PROD debe ser copia del sqlite de RUTAP (v_rutap_latest)

MOVILBA-13 movilba Backlog urgent

└─ CORREGIR 12: clase F, conflictos reales campo a campo

MOVILBA-25 movilba Backlog high

└─ CORREGIR 10: importador debe ingerir altas recientes y filas cerradas

MOVILBA-23 movilba Backlog high

└─ Relleno '0' textual en id_adas / ip_mdvr / ip_canbus: 2012 celdas, cero NULLs en prod

MOVILBA-30 movilba Backlog

Wedged/booting session is electable as PM and can be handed the queue flush (register fakes liveness)

MSG-289 llmmsg-srv Backlog urgent ↳ MSG-285

EPIC: ONEDB target flip — telemetry consolidation onto venus-pg (supersede whey-pg)

VENUSINF-1 venusinfra Backlog urgent

└─ Confirm + record: venus-pg is the consolidation target; supersede whey-pg in ONEDB-12/10 + one-db/DESIGN.md

VENUSINF-6 venusinfra Backlog

└─ Repoint venus-kpi-collect + whey/lezama remote writers to venus-pg

VENUSINF-9 venusinfra Backlog

└─ Provision postgres17 on venus (data dir, listen_addresses, telemetry db + telemetry_rw role)

VENUSINF-7 venusinfra Backlog

└─ pg_hba + network: allow whey + lezama as remote writers to venus-pg

VENUSINF-8 venusinfra Backlog

└─ Cross-update ONEDB WIs (ONEDB-12 ingestion, ONEDB-10 pg-write flip) for new target host

VENUSINF-10 venusinfra Backlog

Implantologia and reconstruccion alveolar need modulo-specific fields (injerto, zona dadora, barrera, marca de implantes): never built, shape undecided

TERRA-76 terra Backlog high

Shared support tables have zero DB-side access control: no RLS, owning role, cross-tenant with terra

ENAMEL-28 enamel Backlog high

Support-ticket API parity - create/triage/status ops + list read, no UI-only actions

PLUTO-700 pluto Backlog high

Venus-consolidation: unified service on host venus for Vercel/Supabase background work

EVO-86 evolutiva Backlog high

Mars OAuth redirect_to bypasses resolveSiteOrigin() + 3 uncanonicalized prod hosts (TERRA-20-derived)

MARS-642 mars Backlog high

Interno desactualizado en 2 vehiculos: AB674IP y AF106VS no coinciden con el SSOT de RUTAP

MOVILBA-43 movilba Backlog high

Refactor: historial de vehiculo pasa a log append-only con workflow (reemplaza el parche de forzar Otro)

MOVILBA-42 movilba Backlog high

└─ vehiculo_historial: no hay columna que diga cual es la fila vigente - borrado_en y creado_en estan sobrecargados

MOVILBA-12 movilba Backlog

Live schema and db/migrations have drifted: full both-directions inventory needed

ENAMEL-26 enamel Backlog high

Agents running outside tmux are silently uncoverable by the actuator: no statusline to read, no pane to keystroke, no alert (pm-llmmsgsrv-cc at 76.4% uncovered right now)

OPS-125 agent-ops Backlog high

Persist-marker latch: PRE-COMPACT PERSIST re-asks an agent that already replied DONE-NO-DELTA (4 confirmations, needs agent_state migration + cross-rail state)

OPS-115 agent-ops Backlog high

Operator-alert attempt ceiling (3.5s) sits below the SMTP transport's own connect timeout (10s) — races away connections that would have succeeded

PLUTO-688 pluto Backlog high

Minimize non-actionable PM DMs at the ALERTER (not just app-side rows). Each alert DM = a PM turn = tokens (Elazar 2026-06-29). Scanner-probe silencing cut the warn ROWS fleet-wide (PLUTO-450/453/454 + mars/venus), but the applog/errscan digest still DMs each PM per tick incl non-actionable warn/info lines. RULE: alerter DMs a PM ONLY on level=error/fatal OR a genuinely NEW/unseen signature; NEVER re-DM known silent-tier (info/security) scanner shapes or recurring-benign signatures. Two legs: (1) shared errscan digest (owner bin-whey-cc, ~L244/L309 PM-digest render + the source view predicate) suppress non-error/non-novel; (2) per-project applog-pull digest (each PM's project) same predicate. Fleet-wide; all 3 PMs align in aro:evolutiva-management. Distinct from EVO-46 (count mislabel) though same render path.

EVO-47 evolutiva Backlog high

Consolidate Evolutiva backups into one performed/monitored/inventoried lane

VENUS-357 venus Backlog high

Greenfield transactional email stack: dispatcher chokepoint, admission+egress guards, durable outbox

ENAMEL-16 enamel Backlog high

Unpinned authz-scope functions need explicit search_path design (pg_temp fleet finding)

PLUTO-666 pluto Backlog high

applog rail: 404/probe path CLASSIFIER + 4-outcome taxonomy — must land BEFORE any suppression predicate on any rail (both per-app predicates withdrawn)

VENUS-327 venus Backlog high

applog-listen category filters assume VENUS literals — both are INERT on pluto (security=0 rows, access=0 rows); four rails, one file, four vocabularies

VENUS-326 venus Backlog high

getFrictionDigest: column reference "createdAt" is ambiguous — real SQL error, invisible 14 days because category='security' is bot-filtered to log-only

VENUS-325 venus Backlog high

applog alert delivery: pages routed to the emitter script (scrp-applog-*) instead of a human inbox, all rails

VENUS-322 venus Backlog high

Push staged appEvents-standard + retired-identifiers commons edits once objection window closes (hub 07:58 / 10:58 UTC 2026-07-30)

EVO-85 evolutiva Backlog high

Retroactive audit-PASS verification: 21 Class-A commits with uncited self-noted verdicts

PLUTO-646 pluto Backlog high

Account access-state (Activa/Desactivada), no-soft-delete-for-inactivity

EVO-81 evolutiva Backlog high

Supabase supautils force-grants PUBLIC EXECUTE on new public objects: fleet REVOKE-explicit standing pattern + live-exposure sweep

EVO-71 evolutiva Backlog high

EPIC: read/analysis/consumption surface

WEBUSAGE-2 webusage Backlog high

lastPractica/inactiveStudents: persisted-attribution scope-gate

PLUTO-575 pluto Backlog high

SOP support-ticket API: full CRUD + private stakeholder comments + notify-list, per app

EVO-52 evolutiva Backlog high

└─ SOP support-api: add ticket CRUD (close/status/notify) + private stakeholder comments

MARS-467 mars Backlog high

pruneStale wipes aro memberships of sleeping-host agents; make membership sticky across stale-prune

MSG-270 llmmsg-srv Backlog high

Harden status-ping reroute: catch leading-*** ceremony banners to Elazar

MSG-269 llmmsg-srv Backlog high

hourly LLM concision sampler for agent-to-agent messages

VENUS-224 venus Backlog high

Route hub-originated alerts (silence-detector/pmidle/dormant-PM) OFF HUMAN_AGENT to a PM/ops lane

MSG-265 llmmsg-srv Backlog high

Hub: brainstorm-brief to an aro with an open session silently DISCARDS the brief body (hub.mjs:2585) — make deflect non-destructive

MSG-261 llmmsg-srv Backlog high

Legal review: HC data residency under Ley 25.326

ENAMEL-1 enamel Backlog high

Agent name parsing: forbid dashes inside role/project (single-token parts only)

OPS-72 agent-ops Backlog high

Memory-discipline policy: make enforcement discoverable fleet-wide (whey/venus/lezama)

MSG-179 llmmsg-srv Backlog high

└─ Land canonical memory-discipline.md in sh.git (docs/md), commit+push; nw-* pull propagates to 3 hosts

MSG-181 llmmsg-srv Backlog high

└─ Consolidate evolutiva-memory-discipline.md into fleet-neutral canonical + scrub project/agent names for public sh.git

MSG-180 llmmsg-srv Backlog high

└─ Per-host global CLAUDE.md: add memory-discipline.md to Lazy-loaded + 2-line enforcement pointer (whey/venus/lezama, one commit each)

MSG-183 llmmsg-srv Backlog high

└─ Stub evolutiva-memory-discipline.md -> sh.git canonical; update maintainer-agents.md pointer

MSG-182 llmmsg-srv Backlog

└─ Acceptance gate: fresh agent on each host must cite the policy+thresholds when asked is-there-a-md-policy

MSG-184 llmmsg-srv Backlog

└─ memory-discipline.md threshold divergence: prose (§10/§13/§15 ~4k tok/150-200 lines/8000 budget) != enforced memlint-cron.sh (600 warn/1200 trim); make doc reference script as threshold SSOT, drop duplicated numbers

MSG-185 llmmsg-srv Backlog

Agent-hygiene: automated CLAUDE.md/memory bloat detection + LLM compression (fleet-wide)

MSG-160 llmmsg-srv Backlog high

└─ chat-duo Agent Hygiene pane: surfaces top-bloat agents from /agent_hygiene

MSG-167 llmmsg-srv Backlog low

Admin: delete data (different from self-erasure CR-290)

AYUD-81 ayudarg Backlog high

ARO topology v3 fleet-wide rollout (epic)

MSG-174 llmmsg-srv Backlog high

└─ Phase 6: llmmsg-protocol.md §ARO Membership + §Routing rewrite

MSG-178 llmmsg-srv Backlog

Land reviewed ca.sh in sh.git (after PM draft review); commit+push

MSG-188 llmmsg-srv Backlog high ↳ MSG-186

dbcaba backup gaps: dev backup targets wrong db + gdrive backup-mirror broke 2026-05-16 (dbcaba has no auto-backup today)

OPS-76 agent-ops Backlog high

multi-subscriber SSE + sender echo + client dedupe (chat-duo + chat-duo-web cohabit)

MSG-118 llmmsg-srv Backlog high

lezama split-brain: island-b hub (llmmsg-srv.service) auto-started, isolated lezama agents from whey hub

MSG-194 llmmsg-srv Backlog high

backup-whey.service: NOPASSWD sudo for cryptsetup+mount in /etc/sudoers.d/backup-whey (failing since run #23 2026-05-08T14:22 - sudo prompts for rob pw under systemd no-tty); owner: os-whey-cc-w

OPS-32 agent-ops Backlog high

UX app-wide: diferenciar visualmente botones vs badges vs tarjetas

AYUD-85 ayudarg Backlog high

Global PreToolUse enforcement hook: deny non-llmmsg-srv-team agents Edit/Write to /opt/llmmsg-srv/{hub,bridge,scripts/lib}/** + deny Bash curl/http to hub privileged endpoints (extend existing PATH-script-block hook). Elazar approved ship - recurring: agents edit hub code/curl API instead of MCP tools.

OPS-79 agent-ops Backlog high

Design + LIVE-TEST ca.sh: reads ca= from .agent-name, codex --dangerously-bypass-approvals-and-sandbox, injects -c mcp_servers.llmmsg-srv.env.LLMMSG_AGENT_NAME + LLMMSG_HUB_URL; PROVE shim auto-registers under ca name (roster check) before calling done

MSG-187 llmmsg-srv Backlog high ↳ MSG-186

Close aro_config auth gap: token-gate POST /aro_config + other privileged hub writes so a forged caller=elazar fails (coder-applog-cc exploited it to flip aro:applog PM). Elazar approved ship.

MSG-201 llmmsg-srv Backlog high

Alert when a CC session is blocked on interactive prompt (AskUserQuestion menu / permission approval / ExitPlanMode): wire CC Notification hook (or transcript-watcher fallback) to DM elazar via llmmsg-srv naming the blocked agent+host. Solves operator having to hunt tmux windows. Research dispatched to claude-code-guide.

MSG-202 llmmsg-srv Backlog high

lezama host-dark recurrence: root-cause + harden against full-dark (2nd occurrence; died 2026-06-01 18:03 ART, clean cliff)

OPS-80 agent-ops Backlog high

└─ Reboot forensics: journalctl -b -1 -k (panic trace=crash / empty=power loss) + full -b -1 (OOM?), dmesg|tail-50, df -h, last -x reboot, smartctl -a

OPS-81 agent-ops Backlog high

└─ Validate the installed recovery software (failed twice): identify unit, check prior-boot status+journal (fired/tried/failed?), confirm dead-kernel/power is below userland scope; validate reverse-tunnel health EXTERNALLY from whey, never trust the ssh_r_active self-report flag

OPS-82 agent-ops Backlog high

└─ lezama single-path fragility: all 5435 probes since May23 are public-dns with zt_whey_visible=0 (ZeroTier fallback never worked); make ZT a real 2nd route + fix phantom ssh_r_active self-report

MSG-205 llmmsg-srv Backlog

└─ lezama host-dark alert: watchdog fires notify-elazar+eq after 3 consecutive 'unreachable' skips (~15min), instead of silently skipping forever

MSG-204 llmmsg-srv Backlog

└─ lezama out-of-band reset: a dead kernel cannot self-recover; scope IPMI/iDRAC vs smart-PDU for remote host-dark power-cycle (blocked on Elazar: does box have IPMI?)

MSG-206 llmmsg-srv Backlog low

Plugin hygiene v2 - lezama host portion: telegram uninstall + host-global lean flip + movilba per-agent enables (see parent 459)

OPS-59 agent-ops Backlog high ↳ OPS-58

Transport reliability + observability program (whey/venus/lezama)

MSG-149 llmmsg-srv Backlog high

└─ Idle over-budget agents never self-compact: wire host-side actuator (whey/lezama)

MSG-207 llmmsg-srv Backlog high

└─ Fleet context-cost rollout: send-keys /compact watchdog + aro_leave-on-idle

MSG-210 llmmsg-srv Backlog high

└─ cc-context-monitor safety-net: flag/extend nag for agents that miss self-leave (seq AFTER rule lands)

MSG-213 llmmsg-srv Backlog

└─ WI592 nag: drop CronCreate /compact from emit_context_budget_nag interactive branch once send-keys watchdog verified fleet-wide

MSG-214 llmmsg-srv Backlog

└─ cc-context-monitor measured role-cap version (floor+EOQ headroom) - successor to #617 seed caps

MSG-217 llmmsg-srv Backlog low

└─ path-B UserPromptSubmit injection copy: reframe CronCreate as automatic-fallback not manual action (avoid conflict w/ v2.13 over-cap DM)

MSG-218 llmmsg-srv Backlog low

└─ chat-duo-web 9704 to lezama: move off whey-initiated -R (VPN-dependent) to lezama-initiated -L over public route

MSG-208 llmmsg-srv Backlog

└─ Shim transport prefer-list: loopback -> ZT -> public DNS (defer until W3+W4 prove design)

MSG-158 llmmsg-srv Backlog low

memory-budget over-budget warning: route shared-file footprint breaches to project PM with escalation chain

OPS-57 agent-ops Backlog high

eq backend unbuilt: hub.mjs has no /eq_* routes + no elazar_questions table — eq CLI POSTs to non-existent endpoints (/eq_ls returns not_found). chat-duo Pending panel reads elazar_questions, so no Elazar question can ever surface. Implement hub-side /eq_add /eq_ls /eq_show /eq_answer /eq_dismiss /eq_stale + elazar_questions schema per eq-spec.md

OPS-49 agent-ops Backlog high

chat-duo-web tablet-grade evolution (path A for unified browser client)

MSG-171 llmmsg-srv Backlog high

cc-context-monitor path-B/wind-down DM mis-targeting: db-mars-cc remediation delivered to nw-venus-cc

OPS-9 agent-ops Backlog high

Make context-budget nag idempotent: stop re-nagging every turn + stop stacking /compact crons after compact

MSG-12 llmmsg-srv Backlog high

Codex receive-bridge: sidecar tmux-poke so Codex agents auto-drain llmmsg unread (no live push)

MSG-10 llmmsg-srv Backlog high

└─ HARD PREREQ: derive + test a Codex-specific ready-prompt regex for idle-gating (CC matcher will NOT transfer; wrong matcher = corrupted-buffer poke). No send-keys goes live until validated.

