Shared DB eprpywqwzsvrjeaforei has ZERO backup coverage: free plan, backups list empty, PITR off, no dump machinery on either tenant

TERRA-7 terra Blocked urgent

enamel_031's NOT NULL no-default on shared supportTickets broke requestTerraAccess for 9 minutes: zero eligible callers, nobody hit it

TERRA-40 terra Done urgent

Nav visibility gap: /practicas/nueva + /mi-cursada unreachable via sidebar for non-alumno roles

TERRA-17 terra Blocked high

Retire/reactivate writes archive rows with no actor or reason: RETIRE_SQL runs on a bare pool.query so setArchiveContext cannot reach it, and terra_29 will break the feature outright

TERRA-78 terra Todo high

Modulos offer AI-seeded cirugias instead of the catedra list: client-reported, correct mapping supplied, Drive source not yet in hand

TERRA-75 terra Blocked high

Implantologia and reconstruccion alveolar need modulo-specific fields (injerto, zona dadora, barrera, marca de implantes): never built, shape undecided

TERRA-76 terra Backlog high

A probe row in appEvents is indistinguishable from a real user failure and the record is permanent

TERRA-43 terra Blocked high

Guard suite unexercised on a non-empty population: the writer exists and is owned, but no natural terraPracticas write has been observed

TERRA-46 terra Todo high

The citation gate checks tag SHAPE, never tag REALITY: a well-formed invented token passes exactly as a genuine one does, and reads to a human as a real citation

TERRA-69 terra Done high

Reason codes assert the data is wrong and terra has no correct-or-retire path for a cirugia: TERRA-55 risks showing staff a fault they cannot act on

TERRA-56 terra Done high

Vocabulary-table archive-on-UPDATE: terraCirugias has an INTEGER PK against a uuid NOT NULL sink, so the generic archive function cannot be reused and the sink assumption itself is in question

TERRA-66 terra Todo high

Raise with applog-listen.ts owner: refuse startup when co-tenanted DB has APPLOG_APPKEY unset

TERRA-25 terra Done high

Client cannot confirm a cirugia: isConfirmedByClient has 3 readers and no writer, and it blocks every guard on the empty population

TERRA-52 terra Done high

Support-ticket surface fails the agent-operable directive: mutation and thread capabilities are MISSING, not merely auth-unreachable

TERRA-36 terra Blocked high

Session dies mid-session on read-only navigation ~1h after login

TERRA-22 terra Blocked high

Terra hard-delete guard coverage: archive ledger, 4 clinical detail tables, counter

TERRA-10 terra Done high

terraPacienteImplantologia: patient-clinical table with deletedAt and apparently no archive trigger on any mutation

TERRA-31 terra Done high

Detail-table UPDATEs bypass both archive triggers: clinical content overwritable with zero trace

TERRA-28 terra Done high

Unprotected .vercel.app project alias serves the full production build, and is the PKCE-mismatch mechanism

TERRA-20 terra Done high

Terra outbound mail: access-request notification (NOT migration terra_13 — that is TERRA-10's deliverable)

TERRA-13 terra Done high

deletedAt on the four terra clinical detail tables (ruled 2026-07-31, not delivered by terra_13)

TERRA-15 terra Done high

Data API OFF is an unowned config that terra's pg_temp LATENT rating silently depends on

TERRA-11 terra Done high

Terra leg of EVO-83: CR + client-questions surface

TERRA-1 terra Done high ↳ EVO-83

Alert-rail per-app routing for terra errors

TERRA-2 terra Canceled high

users.lastSignInAt is never written - the adoption instrument is accidentally-always-zero

TERRA-80 terra Backlog

Odontogram offers deciduous teeth 51-85 which cannot take implants: terra has an exclude scope row for exactly this and it is not narrowing

TERRA-77 terra Backlog

Blocked-item sweep: measure whether each of the seven stated blockers still holds

TERRA-73 terra Done

Citation gate must state its own bound: shape-checked, not authorization-verified

TERRA-71 terra Backlog

terra_27 cites a GO its own text records as dead: establish disposition of what was applied

TERRA-72 terra Canceled

appEvents is now a HARD DEPENDENCY of two terra user actions: a rejected INSERT rolls back the state change, and the constraints live on a shared table the co-tenant can alter

TERRA-70 terra Backlog

Does the shipped citation gate accept unverifiable prose? TERRA-63 checked presence, TERRA-64 checked reality, nothing has checked the checker

TERRA-67 terra Done

Citation currency audited across 31 applied migrations: terra_27 CLEAN, terra_16/17 unverifiable-by-construction

TERRA-64 terra Done

A production import is evidenced in the DB while the tool that performed it exists only on one disk, unversioned

TERRA-62 terra Done

An unconfirm reason routes nowhere: the client states a correctable fact and no terra surface shows it to anyone who can correct it

TERRA-55 terra Done

callback route.ts:270 redirects to /login?error=auth with no finish(): a login rejection landing that writes no signInCompleted row at all

TERRA-61 terra Done

Demote trigger-gated content out of terra-commons into a lazy-loaded detail file: auto-loaded footprint measured ~34K against an 8K budget

TERRA-60 terra Done

Failed access request told the user nothing: generic toast invited a futile retry with no sign the request was not registered

TERRA-41 terra Done

A successfully filed access request notifies nobody: COORDINATION_GROUP is null, so the success-path promise has no transport

TERRA-59 terra Blocked

terraCirugias hard-delete ban applied; archive-on-UPDATE ruled NOT TAKEN on redundancy with re-open conditions recorded

