4 untracked Terra access reports, 10 days open, noProfile - check registry before assuming absent

TERRA-295 terra In progress high

Terra production pool connects as the postgres TABLE OWNER - no GRANT or trigger containment is enforceable in that schema until a non-owner app role exists (twin of PLUTO-670)

TERRA-281 terra In progress high

Participant eligibility admits the bedel-only support service actor as a recorded practica teammate

TERRA-279 terra Backlog high ↳ TERRA-277

└─ Re-test inactive Terra grant refusal if either shared guard changes

TERRA-287 terra Backlog low

vUserGroups role gate uses a bare toAt IS NULL, so a future-end grant confers no app role while still conferring clinical write

TERRA-286 terra In progress high

Una practica no se puede corregir despues de creada: la unica excepcion es el postoperatorio, y todo lo cargado al crear (marca, injerto, zona, piezas, regiones, complicaciones intra, antecedentes) queda mal para siempre

TERRA-181 terra Todo high

Demo 1/10: 14 genuine-Google identities hit noProfile; classify and route

TERRA-278 terra Backlog high

MISSING PRIMITIVE: terraPracticas has no validation state, so three ruled rows reference a boundary that does not exist (TERRA-254/150/146)

TERRA-276 terra In progress high

Support-ticket surface fails the agent-operable directive: mutation and thread capabilities are MISSING, not merely auth-unreachable

TERRA-36 terra Blocked high

PUBLIC pg_net grants give Terra _ro roles effective writes; cron grant remains dormant

TERRA-257 terra Blocked high

Three terra users locked out today need enamel-side writes: one email correction to let a bind happen, two member rows created - one of them a docente mid-course

TERRA-261 terra Blocked high ↳ TERRA-242

Measure whether terra's app pool also connects as the project OWNER role, and whether RLS is FORCE-d on the tables it touches - owner bypasses RLS silently

TERRA-244 terra Blocked high

Google 400 at consent stops a real user signing in to Terra

TERRA-137 terra Blocked high

Terra needs a request-needs-info email mechanism (no equivalent exists); use it for Matias/ceda0a10

TERRA-296 terra Backlog

EVO-123: convert 11 UPDATE OF invariant guards to AFTER/no-column-list

TERRA-289 terra Backlog

Audit Terra clinical mutation authority separately from authorship

TERRA-280 terra Backlog ↳ TERRA-277

A named ayudante has no correction path: TERRA-140 lets one person assert another attended a surgery, and whether the named person can remove themselves is unanswered

TERRA-146 terra Todo ↳ TERRA-140

Standing coordination-notification subscription rule is undecided: COORDINATION_GROUP is null on purpose and the question survives only in a code comment and a superseded TERRA-59 description

TERRA-214 terra Todo

Marca de implante: proposal and approval path - client answered 'todos los docentes' but no suggestion surface exists

TERRA-141 terra Todo

Who may create a practica is an undecided policy the source itself flags: page and action both gate on all five PRACTICA_ROLES and that default also authorises a write into enamel's shared pacientes registry

TERRA-150 terra Todo

Measure unbound Terra users and watch corrected cohort sign-in

TERRA-274 terra Blocked

Correction-rail attribution unobserved: terra_234/235 INSERT arms and terra_236 pure-delete actor never read back

TERRA-273 terra Backlog

Pure antecedente soft-delete blocked by later required-detail catalog change

TERRA-272 terra In progress

37 GoTrue signups in 7 minutes on the shared project, 9 of them not on the roster - nobody has established what opened that path

TERRA-262 terra Blocked

Integrate terra with webusage telemetry (per-app bearer) so an aged session is observable

TERRA-270 terra Blocked ↳ TERRA-22

Ejercitar las rutas autenticadas antes de publicar con un doble en la frontera del resolvedor: hoy nada autenticado se prueba porque la compuerta exige una identidad de Google real

TERRA-226 terra Todo

Disposition of the Maxilo exception list: which untracked fields terra adopts, and which absences are deliberate

TERRA-143 terra Blocked

Every create in the shared registry needs Elazar personally: the only live admin grants on enamel and terra are one human row

TERRA-268 terra In progress

Paciente queue depends on 7 bound accounts out of 28 reviewer grants, and 2 requests have aged 2 days

TERRA-267 terra Backlog

Practicas N19 y N20 son fixtures de prueba en produccion a ocho dias de la demo del 1/10, y ningun script las borra

TERRA-255 terra Blocked

db/schema-live.md is stale: no createdVia column although the app writes one, so a generated snapshot the fleet trusts gives confident wrong schema facts

TERRA-253 terra Blocked

Un pedido rechazado guarda el motivo y nadie se lo dice nunca a la persona que escribio

TERRA-245 terra Backlog

Cuanto tiempo se guardan los datos personales de un pedido de registro de paciente RECHAZADO - hoy para siempre, y nadie lo decidio

TERRA-235 terra Backlog

COORDINATION_GROUP has nowhere correct to go: the seam accepts only a userGroups authorization value, so filling it overloads the table every route gate reads

TERRA-239 terra Backlog

Non-Google-address onboarding requires actual Google sign-in verification and a unified replacement flow

TERRA-111 terra Blocked

Add LoginCard render coverage for untrusted error query values

TERRA-293 terra Backlog low ↳ TERRA-291

Scoped gitpush proceeds unserialised when hub identity is missing in shared checkout

TERRA-290 terra Backlog low

Possible MISBINDING: Terra profile bound to an auth account whose display name does not match it, while a failed-noMatch account does (Case B, carved from TERRA-274)

TERRA-275 terra Backlog low

Redact sent emailOutbox bodies in terra's own drain - enamel's ENAMEL-16 pass is scoped to enamel rows only

TERRA-269 terra Backlog low

Pool identity: connect timeout recuperado en cold start del drain; falta causa del proveedor

TERRA-98 terra Blocked low

Decision de la catedra: entra tipoBarrera al desglose de /informes? Si entra, agrupa por campo - eso ya esta decidido

TERRA-237 terra Backlog low

A NUL byte in a .ts source passes every gate and breaks every text tool

TERRA-229 terra Backlog low