MSG-11 llmmsg-srv Backlog high

DECISION (Elazar): kpi.pensanta.com exposure - Tailscale-only (team rec: bind whey tailnet IP, no TLS/cert ops, no public attack surface) vs public-TLS

ONEDB-6 one-db Backlog high ↳ ONEDB-5

one-db: 5 telemetry sqlite -> Postgres17 consolidation (umbrella)

ONEDB-1 one-db Backlog high

└─ DECISION (Elazar): make ~/Documents/terminal/one-db its own git repo? bin (PM) owns the call

ONEDB-7 one-db Backlog high

EPIC: agents-efficiency-KPI - per-agent context/token efficiency report Elazar actually sees (Elazar 2026-07-02: 'never seen a report on that'). Inputs: usage polls + context samples (venus PG). Deliverable: recurring per-agent report (tokens/turn, cache-read overhead, context growth, compact frequency) surfaced to Elazar. Coordinate: bin-whey-cc (one-db data), coder-llmmsgsrv-cc (kpi views/report script)

SAVETOKE-33 saveTokenz Backlog high

Epic: General — cross-fleet token reduction (message size, batching, routing)

SAVETOKE-1 saveTokenz Backlog high

└─ Fleet: never-multi-recipient audit — audit-mars-cc (394 msgs all 1-to-1), audit-mba-l-cc, db-basquetwi-cc never use array sends; coach + verify adoption

SAVETOKE-24 saveTokenz Backlog

└─ Role/agent-scope the eager MEMORY.md index — needs ccs.sh launcher change. MEMORY.md index is the ONE memory file eager-loaded every turn; today it's keyed per-PROJECT (by cwd), so e.g. db-mars-cc's eager index carries coder-only entries it never uses. Re-key the index per-AGENT so each agent eager-loads only its own index lines (individual fact files stay lazy as today). Launcher/sh.git change (ccs.sh memory-path derivation). Owner: bin-whey-cc + pm-llmmsgsrv-cc coordinate (sh.git). Resolves Elazar's per-agent-memory premise at the eager layer where it actually costs tokens.

SAVETOKE-31 saveTokenz Backlog

└─ Codification-arrow discipline: graduate stable per-agent memory facts into ROLE-scoped commons, prune the memory copy. evolutiva-memory-discipline.md §4 already defines memory->commons graduation; make it routine so durable role-shared knowledge lives once in role-commons (shared, deduped) instead of being re-derived in each agent's memory. Pairs with the two structural WIs above; ongoing per-PM hygiene, not a one-shot. Cross-fleet discipline.

SAVETOKE-32 saveTokenz Backlog

Epic: Venus — venus ARO token reduction

SAVETOKE-2 saveTokenz Backlog high

└─ pm-venus-cc send consolidation: collapse sequential status/decision within a 30-min window into one post; eliminate ack-only/phatic sends. Baseline 185 deliveries/50-per-hr peak/16 rapid Elazar exchanges. Target 185->140 deliveries.

SAVETOKE-15 saveTokenz Backlog

└─ Worker coordination OFF aro:venus: intra-team coder<->audit back-and-forth via DM; reserve ARO for PM summary + brainstorm turns only. Baseline aro:venus = fleet top-cost ARO, 77k tokens/416 msgs/24h.

SAVETOKE-16 saveTokenz Backlog

└─ coder+audit-venus large-ARO trim: design-justifications/audit findings post HEADLINE+3-bullet to ARO, full detail DM to PM/counterpart. Baseline coder avg 888 chars, audit 1100+ chars/msg; design-ping 4281-char samples.

SAVETOKE-17 saveTokenz Backlog

└─ audit-venus checkpoint batching: 3+ audit checkpoints within 2hr collapse to one batched post; PASS/BLOCK verdicts stay single-line. Baseline audit-venus 90 deliveries/24h, burst-flagged.

SAVETOKE-18 saveTokenz Backlog

Epic: Mars — mars ARO token reduction

SAVETOKE-3 saveTokenz Backlog high

└─ db-mars-cc tiny-send batching: 14 sub-52-char status acks/24h; fold working:/done: into fewer messages per task

SAVETOKE-13 saveTokenz Backlog

└─ audit-mars-cc: adopt array multi-DM (to:[...]) for shared findings — 394 msgs/24h ALL 1-to-1, same finding sent separately to pm+coder; ~10,600 tokens/day (biggest single Mars lever)

SAVETOKE-9 saveTokenz Backlog

└─ pm-mars-cc <-> db-mars-cc ping-pong: 27 rapid exchanges/24h (~6,315 tokens); batch dispatch+result into fewer round-trips, drop sub-30s over-checking

SAVETOKE-11 saveTokenz Backlog

└─ coder-mars-cc/audit-mars-cc oversized ARO design-pings: 4400-char 'never-directive' mandates to ARO; headline+summary in ARO, full detail DM-to-PM/assignee

SAVETOKE-12 saveTokenz Backlog

Epic: Pluto — pluto ARO token reduction

SAVETOKE-4 saveTokenz Backlog high

└─ aro:pluto worker post-size: coder-pluto-cc (avg 1137 chars/delivery) & audit-pluto-cc (avg 1118) post full design-pings/audit-findings to the room. Move to headline+summary in ARO, full detail (file paths, gate criteria, evidence) DM to PM/assignee. Target ~400 chars/ARO post. Saves ~700 chars x ~150 posts/day.

SAVETOKE-27 saveTokenz Backlog

└─ aro:pluto reframe worker->PM mandate posts (KPI Finding 8): coder-pluto-cc 'never-directive' (4590 chars) + audit-pluto-cc 'do-not' (4465 chars) one-way mandates to pm-pluto-cc. Pattern: worker PROPOSES (concise) in ARO/DM, PM decides+announces. Removes 4k-char one-way mandate posts + clarifies accountability.

SAVETOKE-28 saveTokenz Backlog

└─ aro:pluto tiny-send batching (low ROI): db-pluto-cc (+ others) emit separate 'working:'/'done:' status acks (31-247 chars). Batch into single first+last-action message per task. Minor per-send tag/overhead savings; flag-only, not urgent.

SAVETOKE-29 saveTokenz Backlog

Epic: llmmsg-srv — hub/MCP/infra token reduction

SAVETOKE-5 saveTokenz Backlog high

└─ Fix v_large_aro_content_24h view: add recipient LIKE 'aro:%' filter (currently over-counts DMs with origin_aro carry-through as ARO fan-outs — inflates coaching false positives)

SAVETOKE-19 saveTokenz Backlog

└─ Hub: implement /breaker auto-reset after N hours if tripped by legitimate traffic (today required manual reset, blocking Elazar DMs)

SAVETOKE-20 saveTokenz Backlog

└─ Haiku KPI: add fixed v_large_aro_content_24h + re-run coaching after view fix to get accurate per-agent attribution

SAVETOKE-21 saveTokenz Backlog

Epic: Movilba — mba-l ARO token reduction

SAVETOKE-6 saveTokenz Backlog high

Epic: NightWatch — night-watch processes token reduction

SAVETOKE-7 saveTokenz Backlog high

Epic: AlertsAndStatusMessages — alerts, status, scraper messages token reduction

SAVETOKE-8 saveTokenz Backlog high

└─ context_monitor scraper: 12 msgs/day × 966 chars each = 11.6k chars to agents already over budget — add backoff (stop sending after 3 consecutive over-budget pings; resume only after /compact)

SAVETOKE-22 saveTokenz Backlog

└─ KPI scraper: fan-out to 5 recipients on each send — switch to single DM to pm-llmmsgsrv-cc only; PM decides if fleet needs it

SAVETOKE-23 saveTokenz Backlog

gitpush.sh strict-mode: detect staged deletions in ONLY_PATHS and commit them (git rm --cached silently dropped today)

MSG-109 llmmsg-srv Backlog high

Hub SIGTERM handler hangs on shutdown — ~90s blackout per restart

MSG-83 llmmsg-srv Backlog high

Sensitive-files backup to backupYes LUKS USB (whey-state-backup.sh) — maintainer nw-whey-cc. DONE: restarted timer (dead since 06-17 reboot, 9d gap) + added ~/.local/bin/.llmmsg-env+.agent-name coverage (v1.1.0, verified). OPEN/Elazar: exclude ltm.md from gdrive leg (holds creds); mars.env NOPASSWD read-rule; off-whey LUKS keyfile+passphrase (SPOF).

OPS-25 agent-ops Backlog high

pluto EVO-19 leg: two-sink fix; UA-tagged causal proof (5x /login -> 5 phantom rows on 200) + matcher-excluded empty-route blindspot; ship

EVO-22 evolutiva Backlog high ↳ EVO-19

OPS-25: rkhunter-scan.sh email malformed — wrong From (envelope=elazar.pimentel vs body=evolutiva), raw HTML renders (dup header block before <html>), WARNING COUNT='0\n0' (stray newline). Fix all three, re-verify rendered output.

MSG-79 llmmsg-srv Backlog high

OPS-24: notify-nw.sh ORIGIN_ARO env support — script must read ORIGIN_ARO from env and pass origin_aro to hub send; without it DM routes without origin_aro regardless of EnvironmentFile

MSG-78 llmmsg-srv Backlog high

OPS-23: hub.pensanta.com DNS repoint — A-record still 172.27.178.27 (dead ZT IP), blocks all venus scrp- DM legs; update Hostinger DNS to real venus IP

MSG-77 llmmsg-srv Backlog high

scrp- convention migration: fleet-wide rename + aro:hosts-status creation (coordinated pass, bin-whey-cc coordinates)

OPS-21 agent-ops Backlog high

Infra cleanup phase 1: canonical URL migration to hub-t.pensanta.com fleet-wide + kill-list execution post Elazar GO (tracked in /gdrive/systemd-audit-*/)

MSG-93 llmmsg-srv Backlog high

Migrate bwi authoritative writer from whey to venus (wi-http.service + bwi-venus-tunnel) — prerequisite for whey backup-only retirement

MSG-92 llmmsg-srv Backlog high

Render/server errors in appEvents (appLog): verify capture parity across pluto, mars, venus + fill gaps

EVO-4 evolutiva Backlog high

KPI Track A: ADD pg views (usage.v_kpi_tokens_7d + context.v_kpi_compact_7d) + extend scrp-kpiweekly-whey (email + snapshot/live-read)

MSG-54 llmmsg-srv Backlog high

POST /unregister route: deregister permanence for VENUSINF waves - {agent,caller,[bearer]}; txn validate->capture-PM-AROs->deleteAroByAgent->electPm-each->deleteRosterRow; PRESERVE cursors (optional purge_cursor:true default false); idempotent 200 already_absent; auth self-dereg ungated + admin-dereg edge-bearer interim soft-dep #599; HTTP-only (no MCP tool). Replaces hand-SQL roster DELETE dereg-at-cutover.

MSG-38 llmmsg-srv Backlog high

Hub leaks direct DMs into sender's home ARO: kind=dm fanned to origin_aro roster (cc-context-monitor-venus DMs reaching nw-venus-cc)

MSG-13 llmmsg-srv Backlog high

Post-/compact re-register reliability: hook-fire blind spot + hook-independent shim re-register net

MSG-5 llmmsg-srv Backlog high

E1: Audit & Standardize

CLEDGER-1 cledger Backlog high

Real-time error tee: appEvents AFTER-INSERT pg_notify trigger on Pluto Supabase (error→PM DM, warn stays in digest). GATED on nw-venus's exact spec (channel name, WHEN-clause, payload — byte-identical channel+payload across 3 apps; host listener LISTENs + DMs PM). Pluto level vocab = error|warn|info (NO fatal) so WHEN-clause = level='error'. Pre-apply audit review per DDL discipline. Additive/reversible. Do NOT start until spec lands + 112 done.