TERRA-58 terra Done

Permanent pool-identity read: current_user to appEvents at cold start

TERRA-14 terra Done

TERRA-43's chokepoint coverage claim outlives the chokepoint: TERRA-52 makes logger.ts a non-sole writer

TERRA-54 terra Done

terraCirugias is deliberately unguarded as 'vocabulary, not clinical record' - TERRA-52 makes it carry a client decision and falsifies that premise

TERRA-57 terra Done

PKCE exchangeFailed on first sign-in: instrument shipped, population gone, unresolved between two lanes

TERRA-51 terra Backlog

Login reliability: PKCE exchangeFailed on first sign-in, plus no actionable message on wrong-Google-account

TERRA-18 terra Done

Terra's 45 guard triggers are all tgenabled='O': one SET session_replication_role='replica' disables the entire guard suite

TERRA-47 terra Done

Archive-context GUCs are bare shared-namespace names (app.user_id / app.archive_reason): rename agreed in terra_13, never scheduled

TERRA-33 terra Done

Guard-inside-try scanner skips any actions module with more than four lines above its directive

TERRA-44 terra Done

Write the accepted service_role/postgres mutation exposure into terra-commons: appEvents append-only and no-hard-delete are CONVENTIONS, not table properties

TERRA-9 terra Done

└─ Watcher on db_schema for eprpywqwzsvrjeaforei: the only control over a fleet-token-writable value gating service_role HTTP reach

TERRA-35 terra Done high

db/export-schema.sh: extend snapshot beyond public schema (13 non-pg_* schemas)

TERRA-12 terra Done

appEvents context columns exist and terra writes none of them (sessionId, userAgent, ip, requestId, traceId)

TERRA-27 terra Done

appEvents immutability guard is disarmed by a BARE shared-namespace GUC (app.bypass_appEvents): TERRA-33 does not cover it and closing 33 must not read as closing the class

TERRA-45 terra Done

Lint guard: ban runtime-derived origins in auth paths (never built under TERRA-21)

TERRA-32 terra Done

withAction presence checks read raw text: a comment mentioning withAction excuses a module that never calls it

TERRA-29 terra Done

Terra applog rail: failnotify propagation gap - both shared template units lacked OnFailure=, and the notifier that fixed it was an unbounded emitter with an inert label

TERRA-26 terra Done

appEvents 48h silence is no-traffic, not a broken writer: terra and enamel writers each proven by emitting through the ordinary app path on the current build

TERRA-42 terra Done

signInCompleted's 8 unattributed rows are outcomes with no resolvable users row, not a call-site gap: 13/13 authorized attributed, so TERRA-23 needs no coverage bound

TERRA-30 terra Done

TERRA-19 instrument fires once per bucket from the Server-Component path via console.error, proven by injected unit + build only: Vercel capture NOT established

TERRA-24 terra Done

pnpm test glob was directory-enumerated and depended on authors remembering to widen it: latent, no committed test was ever skipped

TERRA-38 terra Done

First terra applog digest triaged: no terra defect - login:no-profile is a separate toast sink, PKCE loss was Supabase JS's own verifier storage

TERRA-37 terra Done

Pasart account blocked: no address, no name available

TERRA-6 terra Blocked

TERRA-22 screening instrument: inter-login interval near 60min on signInCompleted

TERRA-23 terra Done

Terra-side applog/alert-rail coverage

TERRA-3 terra Done ↳ EVO-84

server.ts swallows cookie-write failures on a safety condition (middleware) that does not exist in terra

TERRA-19 terra Done

Move terra detail-table reads to active views + archive-context on detail soft-delete

TERRA-16 terra Canceled

Terra function set: no pinned search_path on SECURITY-adjacent functions

TERRA-8 terra Done

terra_10 follow-up: heal-GUC visibility on appEvents (audit-trail gap WITHDRAWN as false - archive already records it)

TERRA-5 terra Canceled

Confirm enamel whole-DB backup coverage for the shared project

TERRA-4 terra Done

terra_22 asserts trigger identity by tgname with no tgrelid scoping, so the assertion can match a trigger on another relation

TERRA-79 terra Backlog low

Post-deploy PTD check mints one permanent appEvents row per push on a shared 365d-floor table

TERRA-74 terra Backlog low

Three shipped comments disagree on whether terraCirugias has rows, and /administrar's stated purpose depends on the answer

TERRA-65 terra Done low

terraModulos has the same zero archive coverage and the same integer-PK wall as terraCirugias, and is the second half of the population TERRA-66 measured

TERRA-68 terra Backlog low

The push gate never sees a new migration unless a human names it in a test: only terra_16 and terra_19 are read

TERRA-63 terra Done low

login:no-profile logs a correct denial at warn on every unregistered visitor: per-code severity or a traced benign arm

TERRA-39 terra Done low

Probe marking is unavailable on non-error rows: markSynthetic needs errorMessage, and detail.synthetic is explicitly not the marker

TERRA-53 terra Backlog low

Stale bare-name GUC reference in db/specs/appevents-pruner-design.md, deliberately excluded from a621cb6 to avoid sweeping another lane's uncommitted work

TERRA-49 terra Done low

No instrument distinguishes noProfile wrong-account from genuinely-unprovisioned: both carriers falsified

TERRA-50 terra Backlog low

db/specs/appevents-pruner-design.md:90 still names bare app.user_id GUC, stale since terra_23

TERRA-48 terra Canceled low

DELETE/TRUNCATE-class guards stay 'O' (21 triggers, all 12 tables): ENABLE ALWAYS traded away on purpose

TERRA-34 terra Done low

Lint guard: ban runtime-derived origins in auth paths

TERRA-21 terra Done low