Treat 404 as error: emit level=error on 404 + email+DM + feed auto-fix protocol (Elazar 404-directive, kpi-n-optimization)

PLUTO-158 pluto Blocked high

Extend SCANNER_PROBE_RE with archive-probe family (/backup.tar|.7z|.rar|.zst|...) — 294 unsuppressed scanner 404s in one window

PLUTO-661 pluto Blocked

conform appEvents to fleet SSOT (categoryId FK, promoted cols, append-only+GUC, appEventRelays sidecar, retention guard, logger, views)

PLUTO-73 pluto Blocked

Prácticas: sometimes a student is operador with NO student asistente (single-participant práctica) - define canonical rule

PLUTO-511 pluto Blocked

Prácticas: enforce operador/asistente role separation once rosters are curated (students can't pick a docente as asistente)

PLUTO-510 pluto Blocked

Adopt fleet ticket-triage protocol (bs-mr4xk6nnuu2) — Pluto replication

PLUTO-487 pluto Blocked

Generalize known-benign 404 suppression (extends PLUTO-182/184 template, app-side classifier per Elazar bs-mqoruy0m32e). All currently page at warn; reclassify at the write path (not-found-classify.ts / not-found-log.ts) so the row persists at info and never enters the warn page path. Candidates: (1) phantom redirect over-fire PLUTO-165/169 residue: empty requestedPath + classifiedReason=genuine-bad-route -> info (~1.9/day); (2) /apple-touch-icon.png + -precomposed.png iOS/Safari auto-requests -> WELLKNOWN_BENIGN_RE -> info/navigation (~1.3/day); (3) /robots.txt -> WELLKNOWN_BENIGN_RE -> info (~0.5/day; optionally serve real robots.txt separate); (4) credential-JSON scanner burst ~15 variants currently mis-tagged navigation NOT security (gcp/firebase/secrets/config/service-account .json, /api/env, /actuator/env) -> extend SCANNER_PATH_RE -> info/malicious (these are 182-class probes that slipped the regex); (5) /practicas/<non-uuid-slug> malformed -> non-UUID on UUID route -> info/malicious (~0.3/day). INVESTIGATE-FIRST sub-point: anonymous-no-referer-unknown old-schema warn rows (~0.9/day) -> suppress ONLY if all pre-date PLUTO-169 deploy; if any post-date, find the un-upgraded code path. ~7/day of ~14/day page_not_found warn volume.

PLUTO-187 pluto Blocked

EVO-70 Tier 1 follow-up: retire app after() calls (gated on passive prod evidence)

PLUTO-615 pluto Blocked low ↳ EVO-70