PLUTO-116 pluto Backlog high

Spurious unread-poke loop: read_unread cursor-ack is fire-and-forget (race) + drain-on-other-tools acks only on next poll + poker lacks debounce/idle-gate

MSG-35 llmmsg-srv Backlog high

init-db.sh drift: stale messages schema (generated tag + phantom cols) contradicts hub.mjs self-create / live DB - reconcile or demote

MSG-32 llmmsg-srv Backlog high

Mobile-first refactor (Elazar all-app directive): audit + base-up redesign of layouts/nav/forms/touch-targets/breakpoints

PLUTO-40 pluto Backlog high

Normalización de Ambiente de Correos

ADRIANAP-3 adriana-pavon Backlog high

└─ Audit all accounts/devices: map which client (iPhone, Mac, old PC) has which account and protocol (POP vs IMAP)

ADRIANAP-4 adriana-pavon Backlog

└─ Disable POP3 on prensa@ and hola@ in DonWeb cPanel

ADRIANAP-5 adriana-pavon Backlog

└─ Fix Cloudflare DNS: merge duplicate SPF records, add DKIM key from DonWeb, add DMARC record

ADRIANAP-6 adriana-pavon Backlog

└─ Write IMAP config guide for all 6 accounts (prensa@, hola@, 3x Gmail, iCloud) for iPhone + Mac

ADRIANAP-7 adriana-pavon Backlog

└─ Coordinate handoff to IT tech who will apply IMAP config on devices

ADRIANAP-8 adriana-pavon Backlog

Recover lost 2026-05-26 evolutiva-commons patch: §Shared MD Flow + §Versioning + §Boundaries B1/B4/B5 — check llmmsg message DB for original content

OPS-12 agent-ops Backlog high

EPIC: venus hardening (public-IP attack surface) — GATES service exposure

VENUSINF-4 venusinfra Backlog high

└─ nftables/ufw default-deny + per-service allow rules

VENUSINF-19 venusinfra Backlog

└─ ssh lockdown (key-only, no root login) + fail2ban

VENUSINF-20 venusinfra Backlog

└─ Per-service bind/least-exposure audit (pg/hub/smtp listen only where needed)

VENUSINF-21 venusinfra Backlog

└─ unattended-upgrades + basic intrusion/monitoring on venus

VENUSINF-22 venusinfra Backlog low

EPIC: llmmsg hub + runtime DB → venus

VENUSINF-2 venusinfra Backlog high

└─ Repoint whey + lezama MCP shim + bootstrap to venus hub endpoint

VENUSINF-13 venusinfra Backlog

└─ Point llmmsg-hub.pensanta.com (DNS) at venus public IP

VENUSINF-14 venusinfra Backlog

└─ Stand up llmmsg hub service on venus (v2-hub.mjs, port 9703, systemd)

VENUSINF-11 venusinfra Backlog

└─ Migrate runtime DB v2.sqlite whey→venus (quiesce, copy, integrity-check)

VENUSINF-12 venusinfra Backlog

└─ Burn-in then decommission whey hub

VENUSINF-15 venusinfra Backlog low

GATE#1 step v: remote-monitor ingestion — venus/lezama write whey-pg DIRECTLY per-host (NO ssh-pull). Transport: venus=ZeroTier 172.27.178.27 or Tailscale; lezama=ssh -w L3 tunnel only (GCABA blocks ZT+TS), pg client→172.30.0.1. whey: listen_addresses + pg_hba for both + telemetry_rw role. nw co-owns

ONEDB-12 one-db Backlog high ↳ ONEDB-2

GATE#1 step ii: repoint 5 sqlite readers to pg telemetry_ro — netreport.sh, testnetwork --report, ccusage-daily-kpi.sh, llmmsg-kpi-report.sh, memory-lint.sh

ONEDB-9 one-db Backlog high ↳ ONEDB-2

GATE#1 step i: add reporter-set pg views to schema.sql (network v_history/v_report/v_by_wifi; kpi 3-day window) — distinct from coder's dashboard views; back the 5 sqlite readers

ONEDB-8 one-db Backlog high ↳ ONEDB-2

attach-tmux.sh nests tmux/stacks extra login shell on switch-client path (recurring, 'fixed 5x')

OPS-10 agent-ops Backlog high

Archive triggers RAISE on a missing app.user_id but silently NULL a missing app.archive_reason, so commons promises loud failure it does not deliver

PLUTO-707 pluto Backlog

CLAUDE.md cites a 6-prefix archiveReason policy that is defined nowhere in the repo

PLUTO-706 pluto Backlog

users.lastSignInAt is never written - the adoption instrument is accidentally-always-zero

TERRA-80 terra Backlog

Odontogram offers deciduous teeth 51-85 which cannot take implants: terra has an exclude scope row for exactly this and it is not narrowing

TERRA-77 terra Backlog

Citation gate must state its own bound: shape-checked, not authorization-verified

TERRA-71 terra Backlog

appEvents is now a HARD DEPENDENCY of two terra user actions: a rejected INSERT rolls back the state change, and the constraints live on a shared table the co-tenant can alter

TERRA-70 terra Backlog

Comment notification quotes empty-content comments and fires on aprobado practicas

PLUTO-703 pluto Backlog

push-scope-guard write-side recovery tooling (captured-index disentangle)

EVO-87 evolutiva Backlog

Admin action: agregar participante omitido a una practica fuera de la ventana de 48h

VENUS-372 venus Backlog

PKCE exchangeFailed on first sign-in: instrument shipped, population gone, unresolved between two lanes

TERRA-51 terra Backlog

applog-pull zero-row path skips writeWatermark — permanent cold-start gap

VENUS-370 venus Backlog

Support-agent registry + atomic assign/list-budget functions for support-API

MARS-648 mars Backlog

Práctica edit-quota lock burns a slot on tab-abandon, not just on save

MARS-646 mars Backlog

Lezama context/token telemetry -> venus canonical store

ONEDB-16 one-db Backlog

OAuth redirectTo pinned to validated canonical origin (was window.location.origin)

PLUTO-699 pluto Backlog

AI357EF/EG/EH figuran en Alta en la app pero RUTAP cerro todas sus filas el 13/08

MOVILBA-44 movilba Backlog

Importador RUTAP: el scan de contaminacion cubre solo NBSP (1 de 5 clases) - detectar y reportar, nunca auto-corregir

MOVILBA-40 movilba Backlog

Calidad de dato en expediente / expediente_baja de vehiculo_historial: el campo no esta tipado (5 poblaciones medidas)

MOVILBA-39 movilba Backlog

└─ Cadena de expedientes RUTAP: 152 bajas cuyo expediente no es el alta del tramite siguiente

MOVILBA-38 movilba Backlog low

└─ Tramite duplicado en vehiculo_historial: 7394 y 7400 (AD956UK) misma fecha de alta y de baja

MOVILBA-37 movilba Backlog low

Catalogo vehiculos_subtipos_transporte con descripciones duplicadas activas

MOVILBA-33 movilba Backlog

llmmsg-reconcile.sh: populate detail (RECONCILE_NOTE) + name agent in invoked_by

MSG-291 llmmsg-srv Backlog

Standardize /alumnos filters onto the shared URL-param filter pattern

MARS-635 mars Backlog

kpi-coach rubric: cover lock banners + N-separate-DM fanout

MSG-287 llmmsg-srv Backlog

Declare maxDuration on /api/image, then set fetchImage timeout bound from sampled data

PLUTO-697 pluto Backlog

fetchImage needs AbortSignal.timeout, bound picked from Pluto's own latency data

PLUTO-696 pluto Backlog

Grading-path notification+email both lost on pool timeout (Class-A)

PLUTO-693 pluto Backlog

logCaughtError drops error.cause — every caught fetch failure is un-attributable

PLUTO-691 pluto Backlog

Historia clinica: the stated initial focus, zero app surface, pacientes table empty

ENAMEL-24 enamel Backlog

Opportunistic compliance: rename tipoDocumento/numeroDocumento -> documentoType/documentoNumber (entity-first) on users + accessRequests; confirm stored value stays lowercase 'dni'/'pasaporte' (Mars already correct)

MARS-406 mars Backlog

Hub: generalise rail-sender prune exemption from name regex to push-only-producer property (held diff, awaiting audit)

MSG-280 llmmsg-srv Backlog

139 restored report files sit uncommitted; 27 folders have no recovery path

WEBSITES-14 websites-tools Backlog

Add venv self-bootstrap to the remaining agent-callable scripts

WEBSITES-13 websites-tools Backlog

Maintainer registry rows for admin-websites-cc not yet inserted

WEBSITES-4 websites-tools Backlog

google-ads-report.py fails on Google Ads API v23

WEBSITES-1 websites-tools Backlog

Alert windows that straddle a host reboot are reported as agent faults: no-statusline duration spans downtime the process did not exist for

OPS-126 agent-ops Backlog

context-monitor.sh reports stale ctx for idle whey agents: frozen transcript pins them at >=180k for hours (OPS-11 residual, action gated but read still wrong)

OPS-124 agent-ops Backlog

Commanded /compact does not land: 3 agents measured unverified in one pass, root cause unknown

OPS-107 agent-ops Backlog

Rule 3 silence-default violations

MSG-278 llmmsg-srv Backlog

Rule 9 dossier-dump-inline detection

MSG-277 llmmsg-srv Backlog

Stuck-busy alert has no known-wedged latch: re-fires every 6h forever with no escalate-once path

OPS-122 agent-ops Backlog

Right-size event_log telemetry retention: 7d raw is ~800MB steady state, gates_evaluated JSON is a third of it

OPS-120 agent-ops Backlog

cumulative_usage() lacks the id-dedup token-usage-collect.sh has: my cumulative token numbers overcount streamed turns

OPS-117 agent-ops Backlog

Purga de logs fresh-start (app_logs + audit_log)

MOVILBA-9 movilba Backlog ↳ MOVILBA-1

VENUS-364 — dedup 8 copies of the role-label map onto practica-roles.roleLabel()

VENUS-364 venus Backlog

Audit student-facing counts for operador-vs-participacion conflation

VENUS-362 venus Backlog

Quote SOL-VENUS-N in requester-facing access-request emails

VENUS-361 venus Backlog

weeklyReport es un kind sin fila: el reporte KPI semanal solo existe en vuelo y catchUp() no puede re-barrerlo — perdida silenciosa e indistinguible de una semana tranquila

PLUTO-682 pluto Backlog

resolveFrom honra cualquier SMTP_FROM_* seteado sin validar — Gmail re-estampa el From y el mail sale mal atribuido (ambas vars seteadas en prod)

PLUTO-681 pluto Backlog

setPersonaRoles: replace-the-set sin baseline — dos superficies de admin de roles se pisan silenciosamente y la atribución del archive queda mal

PLUTO-680 pluto Backlog

Fleet DB-hardening directive — pluto leg (logging/principals/backups)

PLUTO-684 pluto Backlog

PostgREST pg_pgrst_no_exposed_schemas error fires every ~32s, drowning the venus postgres log

VENUS-356 venus Backlog

venus-db-backup.sh prune glob crosses lanes — retention 84 total not 84 encrypted; effective 6 days not 7

VENUS-355 venus Backlog

venus-db-backup.sh: trash-fails fallback hard-deletes (rm -f) instead of degrading safely

VENUS-354 venus Backlog

practicaCodigo format: add PRA-MARS- prefix

MARS-614 mars Backlog

Hide non-required fields + require Endodoncia I fields for Endodoncia I students

MARS-612 mars Backlog

Reconcile 'principal' JTP checkbox on /docentes vs no-principal-JTP claim

MARS-610 mars Backlog

Add a main-JTP designation to comisiones

MARS-608 mars Backlog

cc-context efficiency report - read-only reporting layer on monitor-context.sqlite (week/day/48h)

OPS-60 agent-ops Backlog

context-monitor.sh 180k nudge DM promises a 220k injection that cannot happen under COMPACT_ACTUATOR=0

OPS-110 agent-ops Backlog

scan-context coverage alarm is permanent noise: Codex audit-*-ca panes have no CC statusline to read

OPS-109 agent-ops Backlog

supportTicketCounters has no guard - the instrument used to bound a disclosure incident is itself unprotected

ENAMEL-19 enamel Backlog

Add egress deliverability classifier at email-transport chokepoint (distinct from allowedEmailDomains admission gate)

PLUTO-674 pluto Backlog

appEvents has no success row for outbox-path email delivery

PLUTO-675 pluto Backlog

cc-context-monitor zombie-detector false-positives on reactive-idle agents: rule (turns>=2 && tool_calls==0 -> zombie) can't distinguish a self-armed-wakeup zombie from a reactive agent woken by inbound llmmsg DM that acked + stood down with no tools needed. At 05:00 it flagged audit-venus-cc (benign: empty CronList, zero ScheduleWakeup ever, 100% inbound-DM-driven) -> 2 dup alerts + cross-host investigation. Hits EVERY reactive agent (host nw between alerts, audit agents). Fix (nw-whey suggested): a wake is zombie-suspect only if NOT preceded by an inbound message in the window (self-triggered) AND/OR non-empty CronList; if wake correlates with inbound DM + empty CronList -> reactive-idle, suppress. Hub has inbound-msg timestamps to correlate. Related: OPS-11 last_turn stale-read.

OPS-17 agent-ops Backlog

PostgREST empty-exposed-schema sentinel floods postgres log (~2700 ERROR rows/day) — silence or document

VENUS-349 venus Backlog

fn_notify_pm_triage exception-swallow silently drops PM alerts

MARS-596 mars Backlog

fn_isadmin/fn_istitular gate on JWT app_metadata.role — banned shape, dormant while RLS off

VENUS-346 venus Backlog

Sweep SECURITY DEFINER functions for pg_temp shadowing (fleet finding)

VENUS-345 venus Backlog

Exports (CSV + catedra PDF) ignore /informes taxonomy filter params

VENUS-341 venus Backlog

venus applog-pull rail has emitted nothing for 24 days with every liveness instrument green — process alive, function idle, indistinguishable

VENUS-338 venus Backlog

slow-query notice prints to stdout and writes NO ledger row — classify.ts:133's slowQueryPageMs gate has had nothing to act on

VENUS-337 venus Backlog

applog rails execute a LIVE WORKING TREE — point them at a checkout-of-record; venus/scripts is an unrepresented production surface for mars and pluto

VENUS-336 venus Backlog

Enumerate every gate AND discriminator-mutating transform between an appEvents write and a human — venus leg

VENUS-331 venus Backlog

Full write-to-human appEvents consumer/gate/transform enumeration for mars

MARS-590 mars Backlog

Venus PTD cannot bind a SHA to a deployment: no githubCommitSha in either vercel inspect form

VENUS-330 venus Backlog

Venus 404 evidence loss at proxy.ts:114 — the middleware matcher excludes static extensions, so an asset 404 is structurally pathless before any writer runs

VENUS-329 venus Backlog

v_appEvents_404 groups by a half-dead key: no venus 404 writer populates appEvents.path (NULL on 100% of 969 rows)

VENUS-328 venus Backlog

Percent-encoded path evasion bypasses SCANNER_PROBE_RE allowlist entirely

MARS-586 mars Backlog

error-tier toast/error-shown rows would page despite mig 074 mute (warn-only scope)

MARS-584 mars Backlog

Real 404s hidden in alert-rail noise: /login x19, /practicas/<uuid> x36

MARS-583 mars Backlog

Mars measured VENUS-319 burst mispairing: 10 rows stranded

MARS-582 mars Backlog

Venus-side applog rail instrument: DB-to-cursor WORK LAG across all 4 rails + unit-alive assertion

VENUS-320 venus Backlog

applog-listen catch-up watermark stalls permanently when every caught-up row is filtered (venus pinned 15d at 2026-07-15)

VENUS-318 venus Backlog

Applog relay daemon conflates DATABASE with TENANT — no per-tenant routing on shared-DB co-tenants

EVO-84 evolutiva Backlog

Profile photo escalating nag -> hard block on 10th prompt; show photo in practica for teacher identification

MARS-580 mars Backlog

└─ Admin lever to clear a profile-photo block (and handle self-deleted photos re-entering the ladder)

MARS-628 mars Backlog high

└─ Route the profile-photo nag upload through the MARS-567 honest-copy validator before uploadProfileImage

MARS-627 mars Backlog high

route.ts: /api/log-error outer catch swallows its own failures, no appEvents row

MARS-577 mars Backlog

audit-venus-ca retro-review queue (reviewer outage since 2026-07-23)

VENUS-307 venus Backlog

Sweep pre-086 owner-rights agent-granted views to security_invoker=true

MARS-561 mars Backlog

usuarios: DB-backed regression tests for updateAlumno/tier authz matrix

MARS-556 mars Backlog

Teachers can claim out-of-scope students as theirs (JTP/ayudante takeover)

MARS-553 mars Backlog

View-as writes attributed to real admin

VENUS-299 venus Backlog

Document as durable person key (DNI/legajo/passport/CUIT); email+googleSub are rotatable credentials; build email-change re-link flow

EVO-82 evolutiva Backlog ↳ EVO-74

CR G8+G10 — structured pre-op diagnosis + post-op medication fields (v2 candidate, client-decision-pending)

