enamel_031's NOT NULL no-default on shared supportTickets broke requestTerraAccess for 9 minutes: zero eligible callers, nobody hit it

TERRA-40 terra Done urgent

The citation gate checks tag SHAPE, never tag REALITY: a well-formed invented token passes exactly as a genuine one does, and reads to a human as a real citation

TERRA-69 terra Done high

Reason codes assert the data is wrong and terra has no correct-or-retire path for a cirugia: TERRA-55 risks showing staff a fault they cannot act on

TERRA-56 terra Done high

Raise with applog-listen.ts owner: refuse startup when co-tenanted DB has APPLOG_APPKEY unset

TERRA-25 terra Done high

Client cannot confirm a cirugia: isConfirmedByClient has 3 readers and no writer, and it blocks every guard on the empty population

TERRA-52 terra Done high

Terra hard-delete guard coverage: archive ledger, 4 clinical detail tables, counter

TERRA-10 terra Done high

terraPacienteImplantologia: patient-clinical table with deletedAt and apparently no archive trigger on any mutation

TERRA-31 terra Done high

Detail-table UPDATEs bypass both archive triggers: clinical content overwritable with zero trace

TERRA-28 terra Done high

Unprotected .vercel.app project alias serves the full production build, and is the PKCE-mismatch mechanism

TERRA-20 terra Done high

Terra outbound mail: access-request notification (NOT migration terra_13 — that is TERRA-10's deliverable)

TERRA-13 terra Done high

deletedAt on the four terra clinical detail tables (ruled 2026-07-31, not delivered by terra_13)

TERRA-15 terra Done high

Data API OFF is an unowned config that terra's pg_temp LATENT rating silently depends on

TERRA-11 terra Done high

Terra leg of EVO-83: CR + client-questions surface

TERRA-1 terra Done high ↳ EVO-83

Blocked-item sweep: measure whether each of the seven stated blockers still holds

TERRA-73 terra Done

Does the shipped citation gate accept unverifiable prose? TERRA-63 checked presence, TERRA-64 checked reality, nothing has checked the checker

TERRA-67 terra Done

Citation currency audited across 31 applied migrations: terra_27 CLEAN, terra_16/17 unverifiable-by-construction

TERRA-64 terra Done

A production import is evidenced in the DB while the tool that performed it exists only on one disk, unversioned

TERRA-62 terra Done

An unconfirm reason routes nowhere: the client states a correctable fact and no terra surface shows it to anyone who can correct it

TERRA-55 terra Done

callback route.ts:270 redirects to /login?error=auth with no finish(): a login rejection landing that writes no signInCompleted row at all

TERRA-61 terra Done

Demote trigger-gated content out of terra-commons into a lazy-loaded detail file: auto-loaded footprint measured ~34K against an 8K budget

TERRA-60 terra Done

Failed access request told the user nothing: generic toast invited a futile retry with no sign the request was not registered

TERRA-41 terra Done

terraCirugias hard-delete ban applied; archive-on-UPDATE ruled NOT TAKEN on redundancy with re-open conditions recorded

TERRA-58 terra Done

Permanent pool-identity read: current_user to appEvents at cold start

TERRA-14 terra Done

TERRA-43's chokepoint coverage claim outlives the chokepoint: TERRA-52 makes logger.ts a non-sole writer

TERRA-54 terra Done

terraCirugias is deliberately unguarded as 'vocabulary, not clinical record' - TERRA-52 makes it carry a client decision and falsifies that premise

TERRA-57 terra Done

Login reliability: PKCE exchangeFailed on first sign-in, plus no actionable message on wrong-Google-account

TERRA-18 terra Done

Terra's 45 guard triggers are all tgenabled='O': one SET session_replication_role='replica' disables the entire guard suite

TERRA-47 terra Done

Archive-context GUCs are bare shared-namespace names (app.user_id / app.archive_reason): rename agreed in terra_13, never scheduled

TERRA-33 terra Done

Guard-inside-try scanner skips any actions module with more than four lines above its directive

TERRA-44 terra Done

Write the accepted service_role/postgres mutation exposure into terra-commons: appEvents append-only and no-hard-delete are CONVENTIONS, not table properties

TERRA-9 terra Done

└─ Watcher on db_schema for eprpywqwzsvrjeaforei: the only control over a fleet-token-writable value gating service_role HTTP reach

TERRA-35 terra Done high

db/export-schema.sh: extend snapshot beyond public schema (13 non-pg_* schemas)

TERRA-12 terra Done

appEvents context columns exist and terra writes none of them (sessionId, userAgent, ip, requestId, traceId)

TERRA-27 terra Done

appEvents immutability guard is disarmed by a BARE shared-namespace GUC (app.bypass_appEvents): TERRA-33 does not cover it and closing 33 must not read as closing the class

TERRA-45 terra Done

Lint guard: ban runtime-derived origins in auth paths (never built under TERRA-21)

TERRA-32 terra Done

withAction presence checks read raw text: a comment mentioning withAction excuses a module that never calls it

TERRA-29 terra Done

Terra applog rail: failnotify propagation gap - both shared template units lacked OnFailure=, and the notifier that fixed it was an unbounded emitter with an inert label

TERRA-26 terra Done

appEvents 48h silence is no-traffic, not a broken writer: terra and enamel writers each proven by emitting through the ordinary app path on the current build

TERRA-42 terra Done

signInCompleted's 8 unattributed rows are outcomes with no resolvable users row, not a call-site gap: 13/13 authorized attributed, so TERRA-23 needs no coverage bound

TERRA-30 terra Done

TERRA-19 instrument fires once per bucket from the Server-Component path via console.error, proven by injected unit + build only: Vercel capture NOT established

TERRA-24 terra Done

pnpm test glob was directory-enumerated and depended on authors remembering to widen it: latent, no committed test was ever skipped

TERRA-38 terra Done

First terra applog digest triaged: no terra defect - login:no-profile is a separate toast sink, PKCE loss was Supabase JS's own verifier storage

TERRA-37 terra Done

TERRA-22 screening instrument: inter-login interval near 60min on signInCompleted

TERRA-23 terra Done

Terra-side applog/alert-rail coverage

TERRA-3 terra Done ↳ EVO-84

server.ts swallows cookie-write failures on a safety condition (middleware) that does not exist in terra

TERRA-19 terra Done

Terra function set: no pinned search_path on SECURITY-adjacent functions

TERRA-8 terra Done

Confirm enamel whole-DB backup coverage for the shared project

TERRA-4 terra Done

Three shipped comments disagree on whether terraCirugias has rows, and /administrar's stated purpose depends on the answer

TERRA-65 terra Done low

The push gate never sees a new migration unless a human names it in a test: only terra_16 and terra_19 are read

TERRA-63 terra Done low

login:no-profile logs a correct denial at warn on every unregistered visitor: per-code severity or a traced benign arm

TERRA-39 terra Done low

Stale bare-name GUC reference in db/specs/appevents-pruner-design.md, deliberately excluded from a621cb6 to avoid sweeping another lane's uncommitted work

TERRA-49 terra Done low

DELETE/TRUNCATE-class guards stay 'O' (21 triggers, all 12 tables): ENABLE ALWAYS traded away on purpose

TERRA-34 terra Done low

Lint guard: ban runtime-derived origins in auth paths

TERRA-21 terra Done low