Pluto's plan allows) for a SOUND client-vs-server build compare — gives the app a real origin-build signal (today the build-ID is COARSE: app sees only its own serving build, never the client's origin build, which is why an app-side skew downgrade is unsound and the daemon owns the deploy-timing discriminator). Also makes a real end-to-end deploy-skew test possible. Low pri.

PLUTO-170 pluto Backlog low

DEFERRED: extract userDocumentoReview workflow table from users.documento* cols if documento approval flow grows. Workflow entity with natural FK, not generic profile split. Counter to WI#119 verdict.

PLUTO-410 pluto Backlog someday

Análisis estadístico — rol researcher dedicado + acceso a datos anonimizados

PLUTO-306 pluto Backlog someday

Should info/malicious page_not_found bulk (8304 rows) be visible on any digest/surface

PLUTO-660 pluto Backlog someday

Decide whether the 7 remaining baselined Button overrides want semantic colour tokens (--warning) or stay one-offs

PLUTO-723 pluto Backlog someday

Rename tipoDocumento->documentoType, numeroDocumento->documentoNumber (users+accessRequests)

PLUTO-527 pluto Backlog someday

admin/usuarios:97 8-wide fan-out collapse (descoped from PLUTO-102)

PLUTO-486 pluto Backlog someday

Impersonation banner 'Volver a mi cuenta' button: verify mobile touch-target — CDP click() no-op, JS element.click() worked

PLUTO-574 pluto Backlog someday