VENUS-295 venus Backlog

Central patient DB + shared identity/auth hub in enamel (mars/pluto/venus consume) - item f

EVO-80 evolutiva Backlog

└─ Formalize numeroHistoriaClinica as validated patient DNI (governance-gated)

MARS-534 mars Backlog

Weekly KPI/report email quality: stop noisy+wrong sends (recipients with no practicas or all-zero KPIs; some users get 4+ emails) — mars+venus+pluto

EVO-72 evolutiva Backlog

EVO-74 prevention: access-request flow must link-to-existing, not spawn a duplicate account (mars/pluto/venus)

EVO-79 evolutiva Backlog ↳ EVO-74

└─ Soft-deleted-user restore + identity-attach explicit two-step design

PLUTO-620 pluto Backlog

└─ User-facing self-suggestion surface (is-this-you link-to-existing)

PLUTO-622 pluto Backlog low

Grader x verdictBucket grade-tendency views to drive MARS-504 backfill coverage trigger

MARS-530 mars Backlog ↳ MARS-504

Pathology/treatment conflation cleanup — client mixed patologías with tratamientos in option lists

VENUS-290 venus Backlog

Document the rectificar student-reminder email workflow: what triggers it, what emails a student actually receives, volume/dedup — then decide cleanup

MARS-525 mars Backlog

Admin pending-items digest email (open support tickets + pending access requests + pending correcciones) to admin — mars+venus+pluto

EVO-75 evolutiva Backlog

Inactive / never-used user cleanup: identify users who never logged in or never used the app, decide disposition (archive vs exclude-from-comms) — mars+venus+pluto

EVO-73 evolutiva Backlog

Static guard: mandatory three-way REVOKE (PUBLIC, anon, authenticated) on every public function-creating migration

VENUS-289 venus Backlog

EVO-69: add createdAt to 15 static catalog tables + fix lookupOptions.createdAt NOT NULL

VENUS-285 venus Backlog

DB: mandate createdAt insert-timestamp fleet-wide (updatedAt recommended)

EVO-69 evolutiva Backlog

iPhone HEIC upload: wasm-decoder go/no-go — gated on MARS-508 instrumentation (userAgent + detail.diag container) format-mix data

MARS-517 mars Backlog

EVO-58: admin storage tile (GB-left / % of 25GB shared api-images quota)

VENUS-278 venus Backlog

Friction-telemetry action/category labeling hygiene (fleet)

EVO-63 evolutiva Backlog

Classify 5 unclassified (category,action) pairs in appEventFrictionClass — false user-facing fallthrough

VENUS-276 venus Backlog

Telemetry-quality: advisory-only log rows mislabeled as error-shown, inflate friction digest

VENUS-275 venus Backlog

Friction-log-driven UI fix campaign (fleet)

EVO-62 evolutiva Backlog

Remove vestigial isDemoDomain branch in email-domains.ts (post VENUS-270)

VENUS-271 venus Backlog

EVO-57 Mars: audit-trail schema normalization plan (coverage + naming)

MARS-492 mars Backlog ↳ EVO-57

Fleet audit: createdBy/At + deletedBy/At + changelog/archive coverage on every table

EVO-55 evolutiva Backlog ↳ EVO-57

└─ Audit createdBy/At + deletedBy/At + changelog/archive coverage

MARS-483 mars Backlog

Stamp session_user into archive-trigger snapshots alongside app.user_id

MARS-491 mars Backlog

Per-agent Postgres login roles for DB-layer attribution (Mars/Pluto/Venus)

EVO-56 evolutiva Backlog

└─ Per-agent Postgres login roles (REFERENCE impl)

MARS-490 mars Backlog

Adopt Pluto admin-list/detail reference pattern (5 principles) on Mars

MARS-482 mars Backlog

Minimize demo-data technical debt fleet-wide

EVO-54 evolutiva Backlog

Email-identity SSOT campaign: users.emailCanonical generated key + getUserByCanonicalEmail chokepoint (absorbs PLUTO-61 display-write fix + PLUTO-36 JS/DB parity fix as acceptance criteria)

PLUTO-154 pluto Backlog

Operational baseline for the live EVO-51 pipeline

WEBUSAGE-1 webusage Backlog

restoreUser must regrant roles after MARS-382 soft-delete cascade (role-less restore gap)

MARS-479 mars Backlog ↳ MARS-382

No-404 directive: navigation/practica-link-dead fired 3x — find and eliminate the dead practica link source (broken link/route), not just relabel the event

MARS-106 mars Backlog ↳ MARS-437

/practicas dashboard: pending-queue rows repeat in the flat table — dedup UX (Elazar option pick pending)

MARS-478 mars Backlog

vComisionAyudantesByJtp SA-join fix

MARS-477 mars Backlog

Tech-debt sweep: catalog unused DB objects (tables/columns/views, e.g. 0-row #395/#396, redundant text cols #394) + dead app-code fields/exports; file one deletion WI per finding (Elazar 06-05: stop brushing off 'legacy field we dont use')

MARS-13 mars Backlog

└─ Delete unused DB views (technical debt audit)

MARS-14 mars Backlog

cc-* noncanon-sender catcher: verify in-wild, then migrate cc-context-monitor-* to canonical scrp-<name>-<host>

MSG-271 llmmsg-srv Backlog

MARS-468 follow-up: support-action idempotency ledger for close/reopen + test coverage

MARS-470 mars Backlog

Down-tier recurring Failed-to-fetch rejection alert on /practicas/nueva

VENUS-257 venus Backlog

EVO-52: extend support-api for full SOP-ticket CRUD (status transitions incl. close/resolve, private Elazar+stakeholder-only comment type, notify-list on ticket events) — bearer-invokable, no direct DB/chrome-mcp/manual-human path

MARS-468 mars Backlog

CI guard: static logEvent call-site scan vs checked-in action-classification manifest (MARS-465 follow-up)

MARS-466 mars Backlog

Admin landing: pinned-first sidebar + numbered emoji card grid (fleet-uniform pattern, bs-mrlnhbp0y3n)

MARS-458 mars Backlog

Middleware session-refresh (createServerClient) -- edge-bundle-safe design needed

MARS-454 mars Backlog

instrumentation.ts pulls pg (node driver) into the Edge middleware graph — move error-capture behind an Edge-safe boundary

MARS-452 mars Backlog

Nota/concepto-final grading column — spec needed from Elazar before build

MARS-444 mars Backlog

Postgres-offload campaign (5 items): push report/KPI dedup+join logic into DB views

VENUS-237 venus Backlog

to:[] array /send path skips rule-1a origin_aro membership check

VENUS-223 venus Backlog

busy-nudge false-fires on working: sent without re=<ask tag>

VENUS-221 venus Backlog

useActionForm has zero Mars consumers - decide adopt vs leave

MARS-420 mars Backlog

Drop vFriction7d legacy OR-clauses after companions confirm-emitting 7d clean

PLUTO-539 pluto Backlog ↳ PLUTO-534

KPI report defects surfaced by coaching run-1: v_ack_heavy_7d header/threshold mismatch + v_cli_drift_7d lifetime column

VENUS-211 venus Backlog

Inventory + lock down public function EXECUTE and sequence privileges (adjacent to MARS-416 relation-grant revoke)

MARS-417 mars Backlog

Fleet-wide per-agent auth: hub identity is self-asserted on the shared edge bearer

MSG-263 llmmsg-srv Backlog

Scheduled security-scan ownership (rkhunter/clamav) + fleet-wide systemd/cron job registry with heartbeat monitoring on venus

OPS-97 agent-ops Backlog

Promote feedback mechanism from jsonb blob to first-class column on appLog tables (fleet)

VENUS-193 venus Backlog

Optimize Venus mobile-first for its own most-used viewport (data-driven)

VENUS-192 venus Backlog

ux-pain-digest retune + per-field granularity after feedback-category unification

VENUS-190 venus Backlog

Log native HTML5 validation hints as friction events (any user-facing feedback = logged; native constraint-validation currently bypasses the toast/checkRequired path)

MARS-412 mars Backlog

appEvents schema standardization (fleet, mirror of MARS-411)

VENUS-183 venus Backlog

Fleet appEvents schema standardization: single log(entry) entrypoint (no level-wrappers) + promote hot fields to real columns, minimize jsonb-blob reliance

MARS-411 mars Backlog

remove single-active-role constraint — support multi-role per user

VENUS-166 venus Backlog

feat(identity): email-change changelog — one email per account + history

VENUS-156 venus Backlog

Fleet deliverable: draft BACKTEST SPEC + TRIAGE-CODIFICATION CHECKLIST template (Pluto-owned)

PLUTO-524 pluto Backlog

Track AR data-protection reform bill + ReNaPDiS registration procedure

ENAMEL-3 enamel Backlog

Confirm if LOINC + DICOM are mandated (not just recommended) for HCE interop

ENAMEL-2 enamel Backlog

Migration 042 (pluto applog-view-reshape) is designed + audit-PASS'd but HELD for fleet-lockstep GO — do NOT apply solo

EVO-49 evolutiva Backlog

Patient-registry name correction path (pacientes.nombreCompleto)

VENUS-148 venus Backlog

Close/resolve-via-API endpoint for support tickets

VENUS-143 venus Backlog

Cleanup: Puia has 2 non-deleted titular userRoles rows (likely dupe)

VENUS-142 venus Backlog

Refactor DataTable onto shared Pluto sort core (vendored)

MARS-394 mars Backlog

CR26 — role-function guide for Belén (client deliverable)

AYUD-115 ayudarg Backlog

MARS-145 follow-up: daytime-peak 53300 re-scan of the txn-pooler runtime pool

MARS-383 mars Backlog

Localize Supabase password-reset email template (default English → Spanish + AyudArg branding) via Supabase dashboard

AYUD-74 ayudarg Backlog

Normalize agent names + folder/.aro/.agent-name layout: fix hyphenated project-names in cc-names, KEEP host suffix -w/-v/-l (it identifies cross-host agents, e.g. proxy-<proj>-cc-w); rename coder->coder01/coderhelp->coder02/db->db01/db2->db02 via claude-mv per-project (agent-driven, not manual); build drift-normalizer script. whey+venus now, lezama later.

OPS-86 agent-ops Backlog

Fix verify-deploy.sh: --format json + project-name positional incompatibility

AYUD-72 ayudarg Backlog

gitmerge.sh diverged-branch newest-wins auto-adds untracked files, defeats gitpush --only strict-staging

MSG-216 llmmsg-srv Backlog

Custom 404: add LLM-copy block to not-found page + enrich routing/not-found event (referrer, appVersion, requestId) + rate-limiter

MARS-330 mars Backlog

GDPR erasure: fire-and-forget admin email is silent on failure — add error log + retry/queue so the hard-delete loop doesn't stall

AYUD-75 ayudarg Backlog

Fleet audit: every agent's cwd has local .agent-name matching registered name

OPS-73 agent-ops Backlog

Brainstorm: connect lezama agents to whey's llmmsg-srv hub

MSG-112 llmmsg-srv Backlog

bisync watchdog: alert when gdrive-bisync.service fails > 2 consecutive runs

OPS-74 agent-ops Backlog

Push llmmsg protocol mechanics into MCP send tool + hub (shrink model-held context)

MSG-209 llmmsg-srv Backlog

Deploy/verify ca.sh on venus (sh.git pull); confirm a codex test session registers + hub URL resolves remote

MSG-189 llmmsg-srv Backlog ↳ MSG-186

Geolocalización del voluntario

AYUD-42 ayudarg Backlog

/loop skill self-exports LLMMSG_AUTONOMOUS=1 on entry (so L1 hook branches correctly inside /loop)

MSG-196 llmmsg-srv Backlog

Fix static ~/.codex/config.toml footgun: wrong key LLMMSG_AGENT->LLMMSG_AGENT_NAME + LLMMSG_SRV_HOST 127.0.0.1->public; bare codex (not via ca.sh) currently falls back to cc= in /opt/llmmsg-srv = registers as pm-llmmsgsrv-cc on loopback. Non-blocking; ca.sh -c overrides already bypass it

MSG-191 llmmsg-srv Backlog ↳ MSG-186

cc-context-monitor compact half - wire host-side tmux send-keys auto-compact for idle over-cap sessions, after the one-session verification test

MSG-122 llmmsg-srv Backlog

Vercel + Supabase optimization — reduce Fluid Active CPU bill creep, eliminate dashboard misconfig, lower latency

EVO-36 evolutiva Backlog

Agregar necesidades a la acción al crearla

AYUD-45 ayudarg Backlog

UX /personas/(id): agregar campo Comentarios/Notas debajo de Persona

AYUD-88 ayudarg Backlog

aro_config caller field unauthenticated - light-scope hardening

MSG-145 llmmsg-srv Backlog

UX nav: pulldown muestra guión en círculo — reemplazar con ícono usuario + menú estándar

AYUD-87 ayudarg Backlog

Next.js chat client to supersede chat-duo GTK + chat-duo-web (brainstorm item 4): node service on whey, Tailscale-only, native Pending tabs. Needs design brainstorm->spec->plan.

MSG-127 llmmsg-srv Backlog

memory-lint compute_footprint over-walks CLAUDE.md chain - ignores claudeMdExcludes

OPS-61 agent-ops Backlog

Necesidad de salud: notificar admin de Brigada

AYUD-49 ayudarg Backlog

memory-lint scope bug: gitpush pre-hook runs memory-lint.sh with no arg → scans ALL ~/.claude/projects/*/memory dirs → one project's memory hygiene blocks every other project's pushes. Cross-project DoS. Fix: scope to current-project memory dir only (resolve from PWD or .agent-name). Surfaced 2026-05-17 by coder-mars-cc-29923 blocked on llmmsg-srv-cc's dirty memory dir.

OPS-40 agent-ops Backlog

└─ memory-lint A/B/D/E: gitpush-pre.sh per-project scope (arg, not glob) + non-blocking warn-only + drop §11 heading-dup from per-push + never touch CLAUDE.md. Mars+pluto+venus .gitpush-pre.sh mirror. Ratified by Elazar -30088.

OPS-42 agent-ops Backlog high

Enriquecer mapa: colores e íconos por acción/evento/necesidad

AYUD-33 ayudarg Backlog

hub-resident cross-project WI board: add cross_wi table + MCP wi_add/wi_close/wi_ls/wi_show/wi_event tools. Replaces per-host bwi for cross-project items (mars/pluto/venus/evolutiva). 3-PM consensus pm-mars-29395 / pluto-29405 / venus-29411; Elazar greenlight elazar-…-29506 Q2. Owner: llmmsg-srv-cc-w.

MSG-120 llmmsg-srv Backlog

Server-side userId in createEventoOnExistingAccion (do not trust client payload)

AYUD-57 ayudarg Backlog

Crear usuario a Flor

AYUD-44 ayudarg Backlog

bwi git-sync dead since 2026-05-06: decide whey-only policy vs resume DB commits+pushes to GitHub; venus agents routing through whey meanwhile

OPS-65 agent-ops Backlog

Recordatorio visita 24hs si no hay eventos

AYUD-41 ayudarg Backlog

Criterios cierre/apertura/alerta para eventos/acciones/necesidades

AYUD-40 ayudarg Backlog

Emails de alerta + todos criterios timers

AYUD-39 ayudarg Backlog

Bubble de notificación

AYUD-38 ayudarg Backlog

Íconos en mapa llevan a acción

AYUD-37 ayudarg Backlog

Recursero toggle mapa

AYUD-36 ayudarg Backlog

Bienvenido bring back

AYUD-35 ayudarg Backlog

Mapa: ver legales

AYUD-34 ayudarg Backlog

DNI obligatorio en preguntas

AYUD-48 ayudarg Backlog

Aplicar diseño de Flor (diseñadora)

AYUD-51 ayudarg Backlog

Plan beneficiary DNI storage/sharing — autocomplete-suggest, duplicate-DNI warning (same DNI registered under a different name), and statistics

AYUD-92 ayudarg Backlog

Create dailyErrorDigest DB view for daily PM error review (aggregate logs table errors per day)

AYUD-94 ayudarg Backlog

Alta y reseteo de claves

AYUD-32 ayudarg Backlog

Pregunta: ¿Hay algo que no puedas comer?

AYUD-47 ayudarg Backlog

Vercel MCP token expired — auditor falling back to curl for deploy audit

AYUD-67 ayudarg Backlog

Review evolutiva backup policy + space (2h/30d/gdrive, ~1.75GB steady-state; context: WI #509)

OPS-69 agent-ops Backlog

memlint-cron.sh: replace email escalation with llmmsg DM to host maintainer (nw-{host}-cc)

OPS-70 agent-ops Backlog

pull cc-memory-sweep.sh v1.2 (sh.git 20ce2fe) onto whey + lezama

OPS-71 agent-ops Backlog

chat-duo timestamp display drops date - stale msgs read as today

MSG-147 llmmsg-srv Backlog

cdw PWA: make chat-duo-web installable (manifest+icons+service worker, Add-to-Home-Screen)

MSG-46 llmmsg-srv Backlog

Proactive unreviewed-práctica backlog outreach: identify top 3-4 teachers (JTPs) by sin-revisión backlog, the active JTP in each's comisión, the adjunto + titular; draft email to adjunto/titular asking how to address the backlog before it's insurmountable. Real-audience outbound — held for Elazar approval before send. (Elazar 2026-06-14)

MARS-125 mars Backlog

EVO-47 db-lane: redefine vAppErrorsRecent + vAppAlertsRecent to expose level + category + normalizedRoute; redefine rollup signature = normalizedRoute+level+category (subsumes EVO-46 lane-2 distinctPaths). Enables the level/category-aware alert-suppression predicate. Audit pre-apply DDL gate (reversible CREATE OR REPLACE VIEW). BLOCKED: Mars db agent offline — apply queues for db-mars launch; audit preps read-only DDL spec meanwhile.

MARS-344 mars Backlog

Pestaña-2 client answer: complicaciones intra/post pooling + tratamientos pool (quistes/tumores/cáncer) — draft sent to Elazar 2026-07-02, awaiting review

VENUS-101 venus Backlog

v_large_aro_content_24h view: add recipient LIKE 'aro:%' filter so DMs with origin_aro carry-through are not counted as ARO fan-outs

MSG-228 llmmsg-srv Backlog

Stale /compact cron jobs: agents leave CronCreate one-shots from prior sessions (shows as 361d scheduled task on exit). Investigate root cause and implement reliable cleanup — auto-purge stale crons on session start or prevent duplicate creation. Reported repeatedly; needs durable fix.

OPS-93 agent-ops Backlog

db-mba-l/CLAUDE.md: live PROD svc_nextjs password in tracked git file. No rotation (Elazar 2026-06-29). When revisited: git history rewrite or rotation. Also de-bloat 23.6k schema doc → move to docs/ read-on-demand.

OPS-95 agent-ops Backlog

Migrate all whey-hosted maintenance/monitoring to venus: systemd timers, cron jobs, push/pull scripts, and any monitoring that currently runs on whey (bin-whey-cc / nw-whey-cc lanes) must move to venus equivalents. Whey is not 24/7 and must not be depended on for scheduled or continuous ops. Audit all whey services, identify venus gaps, migrate lane by lane. bin-whey-cc becomes contributor/reviewer only; venus agents own runtime.

OPS-94 agent-ops Backlog

authz: /datos gate mismatch vs sibling /admin/* pages — logged-in-only vs isAdmin

AYUD-110 ayudarg Backlog

getAnomalyReport: nested 3-wide raw Promise.all bypasses DB_POOL_MAX limiter (residual pool-acquire class)

PLUTO-151 pluto Backlog

Fleet model audit: many agents still pinned Opus 4.7; move to default-tracks-latest (verify default=Opus 4.8 + future models) or pin Opus 4.8; review model choice per agent by role

OPS-8 agent-ops Backlog

Fleet curated-knowledge-file + prune-arrow adoption: repo-visible SSOT digest .md (coder/db/audit/pm all edit+prune) as the reviewed distillation on top of auto-memory ON; raw memory captured then distilled into the .md, prune superseded. Decoupled from the solo agent (adopt regardless). 4-PM unanimous brainstorm bs-mr3bt2c0vgy. Mars=reference (solo-mars-cc.md already this shape). Scope: standing digest+prune discipline, mirror to venus/pluto/ayudarg.

MARS-372 mars Backlog

db-size-monitor blind to /var/lib: add to scan roots (currently /home/rob /opt /srv /rtshared). The llmmsg-srv hub DB (/var/lib/llmmsg-srv/v2.sqlite 38M live + llmmsg.sqlite 30M dead-v1) never appears in size snapshots - exactly the DB Elazar worries about. Also surfaces probe-table growth (host_probes 32k rows) for retention review.

OPS-1 agent-ops Backlog

attach-tmux.sh: list OFFLINE agents too; selecting one launches its ccs session and attaches you to it

OPS-7 agent-ops Backlog

venus /opt/llmmsg-srv is NOT a git checkout - no sync path for maintainer pushes (forces manual /gdrive/temp hops; v1.16 bootstrap had to be hand-installed). Make it a proper git checkout of origin/main like lezama (project_lezama_code_drift) so future pushes land via git pull. Care: venus dir has live local files (.agent-name, service config) - clone-in-place or backup+clone, don't clobber runtime config.

MSG-9 llmmsg-srv Backlog

Adjunto oversight/governability landing: adjunto logs in -> lands on a page showing comisión health, which JTPs need help, pending workload (Elazar 06-06, q3). NEEDS DESIGN/BRAINSTORM - distinct surface from /practicas

MARS-35 mars Backlog

Check size of Mars images on Hostinger (api-images file store) — measure total disk + file count used by Mars JPEGs on the api.pensanta.com/mars FTP-jail host; report bytes + count, flag if cleanup/retention needed.

MARS-42 mars Backlog

Unknown /command errors back to sender (not silent-send); usage-error on malformed known verb

MSG-49 llmmsg-srv Backlog

Triage edge LLMMSG_HUB_BEARER rotation: exposed on GitHub via api-images repo (NOT llmmsg-only exposure, so no-rotate rule does not apply)

MSG-51 llmmsg-srv Backlog

Archive trigger captures NEW not OLD on UPDATE — verify forensic recovery coverage across audited tables (db)

MARS-64 mars Backlog

Verify: re-run PageSpeed mobile+desktop (target 90+ mobile), visual-parity check vs current live, confirm all internal links + sitemap resolve under cleanUrls

HOAC-11 ha Backlog ↳ HOAC-1

Accessibility pass (DEFERRED per Elazar 2026-06-08): fix viewport user-scalable=0, footer contrast, heading-order, add main landmark

HOAC-12 ha Backlog ↳ HOAC-1

EPIC: Self-hosted SMTP on venus

VENUSINF-3 venusinfra Backlog

└─ Install + configure MTA (postfix) on venus

VENUSINF-16 venusinfra Backlog

└─ PTR/reverse-DNS + SPF/DKIM/DMARC for deliverability

VENUSINF-17 venusinfra Backlog

└─ Repoint notify-elazar.sh to venus SMTP; verify delivery to Elazar inbox

VENUSINF-18 venusinfra Backlog

EPIC: whey + lezama thin-client cutover

VENUSINF-5 venusinfra Backlog

└─ whey → thin client (hub/pg/smtp point to venus)

VENUSINF-23 venusinfra Backlog

└─ lezama → thin client via public venus (simplify the whey-VPN dependency)

VENUSINF-24 venusinfra Backlog

└─ Define what stays local on whey vs moves to venus (role redefinition)

VENUSINF-25 venusinfra Backlog

└─ Per-cutover rollback plan + burn-in verification gates

VENUSINF-26 venusinfra Backlog

UX Friction (epic): reduce user pain points surfaced by toast/error telemetry

MARS-69 mars Backlog

Asesoramiento en SEO

ADRIANAP-2 adriana-pavon Backlog

└─ Configurar accesos: Google Search Console, verificar sitemap.xml, revisar robots.txt

ADRIANAP-14 adriana-pavon Backlog

└─ Auditoría técnica: Core Web Vitals, canonicals, errores 404, velocidad, mobile

ADRIANAP-15 adriana-pavon Backlog

└─ Keyword research y análisis de competencia para flamenco Buenos Aires

ADRIANAP-16 adriana-pavon Backlog

└─ Revisión on-page: title tags, H1 (homepage no tiene), meta descriptions, alt text de imágenes

ADRIANAP-17 adriana-pavon Backlog

└─ Recomendaciones de contenido: fix Cartelera (2024 events visible in 2026), expandir páginas de academias, proponer 3 landing pages SEO

ADRIANAP-18 adriana-pavon Backlog

└─ Recomendaciones Schema.org: Organization, Event, DanceSchool/LocalBusiness por página

ADRIANAP-19 adriana-pavon Backlog

└─ Informe escrito con plan de acción priorizado + llamada de presentación

ADRIANAP-20 adriana-pavon Backlog

feat(infra): DB perf snapshot+diff collector (dbperfSnapshots)

VENUS-19 venus Backlog

Sidebar/navbar per-role regroup (Stage A): execute the holistic restructure the /sidebars-preview diagnostic (75ad66f, 2026-06-04) was built to inform. Per-role nav still cluttered/inconsistent. Use the preview tool (renders real sidebar per role side-by-side) to design grouping, then regroup. Only piecemeal edits landed since (MARS-33/34, WI#327, WI#214); holistic cleanup dropped + untracked until now (Elazar 06-09).

MARS-77 mars Backlog

EPIC: shift /users /estudiantes /docentes from admin-dashboard mgmt to self-managed roster (JTP/Ayudante/Adjunto/students self-pick relationships + self-confirmation workflow)

MARS-87 mars Backlog

hub.mjs latent SQLITE_ERROR: 'no such column: ""' at Database.prepare (seen 00:47:15 pre-restart). Route interpolates empty string into query as = "" (SQLite parses "" as column id). Find the unparameterized query, convert to bound params. Route-triggered, not fixed by restart. Also tidy hub.mjs:1007 error string to match widened regex.

MSG-23 llmmsg-srv Backlog

EPIC mobile-first refactor (Elazar directive, all 3 apps): Mars is desktop-CSS-with-patches, not mobile-first. Staged base-up rework. Stage0 foundation (44px tap floor + search/form fixes, mobile-only media blocks, desktop density unchanged); Stage1 DataTable mobile card mode (fixes /practicas + /docentes); Stage2 /mi-cursada; Stage3 /practicas/nueva form (+tooth-selector tap targets, +undefined .conducto-* classes latent bug); Stage4 filter-bar accordion; Stage5 practica detail (/practicas/[id]+/mi-cursada/[id]: info-bar, changelog, comentarios, review-form, image-viewer pinch-zoom currently broken on mobile); Stage6 secondary (soporte thread, notificaciones, perfil, postgrado-progression). Order 0>1>2>3>5>4>6. Owners: coder-mars 0/3/5, audit-mars-ca 1/6. Held on proxy-mars BEFORE baseline (Elazar launching). Admin wide-tables=P3 tail/defer.

MARS-97 mars Backlog

Vercel log-drain setup: Elazar greenlit (2026-06-12) true 24h+ runtime-log retention (currently logs are point-in-time only via Vercel MCP). Scope: pick drain destination (log service/endpoint), configure Vercel log-drain, implementer is infra (nw-whey/nw-venus) not coder. PM owes Elazar the concrete scoped plan before dispatch.

PLUTO-46 pluto Backlog

Observability: add success-path logging (login success, key page loads) — currently only error branches log

AYUD-3 ayudarg Backlog

CR62: agregar 'ver todas' a pulldown comunas en /recursos

AYUD-106 ayudarg Backlog

CR24-full: remove photo DISPLAY code (listEventPhotosQuery, EventPhotoRow, any /personas/[id] photo render) — Elazar confirmed full erasure

AYUD-4 ayudarg Backlog

Real-life-as-SSOT JTP attribution analysis: quantify divergence between start-of-year studentAssignments (error-prone excel import) and actual student JTP picks (práctica.jtpUserId). Two mismatch classes: (1) JTP students picked but aren't assigned to; (2) students assigned to a JTP who picked a different one. Analysis only first (no writes); evidence base for evidence-based reassignment (NOT admin-pick UI). Links MARS-43 + live-vs-snapshot rule. (Elazar 2026-06-14)

MARS-126 mars Backlog

CR63: /personas/(id) mostrar estado/necesidad con link a detalle de necesidad

AYUD-107 ayudarg Backlog

Mars appEvents conform to fleet standard (evolutiva-appevents-standard.md): add categoryId uuid FK->lookupOptions + seed appEventCategory group (16 canonical + practica/studentAssignment/assignment) + backfill 18 free-text values w/ mapping; add 4 promoted cols (httpStatus/durationMs/path/failureCode); add logError/logWarn/logInfo wrappers + pickKnown + isCritical sync-bypass; append-only trigger (GUC-bypass) AFTER appEventRelays sidecar cutover (replace detail.relay.delivered UPDATE pattern); replace level-only prune with 5-cat-security tiered retention; canonical v_appEvents_* views; legacy_events sink. Staged db+coder. BLOCKED on committed SSOT + Elazar priority call.

MARS-107 mars Backlog

Duplicate practicas: operador + asistente each create the SAME clinical event picking each other as counterpart -> 2 mirror practica rows for 1 real práctica. Need duplicate-detection + canonical-record rule (natural key candidates: fecha+comision+paciente/tratamiento+the operador/asistente pair). Design WITH Elazar; covers (a) prevent new dupes at create, (b) reconcile existing dupes in prod. Cross-team lessons-learned for mars/venus.

PLUTO-78 pluto Backlog

Teacher-facing student reassignment surface (JTP/Ayudante self-service, NOT on /alumnos)

MARS-108 mars Backlog

PLUTO-77 v1 LOW followup: comision-day secondary list capped at limit-200 first-page (no cursor pagination); add cursor paging if an ayudante's assisted-comision roster exceeds 200

PLUTO-81 pluto Backlog

whey↔lezama global ~/.claude/CLAUDE.md §-level reconcile: lezama missing entire sections whey has (was missing ## Collaborate — added 2026-06-14; also lacks Permission, Communication, others). Audit all 3 hosts' global CLAUDE.md section sets, decide canonical fleet-neutral set, mirror missing sections per-host. Surfaced during the log-review-autonomy global-line rollout.

OPS-14 agent-ops Backlog

CR64: /personas/(id) eventos debe mostrar info del evento (iniciado/no iniciado), no necesidades

AYUD-108 ayudarg Backlog

Mars logging structural hardening (R1 follow-up): middleware-injected requestId correlation + actor de-anon in onRequestError (F-3/F-4), isCritical sync-write for auth/authz/security cats (F-5), log-error 5min digest dedup (F-6) — audit design-review first (middleware is auth-adjacent)

MARS-116 mars Backlog

PLUTO D8 compute-placement remediation (self-scan)

PLUTO-98 pluto Backlog

D8 Tier-2: compute-in-Node over DB rows (cron practicas-kpi-report:277/330/146/208, legacy-export-actions:68-88, hierarchy-utils:22-74/team-stats) -> SQL GROUP BY/ORDER BY

PLUTO-99 pluto Backlog ↳ PLUTO-304

Audit PTD render-GET tooling: enable exercising authed routes (dedicated test-user + stored session, OR a server-side render-self-check route) — Mars leg of the cross-project gap that let Pluto's /informes 500 ship unexercised (audit unauth render-GET -> 302/login, authed routes never actually rendered in PTD)

MARS-118 mars Backlog

KPI-rework /informes (gathering inputs, do NOT implement yet): teacher-scoped report quality pass. Inputs so far: (a) wrap bare CohortAndProcedureCards grid (teacher-report.tsx:818) in titled ReportSection; (b) Moda operador/asistente cards mislabeled (modal per-student count, not most-frequent person) + redundant beside Promedio -> cut or relabel; (c) EPI RE-WEIGHT: Puia wants MORE epidemiology on pluto+venus -> KEEP/EXPAND porSexo/porProvincia/etc (REVERSES earlier generic-remove rec; do NOT cut epi buckets). Grounding: judge on ACTUAL teacher-scoped values via audit-venus KPI->source-view map + db-pluto value pull, NOT admin-proxy shape. Awaiting full KPI->view map (~20-30min from audit-venus) + Elazar per-item rulings before WI splits into coder/db work.

PLUTO-121 pluto Backlog

DB (deferred/cold): 24 unindexed FKs on forensic/audit/housekeeping columns (archivedBy/deletedBy/restoredBy/resolvedByUserId/surrogateUserId/actorUserId/createdUserId/assignedTeacherUserId); none in hot paths; track, index only if a real query path emerges

MARS-122 mars Backlog

Measure per-turn injected token overhead per agent; rank remaining cuts by real savings

TOKENDIE-1 token-diet Backlog

DB connection scaling: verify Supavisor txn-pooler + query-shape pass (pre-scale)

PLUTO-146 pluto Backlog

feat(ptd): authed-route PTD tooling — PTD render-GET can't exercise authed routes (302/login); authed pages + authed-only behavior (toast/error-shown producer, práctica gates) never runtime-verified. Fix: in-process self-check route (preferred) or least-priv stored session for manual authed pass. Sibling: MARS-118.

VENUS-14 venus Backlog

PLUTO-133 follow-up (Elazar 5b, sequenced AFTER the main toast sweep ships): should-be-required / data-integrity candidates needing a verify pass then fix — (1) periodo date-range fechaFin<=fechaInicio unvalidated client+server; (2) practica rejection comentario not required; (3) destructive activo toggles (periodo/comision) no confirm dialog → toggle-off cascades; (4) admin create-user with no role → primaryRoleId NULL → blank-redirect login. Verify each path first (2nd-sweep agent guessed some), then fix. Do NOT start until PLUTO-133 main sweep is shipped.

PLUTO-136 pluto Backlog

Re-key grading attribution to práctica-pick (jtpUserId) — reverses live-SA model

MARS-136 mars Backlog

Vercel runtime-log API billing-capped (ExceedsBillingLimitError) — blinds PTD runtime-log gate until cap reset/raised

MARS-141 mars Backlog

Real-time error reporting + auto-heal — Pluto leg (ratified protocol bs-mqn2ze006f7)

PLUTO-164 pluto Backlog

general-pm role + mgmt-aro topology decision (bs-mqolw0w7gcg/bs-mqom01jn5ww): keep general-pm THIN (cross-project convener + EVO-* umbrella owner + router/scribe + authoritative bwi writer); NO bulk .md; depth=pull-on-demand; tiny PM-owned routing map ~1-2k/app (kill-on-drift); pm-mars=fleet-pattern-lead w/ pluto per-app-divergence carve-out; api-image per-topic invite; single-app incidents stay in project aro. FORK resolved CONDITIONALLY on hub non-quorum capability: YES->one-aro non-quorum lurker / NO->two-aro fallback. GATES: (1) Elazar nod on routing-map + mars pattern-lead + lurker model; (2) pm-llmmsgsrv feasibility verdict on member-non-quorum (Q sent). Nothing structural moves until both clear.

EVO-25 evolutiva Backlog

404 digest count inflation: error-digest reports 11 /mi-cursada 404s but appEvents shows only 2 — reconcile digest aggregation vs raw appEvents rows (possible double-count, window mismatch, or path-glob over-match). Source: audit /mi-cursada triage, de2e960 window. mem: appevents double-render dedupe (not-found-log.ts isDuplicateRender) is one suspect.

MARS-164 mars Backlog

INVESTIGATE (not-prejudge): authed post-OAuth /mi-cursada empty-state-vs-404 gap. Row 1 of the triage: a legit OAuth-redirected alumno on the canonical landing got classified genuine-bad-route via the external-referer heuristic. CONFIRM FIRST whether bare /mi-cursada notFound()s for an authed no-active-cursada user (code read says it renders an EMPTY STATE, does NOT 404 — so the 404 is on a different path/referer shape) before prescribing any empty-state fix. Scope: not-found-classify external-referer branch + post-OAuth referer shape.

MARS-165 mars Backlog

cc-context-monitor.timer on venus stalls intermittently (Trigger: n/a, no next fire scheduled) after normal runs — causes ~45min gaps in scrp-context_monitor-venus heartbeat, false DOWN alerts from whey. Observed 4x on 2026-06-21. Root cause unknown (systemd timer drift? service runtime overrun? OnCalendar+Persistent interaction?). Needs bin-whey-cc investigation.

OPS-23 agent-ops Backlog

Soak applog dual-write logs↔appEvents 7d/50-event then retire logs table

AYUD-14 ayudarg Backlog

Hub: detect + block redundant per-member DMs when ARO fan-out should be used (same/similar body to N ARO members in short window → coach to use aro:X fan-out)

MSG-104 llmmsg-srv Backlog

Adopt PMs-24/7 + spawn-workers-on-demand RAM-reduction model (brainstorm bs-mqor18api1w)

EVO-26 evolutiva Backlog

EVO-12 ayudarg leg: server-side 404 capture, error-tier on own-route (DM+email), bot-probe carve-out to warn/digest only

AYUD-16 ayudarg Backlog

Verify applog error→aro:pluto live-PM routing survives EVO-5 rail rename (kpi-n-optimization migration bs-mqmr47bwkk4)

PLUTO-157 pluto Backlog

venus: align scrp- units to bs-mqmr47bwkk4 naming convention

OPS-22 agent-ops Backlog

Restore Mars error->email-to-Elazar loop (bs-mqn8g0rhso5 fleet decision): B ESOCKET operator-email hotfix (after->emailOutbox enqueue) + C instant-error-email onRequestError->enqueue direct-to-Elazar, throttled

MARS-161 mars Backlog

Student duplicate-práctica deletion request: student requests delete (reason=duplicate), picks keeper from pulldown, teacher approves -> non-keeper soft-deleted

MARS-147 mars Backlog

CU-15b: alumno-facing 'ver posición relativa a su camada' — BLOCKED on client anonymization contract (own-position-only vs named-peers). New alumno_postgrado exposure to a KPI surface isStaffRole blocks today; needs self-scoped predicate (effective.id===id) + client ruling on whether alumno sees named peers or only aggregate/own-position. Client flagged 'muy verde, hay que darle forma'. Class-A. Follow-up to CU-15(A) staff camada-compare.

VENUS-105 venus Backlog

LEG-2 aro-retarget: applog-listen alert DM pm-pluto-cc -> POST aro:pluto (aro tag) so Elazar sees in-room + PM runs error-incident troubleshoot IN aro:pluto. DEPS: nw-venus daemon target change + keepalive restart 60cf5e6; pm-llmmsgsrv re-enable fan-out aro:pluto. Pluto verified Elazar in aro:pluto.

PLUTO-167 pluto Backlog

applog-listen venus rail: burst-dedup for opaque client errors (Script error. / Failed to fetch) — N same-UA+session within 60s → 1 alert+count; isolated 1-offs → log-only. pm-venus amend 2026-06-22 (mars cross-app: Samsung Internet crash-loop found in this class). Supersedes blanket log-only.

EVO-27 evolutiva Backlog

CR-override-grade: adjunto/titular jumps in when JTP unavailable

MARS-213 mars Backlog

feat(monitoring): venus EVO-12 email-ENABLE flip — light the dormant own-route-404 email leg (today: capture+classify+LEG-2-DM live, email gated dormant). Gates ALL of: (1) surgical deploy-skew guard audited PASS, (2) Elazar Q3 paging-policy ratify, (3) Q4 alerts@ send-as ruling if migrating off soporte-evolutiva-venus@. Per fleet error-alerting standard + deploy-skew guard.

VENUS-27 venus Backlog

Queryable not-xray image view: count + % of uploaded práctica images flagged as NOT a real radiografía. Elazar 2026-06-26: he has not seen one real x-ray — ~99% are photos of a monitor screen, not actual radiographs. The image-analysis path already produces a flag (a 3-letter code/word per Elazar) that marks an image as not-an-xray. Build a DB view (db + coder) over the existing image-analysis data (likely imageUploadAnalysisEvents) that reports total images vs flagged-not-xray count and percentage, queryable any time (overall + optionally by periodo/comisión/recent-window). FIRST identify the actual flag field + its not-xray value. Read/analysis surface only, no enforcement/blocking. Build deferred — tracking only.

MARS-200 mars Backlog

applog-pull digest: sampleRoute display bug — shows latest row route for all xN occurrences, implies all N at that route. Fix: qualify as latest@route or list distinct routes.

EVO-18 evolutiva Backlog

venus: add TABLET device class to telemetry deviceType (bs-mqmt93jl25b)

EVO-11 evolutiva Backlog

EVO-12 deploy-skew guard FAST-FOLLOW (dormant, flag-OFF + Q3-held): (a) APP manifest-oracle — replace interim KNOWN_SEGMENTS with a prebuild codegen that walks src/app and emits a BUNDLED TS route-pattern module (Vercel-safe, rot-free, not a hand-allowlist); shared cross-fleet helper coordinated w/ coder-mars + coder-ayudarg per pm-llmmsgsrv. (b) DAEMON skew-suppression — nw-venus updates applog daemon to consume detail.isSoftNav/routeResolves + deploy-timing window so a stale-build soft-nav of a valid route downgrades ERROR->WARN and does NOT DM; audit-pluto specs the daemon-side predicate. Both are flag-ON PREREQUISITES (part of the Q3-enable gate), not live bugs. Canonical predicate: downgrade ONLY when RSC-soft-nav AND path in build-time route manifest; hard-nav/curl/bot ALWAYS page.

PLUTO-169 pluto Backlog

PM DB-fed triage loop: support-ticket + access-request events DM PM; PM reads DB + triages (bs-mqotdmmk6b5)

MARS-174 mars Backlog

Pluto fly-solo-kill execution brief (bs-mqpzo3ly470 / EVO-26) — execute on next Elazar-launched team session, do NOT act between sessions. (A) COMMONS/DOC: delete fly-solo/autonomy doctrine + flip log-review=work-order to report-only-Elazar-decides + add Agent-Boundary PM-never-spawns-hands-brief. Pluto-repo files (pluto-commons.md, pm-pluto-role.md) = Pluto coder; shared evolutiva-commons/evolutiva-pm-commons deletes route via bin-whey-cc (whey-canonical, mem shared-commons-edit-routing), NOT Pluto coder. (B) PROBE NOISE (Pluto app code, coder): port venus X-Audit-Probe demotion + internal-probe UA marker so scanner/probe traffic self-classifies to security/info and emits NO page_not_found warn row (source = not-found.tsx capture, mem pluto-notfound-capture-redirect-overfire); + downstream expected-signal allowlist: /wp-* & CMS-scanner paths, apple-touch-icon* 404s, pm-triage NOTIFY probe, gate-correct login-unknown, mobile fetch-abort. (C) RAIL RE-POINT (nw-owned venus daemons = Elazar-launched nw edit, NOT Pluto coder): applog-listen/pull@pluto + pluto-pm-triage-listen.service (EVO-32) -> REAL-severity DM Elazar only, everything else log/queue row no PM DM. (D) DEFERRED per decision pt7: headless sendWelcomeEmail(userId) path (the Agustina exhibit) - policy stands, conversion not scheduled yet.

PLUTO-201 pluto Backlog

EPIC active-view-by-default (Elazar directive 2026-06-26): every soft-deletable table (deletedAt column) must have a canonical active-view filtering deletedAt IS NULL; the app reads the view BY DEFAULT and the raw table only for admin/restore access. Root structural fix for the practica-link-dead class (soft-deleted prácticas still rendering as clickable links to teachers) and any future see-the-deleted-row bug. Scope: (1) db inventory tables-with-deletedAt vs existing active-views + the gap + ONE canonical naming convention (existing views fork camelCase vStudentAssignments vs proposed v_<table>); (2) coder map app read-paths hitting raw tables that must switch to the view, and the admin/restore paths that keep raw access; (3) create missing views; (4) migrate app reads; (5) audit each read-path swap. Staged, reversible per-view+per-path. Cross-project pattern candidate (mirror to pluto/venus). Plan-first; do not build until Elazar sees scope.

MARS-202 mars Backlog

PM DB-fed triage loop (bs-mqotdmmk6b5): PMs run a DB-fed ticket/triage queue + dispatch fixes in each app's own aro. Elazar greenlit per pm-venus relay 2026-06-22. Per-app legs tracked as children.

EVO-29 evolutiva Backlog

└─ Triage-loop leg: PLUTO — ACTIVE. Tickets (net-new surface) + access; live app. pm-pluto dispatching in aro:pluto.

EVO-32 evolutiva Backlog high

└─ Triage-loop leg: VENUS — DEFERRED (authorized by Elazar 'venus can wait'). On un-defer, carries prereqs: canonicalizeEmail + createAuthUserSafe.

EVO-30 evolutiva Backlog

└─ Triage-loop leg: MARS — per its own (mars already has both surfaces: tickets + access).

EVO-31 evolutiva Backlog

BUILD (dispatch-ready, Elazar-launched per bs-mqpzo3ly470 — do NOT act between sessions): Pluto admin "Cambiar email de acceso" server action (canonical change-login-Gmail, decision bs-mqq2v3r1802). New action in src/lib/admin-actions.ts, gate withCap(manageUsers) NOT fullAccess (reportes-trap, mem pluto-view-as-architecture). Input targetUserId+newEmail. In ONE txn w/ setArchiveContext (users is trigger-archived): (1) isAllowlistedEmail(new); (2) dedup-reject if canonicalizeEmail(new) belongs to another live user (id!=target, deletedAt IS NULL); (3) UPDATE users.email=new (emailCanonical GENERATED auto-regens, mem pluto-stored-generated-column-no-recompute) + SET users.authId=NULL so new Google identity re-links next login; (4) cleanup stale auth.users row for OLD identity via service-role admin deleteUser so old account cannot log back in; (5) userAuditLog email delta old->new; (6) optional fire welcome email to new address. Re-login on new gmail = proof-of-control (auth/callback matches by canonicalizeEmail(users.email)==canon(auth email), stamps new authId, same row -> roles/practicas intact). UI: "Cambiar email de acceso" in admin-user-detail.tsx with AlertDialog confirm (account-takeover-shaped). Touches auth/identity -> pre-impl audit design-ping + pre-push audit diff review per push-to-done.

PLUTO-202 pluto Backlog

Mendez Bovio DNI client-confirm: source xlsx has dni=95438931 (9-prefix, out-of-AR-range) + surname 'Bovio' absent in source → identity ambiguity, hold until client confirms value+identity before backfill

VENUS-59 venus Backlog

Rename whey monitor units to bs-mqmr47bwkk4 convention: ctx-monitor-whey.{timer,service}, sender scrp-ctx_monitor-whey, target aro:hosts-status

OPS-24 agent-ops Backlog

auto-commit guard: reject staged *.llmmsg-env / bearer-shaped blobs in git add -A paths (systemic root-cause fix)

MSG-110 llmmsg-srv Backlog

applog-listen rail: alert '×N' count inflated, decoupled from actual DB insert count

EVO-24 evolutiva Backlog

Post-window edit fulfillment: after 48h, student requests correction via botón Ayuda ticket → admin can edit ANY field (no per-field lock unless PM/Puia/Elazar restrict). Policy set Elazar 2026-06-26. Fulfillment mechanism (admin-edit-via-ticket UI vs manual) NOT built yet per his 'not for now'; this WI holds the agreed design.

VENUS-56 venus Backlog

Audit odaia agent roster — 15 cwds under ~/Documents/personal/odaia looks too many; consolidate, then properly scope google-workspace MCP per surviving agent (currently re-added to all 15 per-project as a stopgap 2026-06-05).

OPS-90 agent-ops Backlog

Fleet google-workspace real-usage sweep on venus+lezama: grep each host's transcripts for actual mcp__google-workspace__ tool_use (not installs/mentions); add per-project where used. whey done: odaia(heavy), pluto-pm(light), nw-whey(1 gmail).

OPS-91 agent-ops Backlog

db/schema.md omits function bodies, so it cannot answer what is installed for any fn

PLUTO-704 pluto Backlog low

terra_22 asserts trigger identity by tgname with no tgrelid scoping, so the assertion can match a trigger on another relation

TERRA-79 terra Backlog low

applog-listen: catchUp logs route-suppressed-held rows as 'missed event(s)'

VENUS-376 venus Backlog low

Post-deploy PTD check mints one permanent appEvents row per push on a shared 365d-floor table

TERRA-74 terra Backlog low

terraModulos has the same zero archive coverage and the same integer-PK wall as terraCirugias, and is the second half of the population TERRA-66 measured

TERRA-68 terra Backlog low

Probe marking is unavailable on non-error rows: markSynthetic needs errorMessage, and detail.synthetic is explicitly not the marker

TERRA-53 terra Backlog low

No instrument distinguishes noProfile wrong-account from genuinely-unprovisioned: both carriers falsified

TERRA-50 terra Backlog low

db:export silently depends on unset DATABASE_URL, only DATABASE_URL_DIRECT is populated

PLUTO-701 pluto Backlog low

Dead component image-upload-area.tsx + stale provenance comment referencing it

MARS-649 mars Backlog low

roster.client_version empty for 31/46 agents - version drift is unmeasurable fleet-wide

MSG-292 llmmsg-srv Backlog low

Disambiguate 'rectificar:pending' vs 'rectificar-nudge' feedbackKeys (observability trap)

MARS-641 mars Backlog low

Load-failed class: capture visibilityState + nav-in-flight at throw time

MARS-640 mars Backlog low

estadisticas: dead outlier-detection rule, never fires (since MARS-193)

MARS-639 mars Backlog low

PKCE callbackExchangeFailed: add benign-vs-attack discriminator (volume-gated, no action yet)

PLUTO-698 pluto Backlog low

Author CONTACT_ALIAS spec

MSG-286 llmmsg-srv Backlog low

Pool saturation makes its own telemetry unreliable (partial evidence during incidents)

PLUTO-695 pluto Backlog low

No test script in package.json; vitest unresolvable via pnpm exec

PLUTO-694 pluto Backlog low

Widen or stop truncating toast feedbackKey so distinct validation messages don't collide

MARS-629 mars Backlog low

404 classifier: preview-crawler traffic is a third class, decide handling

PLUTO-690 pluto Backlog low

Standing audit: nextjs/nodejs → Postgres pushdown — find Node-side aggregations/filters that should be DB views/functions, refactor opportunistically

MARS-247 mars Backlog low

claudia-pensanta-com fails lint on pre-existing no-explicit-any errors

WEBSITES-17 websites-tools Backlog low

Four static sites lack a footer version span, blocking gitpush

WEBSITES-16 websites-tools Backlog low

Decide whether gsc-reports/ should be git-tracked per site

WEBSITES-15 websites-tools Backlog low

Three GA4 properties exist for elazarpimentel.com

WEBSITES-9 websites-tools Backlog low

marcelosblancoycortinas-com-ar holds GSC reports but is not a git repo

WEBSITES-6 websites-tools Backlog low

Decide and execute: context-monitor.sh --drain path + its timer are undocumented, possibly dead

OPS-119 agent-ops Backlog low

Retire-vs-cutover: context-venus-monitor-alert.sh is a dormant duplicate of the live context-monitor-alert.sh

OPS-118 agent-ops Backlog low

Comisión-remainder section is read-only but canGradePractica permits grading it — affordance and permission disagree

PLUTO-687 pluto Backlog low

Schema-qualify the six unqualified fn call sites landed in orphan slices C and D

PLUTO-686 pluto Backlog low

primaryRoleId column-write invariant: remove direct writes + real enforcement

PLUTO-669 pluto Backlog low

Verify auth-actions.ts:1572 .email compare without canonicalizeEmail is not a match gate

VENUS-283 venus Backlog low

Benign SEO-crawler sitemap-probe 404 noise: a crawler walks sitemap filename variants (/sitemap_index.xml, /sitemap-index.xml, + a random catch-all-200 test token /_rNd9xZ7kL3) — all correctly 404 (Pluto is auth-gated, no public index surface) but log warn/navigation/page_not_found. Two-part: (1) decide the correct SEO posture — Pluto has nothing public to index, so likely robots.txt Disallow + NO sitemap is right (confirm whether /sitemap.xml exists/should); (2) down-tier benign sitemap/SEO-crawler probe 404s to info, mirroring ICON_PROBE_RE (3c10bb0) / SCANNER_PROBE_RE (PLUTO-442) in not-found-classify. EVIDENCE-GATE the down-tier: audit quantifies frequency over the applog digest/7d BEFORE implementing (per PLUTO-442 discipline + WELLKNOWN_BENIGN_RE caution against speculative benign-matcher broadening). Anchor only to exact sitemap filename shapes; the random token is NOT safely down-tierable. Low-pri.

PLUTO-445 pluto Backlog low

Shared push-tree same-file concurrent-edit handoff protocol

PLUTO-683 pluto Backlog low

Sweep for other per-request/standing-condition alerts that should use logEventOnce

MARS-618 mars Backlog low

Restore column sorting on /administrar/usuarios (server-side, post-MARS-615)

MARS-616 mars Backlog low

Make role->capability map DB-owned, or add a cross-layer drift guard (CAPS vs fn_admin_invariant_ok)

MARS-605 mars Backlog low

db-mars-cc: correct setArchiveContext GUC key for manual psql writes (app.user_id, not app.archive_actor_id)

MARS-603 mars Backlog low

users email-guard hygiene: normalizedEmail (app normalizeEmail) vs uq_users_email_ci (SQL canonicalizeEmail) disagree on 3 live rows; + duplicate index users_normalizedemail_unique == uq_users_normalizedEmail

MARS-566 mars Backlog low

login-email-drift-blocked: consider auto-sync email when supabaseAuthId sub already matches

MARS-602 mars Backlog low

Non-owner app role for archive/fraud/audit table write containment (real remedy, migration 100 is hygiene-only)

PLUTO-670 pluto Backlog low

9 archive tables have zero retention/prune — unbounded growth, fleet-wide pattern (also on venus)

MARS-598 mars Backlog low

edit-form.tsx missing isViewAs dep (view-as correctness) + weekly-kpi.ts unused eslint-disable

MARS-595 mars Backlog low

Disposition MARS-373 archive-context WARN on 2 immutable applied migrations

MARS-594 mars Backlog low

appEvents.path dead column — drop or populate (never-populated query trap)

VENUS-343 venus Backlog low

.gitpush-pre.sh WARN: migrations/applied/ change without schema.md change

VENUS-342 venus Backlog low

users.displayName NOT NULL DEFAULT '' allows silent empty-name insert (siblings CHECK-reject)

MARS-591 mars Backlog low

ayudarg applog rail: check for same cursor-strand defect as mars/venus

MSG-275 llmmsg-srv Backlog low

Consume venus-side applog cursor-age instrument (report pluto's rail age)

PLUTO-651 pluto Backlog low

Applog burst-dedup: duplicate event ID replay within 60s synthesizes x2 burst

PLUTO-650 pluto Backlog low

No reachable contact channel on /solicitar-acceso or /acceso-denegado

PLUTO-649 pluto Backlog low

Migration loop swallows all errors, not just duplicate-column

MSG-273 llmmsg-srv Backlog low

SILENCE_SKIP_AGENTS hardcoded allowlist has rotted (missing scrp-*/claude-global)

MSG-272 llmmsg-srv Backlog low

pm-triage-listen.ts: realtime watermark can permanently skip rows during outage window

VENUS-314 venus Backlog low

appEvents.status free-text drift (7739 rows, ~25% coverage of declared union)

VENUS-310 venus Backlog low

IdentityBindTier dbBackfill contract cleanup

VENUS-312 venus Backlog low

Orphaned active userRoles survive user soft-delete (hygiene)

PLUTO-639 pluto Backlog low

Verify-script: applied/ migrations vs live catalog diff

VENUS-301 venus Backlog low

Retro cross-vendor audit review of MARS-562 / SHA 872495a (mig 091 get_comision_picked_teachers SECURITY INVOKER + three-way REVOKE + jtps-subquery repoint) — cold brief BOUNCED (audit-mars-ca offline, NOT buffered anywhere); re-fire the cold brief when audit-mars-ca returns

MARS-563 mars Backlog low

usuarios: replace per-user correlated roles/comisiones subplans with set-based CTEs

MARS-555 mars Backlog low

usuarios directory: align tier comment with emitted columns, consider programa/período columns

MARS-557 mars Backlog low

Link legacy routes (/alumnos, /docentes, /administrar/usuarios) into the new unified /usuarios directory + eventual consolidation decision

MARS-554 mars Backlog low

Staff hitting reporter /soporte/[id] for a non-owned existing ticket should redirect to /administrar/soporte/[id], not 404

MARS-551 mars Backlog low

Migrate Mars lookup-key columns from uuid-FK to value-code-text per §Lookup-Backed (deferred strict-compliance from MARS-544 exception)

MARS-546 mars Backlog low

resume-link.ts empty-env robustness: align ??->|| so empty-string NEXT_PUBLIC_APP_URL falls to prod host, not a hard URL() crash

MARS-543 mars Backlog low

MARS-526 fast-follow: focused action tests for updateAlumno hardening — null-JTP orphan (vs MARS-29), stale-updatedAt lost-update rejection, closed-periodo/period-scope guard. Audit noted as coverage gap, non-blocking.

MARS-535 mars Backlog low

EVO-75 mars leg: admin pending-items digest — open support tickets + access requests + correcciones to admins (Elazar)

MARS-533 mars Backlog low

Warn-tier friction (nudge-shown) real-time-pages PM — should be digest-only per friction-vs-error standard

MARS-529 mars Backlog low

EVO-70 tail: retire redundant after() email-outbox enqueue now that T1 trigger-wake is live

MARS-528 mars Backlog low

MARS-519 follow-up: add drift-breadcrumb comment in email-outbox.ts tying RECLAIM_AFTER + claim eligibility to the pg_cron T0 guard fn

MARS-521 mars Backlog low ↳ MARS-519

Prune stale password-login-actions.ts entry from .gitpush-pre.sh email-canonical guard

VENUS-282 venus Backlog low

Dedupe double-fired rectificar-reminder toast on /mi-cursada

MARS-511 mars Backlog low

Apply MARS-507 #2 decorate pattern to mi-cursada/[id]/editar form

MARS-510 mars Backlog low

Historial mapping update + regression + drift checks (PLUTO-583F)

PLUTO-589 pluto Backlog low ↳ PLUTO-583

DB enforcement for future rows (PLUTO-583E)

PLUTO-588 pluto Backlog low ↳ PLUTO-583

Harden migration dry-run tooling against embedded COMMIT/BEGIN

PLUTO-582 pluto Backlog low

Consolidate vFrictionEvents 6-way view duplication onto canonical wrapper pattern

MARS-489 mars Backlog low

supportTickets.statusOptionId is uuid-keyed, not value-code (fleet standard gap)

MARS-487 mars Backlog low

Adopt Pluto comisiones-list reference pattern for venus admin list pages

VENUS-263 venus Backlog low

support-core: split SupportActor into domain userId vs telemetry accountableUserId (VENUS-111 follow-up)

VENUS-260 venus Backlog low

fn_getInformesBundle comparativaAdjunto missing p_adjunto_comision_ids/p_comision_ids commission filter

PLUTO-572 pluto Backlog low

kpi-report.py digest-integration polish for kpi-weekly-report.sh: (1) add explicit --markdown flag alias (default stdout already md); (2) off-vocab line as count/total (e.g. 14/47) for the digest health metric. Section anchors ## 1/2/3 already grep-stable.

BWI-9 basquetwi Backlog low

Filter benign framework-chunk unhandledrejection noise from errscan alert rail

VENUS-256 venus Backlog low

Add self-join to errscan hub_register() (shared template, latent gap)

VENUS-255 venus Backlog low

Investigate stray uncommitted .agent-name change in solo-pluto team tree

PLUTO-562 pluto Backlog low

Verify toast/backend-diagnostic dedup pairing on Mars

MARS-464 mars Backlog low

Migrate call-sites to canonical view names + drop old-named views (vPendingAccessRequests/vAccessRequestsPending, vFrictionEvents1w)

MARS-457 mars Backlog low

Add value/codigo machine-key column to lookupOptions

PLUTO-551 pluto Backlog low

Wire applog-listen@enamel error rail when enamel is built

ENAMEL-11 enamel Backlog low

MARS-419: browser-mode integration test for native-validation coalescing

MARS-421 mars Backlog low

Split client tooling out of /opt so hub.mjs stops landing on client hosts

MSG-262 llmmsg-srv Backlog low

Move caseAddresses off raw app-side SQL onto a Postgres view

AYUD-139 ayudarg Backlog low

Surface vFriction7d convention to mgmt ARO (Fri Jul-10)

VENUS-195 venus Backlog low

Remove viewport-size logging to appEvents

VENUS-191 venus Backlog low

PLUTO-529 client friction-telemetry leg: un-stub notifyFriction + wire checkRequired (post-Jul-10, server-action transport)

PLUTO-535 pluto Backlog low

Pluto Historial change-history panels: audit gap + build (HOLD for Elazar go)

PLUTO-531 pluto Backlog low

Audit Mars trackable routes for Historial change-history coverage gaps (extend the /practicas/[id] Historial pattern fleet-wide)

MARS-410 mars Backlog low

no-silent-failure lint false-positives on catch-empty inside comment prose — add offset-preserving comment-strip pre-pass

MARS-409 mars Backlog low

test: approve-path doc-carry coverage (approveAccessRequest → alumno)

VENUS-158 venus Backlog low

Log-plane parity w/ pluto: applog notify emit warn + userAgent in payload

VENUS-152 venus Backlog low

/practicas global-landing student picker: lightweight id/nombre/apellido-only query

PLUTO-509 pluto Backlog low

Add close/resolve-via-API support endpoint

PLUTO-501 pluto Backlog low

gitpush-pre lint: block value exports in use-server modules (PLUTO-491/492 class)

MARS-397 mars Backlog low

Lint guard: forbid non-async-function exports in "use server" modules (gitpush-pre)

PLUTO-492 pluto Backlog low

Ticket-triage protocol: ayudarg replication (post-venus)

AYUD-138 ayudarg Backlog low

Success email leg(b): 'los de la comuna' recipients (blocked-Elazar)

AYUD-137 ayudarg Backlog low

Photo re-enable: frontend HEIC transcode + EXIF strip (Unit-A)

AYUD-124 ayudarg Backlog low

Gate-correct 403 denials logged at level=error inflate error telemetry

PLUTO-482 pluto Backlog low

appEvents double-logging inflates error-cluster counts ~2x

PLUTO-481 pluto Backlog low

Conform Mars appEvents-immutability fn to fleet §5.1 TG_OP-keyed amendment (6794d0e)

MARS-385 mars Backlog low

Drop duplicate unique index users_normalizedemail_unique (dup of uq_users_normalizedEmail)

MARS-381 mars Backlog low

solicitudes needs-info to modal skin (all three modes, cosmetic, no functional change)

MARS-379 mars Backlog low

Migrate drain-email-outbox cron (jobid=6) off inline bearer onto vault cron_auth_header()

MARS-378 mars Backlog low

lint: admin-family gate-presence check for new /admin pages

AYUD-113 ayudarg Backlog low

Recursos: derive comuna options from cards with data (parallel to needOptions) — avoid empty-state on no-data comunas

AYUD-64 ayudarg Backlog low

a11y: htmlFor/id on Otra + Notas inputs in /acciones/nueva + /necesidades/nueva

AYUD-58 ayudarg Backlog low

Cátedra branding sweep p3: URL slug strategy

MARS-279 mars Backlog low

Document to=pm:X send target + hub PM election/pending-queue in README.md protocol section (shipped in 5741b17, README not yet updated)

MSG-128 llmmsg-srv Backlog low

Enable pg_cron + daily errorDigestSnapshots table so error trends survive appEvents pruning (WI#390)

MARS-334 mars Backlog low

Add LLM-copy block to not-found.tsx — cross-app 404 spec parity (venus/mars/pluto WI#486/#487)

AYUD-93 ayudarg Backlog low

Estadísticas: edad voluntarios/asistidos, género, necesidades cubiertas

AYUD-50 ayudarg Backlog low

Tooling: playwright auth setup para screenshot regression (blocked en #119 — Chrome Wayland + cookies cifradas)

AYUD-91 ayudarg Backlog low

Replace prioridad=87 magic number with named constant

AYUD-59 ayudarg Backlog low

Plan: patient DNI/HC number storage + cross-record sharing - enable future autocomplete-suggest, mismatch warnings ('DNI ya existe con otro nombre'), statistics

MARS-331 mars Backlog low

Pruning strategy for append-only growing tables: appEvents (2334 rows), notifications (5202 rows), imageUploadAnalysisEvents (4327 rows) — no TTL/rotation defined; design retention policy + purge job

MARS-294 mars Backlog low

studentPostgradoProgression table: 0 rows, no known app surface — PM decision: implement feature or drop table

MARS-299 mars Backlog low

helpArticles + helpArticleTags tables: 0 rows, no known app surface — PM decision: implement in-app help or drop scaffolding

MARS-300 mars Backlog low

Hub cleanup traps (post-#594): systemd unit sets LLMMSG_SRV_DB but code reads LLMMSG_DB (no-op env var); stale llmmsg.sqlite + init-db.sh schema conflicts with live v2.sqlite

MSG-200 llmmsg-srv Backlog low

venus: rename telemetry field widthBand→viewportBand (bs-mqmscr4k3wh)

EVO-10 evolutiva Backlog low

cc-context-monitor v3.0 M1 sys.exit(1) aborts MANUAL venus/lezama runs before pg-mirror write when CCM_HUB_URL=127.0.0.1 default. Unattended unaffected (service unit exports LLMMSG_HUB_URL ZT/tunnel). Fix post-ONEDB-12: document manual-run env requirement (export LLMMSG_HUB_URL) over per-host CCM_HUB_URL remap. Bump VERSION.

ONEDB-13 one-db Backlog low

Graceful handling of stale server-action-ID (deploy-skew) in global error boundary

MARS-53 mars Backlog low

Adopt curated repo-visible knowledge .md for Pluto agent team (bs-mr3bt2c0vgy consensus)

PLUTO-470 pluto Backlog low

Mobile layout-hardening at 384-415px portrait cohort (visual QA, browser-tool agent)

MARS-158 mars Backlog low

CR-7 comisionChangeRequests

MARS-214 mars Backlog low

Harden intentional info-level appEvents streams against LOG_LEVEL changes (generalizes PLUTO-182's forceSync pattern). Today these persist ONLY because prod LOG_LEVEL=3 disables the logger.ts:98 info-drop gate — none pass forceSync, so lowering LOG_LEVEL (e.g. someone treating 3 as debug noise) would SILENTLY kill the email audit trail + telemetry. Promote to forceSync:true at the call sites so they're LOG_LEVEL-independent: email/email-sent + email/sendAdminEmail (audit trail), client-env/viewport (PLUTO-163), navigation/practica-link-dead, cron audit (pollSecurityAlerts, kpiCronReport, kpiCronSkipRecipient, ux-pain-digest), monitoring/applogListenerHeartbeat. After this, LOG_LEVEL becomes a true verbosity dial (incidental noise only) with no collateral audit-trail loss. EXCLUDE benign well-known + nav page_not_found (we WANT those droppable). Verify with db whether forceSync is a stored appEvents column or purely a logger control flag (affects how to audit coverage).

PLUTO-190 pluto Backlog low

Rename studentAssignments.jtpUserId → assignedTeacherUserId

MARS-208 mars Backlog low

dm-* send-authorization: reject non-owner/non-host-nw/non-Elazar sends to or origin_aro'd-as aro:dm-*

MSG-50 llmmsg-srv Backlog low

EVO-12 follow-up: catch-all API 404 capture (app/api/[...slug]/route.ts) — nonexistent /api/* routes have no Next render/error hook so they escape both the page-404 server capture (MARS-155) and instrumentation.ts (500s only); add a catch-all route that classifies+tiers+logs API 404s through the same shared log path

MARS-162 mars Backlog low

pickerClear button below 44px touch-target min (ayudarg-commons.md)

AYUD-97 ayudarg Backlog low

MapController useEffect deps include full positions Map, causes redundant re-fire on unrelated list re-renders — narrow to focus.nonce

AYUD-101 ayudarg Backlog low

FUTURE (recommend, separate from skew fast-follow): enable next.config deploymentId + Vercel Skew Protection (if Pluto's plan allows) for a SOUND client-vs-server build compare — gives the app a real origin-build signal (today the build-ID is COARSE: app sees only its own serving build, never the client's origin build, which is why an app-side skew downgrade is unsound and the daemon owns the deploy-timing discriminator). Also makes a real end-to-end deploy-skew test possible. Low pri.

PLUTO-170 pluto Backlog low

MARS-373 follow-ups (parked, low-urgency): (a) requireAuthForAction-PRESENCE companion push-lint — flag a session-backed server-ACTION write to an audited table missing the view-as guard (require-cap.ts chokepoint); conditional coupling, MUST NOT fire on cron/system:/tsx-repair/read paths (audit scoping guard). Closes the MARS-163-class silent-omission residual audit could not exhaustively rule out on MARS-352 view-as. (b) Hard-flip readiness for the archive-context-presence lint: currently WARN-permanent per audit; flip to hard-fail ONLY after closing the 204254-function-body (CREATE FUNCTION/DO) DML false-positive class + the 2 other KNOWN-GAPS (unquoted-lowercase DML, multi-file txns). audit sign-off required before any flip. Source: MARS-373 close 2026-07-02.

MARS-375 mars Backlog low

Index cold FK columns deferred from advisor sweep

MARS-67 mars Backlog low

11 active studentAssignments rows with NULL assignedTeacherUserId — students with no teacher assigned (pre-dates 2026-06-06, surfaced during MARS-40). Fix path: evidence-based auto-assign per no-operator model (NOT an admin-pick UI). Triage when bandwidth allows.

MARS-43 mars Backlog low

perf: practicaImages rotation UPDATE — scope-validate trigger fires on all UPDATEs

MARS-167 mars Backlog low

appEvents off-schema categories: 'toast' (53) + 'admin' (3) not in valid category list; logging hygiene

PLUTO-148 pluto Backlog low

Optional: relabel Mars self-probe appEvents rows action='self-probe' (cosmetic, non-blocking)

MARS-175 mars Backlog low

practicaDailySeq gap-fill needs partial unique index first: uq_practicas_student_date_seq is non-partial, so a soft-deleted práctica keeps its (studentUserId,date,seq) slot. Adding deletedAt IS NULL to the seq-counter MAX (MARS-203 item-1) would let re-mint reuse a taken slot → unique_violation 500. Audit BLOCKED + reverted item-1 (guard comment left documenting the trap). REAL fix (2 steps): (1) db migration — make uq_practicas_student_date_seq PARTIAL (WHERE deletedAt IS NULL), audit pre-apply review; (2) THEN coder re-adds the deletedAt filter to the seq counter so gap-fill is safe. Benign/cosmetic today (folio gap after same-day delete-recreate), low urgency. Same partial-index class as MARS-181.

MARS-206 mars Backlog low

Add support: prefix to mars-archive-reasons.md vocab + .gitpush-pre.sh reason-prefix allowlist

MARS-178 mars Backlog low

Add unconditional liveness heartbeats to send-weekly-kpi + support-tickets-digest cron routes (watchdog-coverage prerequisite)

MARS-347 mars Backlog low

Stop the recurring push stash-dance: gitignore untracked auditor scaffolding + resolve parked pm/codex-says.md

MARS-56 mars Backlog low

Telemetry tail from MARS-369: notificaciones markAllRead/markReadAndNavigate + consumeRectificarToasts lack try/catch telemetry. Deferred: minor impact + markReadAndNavigate redirect()-in-catch hazard (NEXT_REDIRECT throws-to-signal) needs careful handling.

MARS-371 mars Backlog low

error-digest client-noise exclusion is inert: keys on detail IS NULL, but client unhandled-errors now always carry detail{os,browser}, so the intended exclusion never matches and lone transient client 'network error' rows surface in errscan. Fix the exclusion predicate to match the intended client-noise class WITHOUT class-suppressing real client errors (design-gate, not a blind broaden). Pairs with MARS-343 forensic-capture gap.

MARS-349 mars Backlog low

Solicitudes: evaluate+fold net-new features into Pluto from mars/venus (brainstorm bs-mr4h5azsk3g)

PLUTO-477 pluto Backlog low

JTP-facing 'solicitar rectificación / reabrir' action: flip graded (aprobado/desaprobado) práctica back to rectificar through the app (audited), so students can correct submitted uploads without a DB poke

MARS-177 mars Backlog low

Large-screen sales-surface polish: xl/2xl density tiers + form line-length cap + side-gutter filters (bs-mqmxqxwop02)

MARS-159 mars Backlog low

Large-screen sales-surface polish: add xl/2xl density tiers (more grid cols / master-detail / side-rail filters), data tables over stacked cards, ~40-48rem line-length cap on prose+forms, persistent sidebar + fluid type >=1280 + responsive imgs. Scope: /informes + KPI dashboards + /admin tables + public landing ONLY. Does NOT touch alumno (PLUTO-159) or docente grading mobile-first paths. Verify via proxy pixel-confirm at 1920/2560. Ship-timing = Elazar's call (low current N). From bs-mqmxqxwop02 decision.

PLUTO-162 pluto Backlog low

Cross-app: port Mars error-digest cron (errores 24h digest email) to Pluto + Venus — Elazar greenlit 2026-06-07, NOT now. Each app gets its own daily digest cron + threshold + recipient. Pluto/Venus PMs mirror in their backlogs when picked up; this is the tracking SSOT.

MARS-63 mars Backlog low

Quiet well-known-path 404 noise (robots.txt, apple-touch-icon[-precomposed].png) in page_not_found telemetry

PLUTO-181 pluto Backlog low

pacientes archive coverage + cross-práctica demographic propagation

VENUS-86 venus Backlog low

B6 student-vs-student/camada compare (design-pending)

VENUS-43 venus Backlog low

C1 single shared complic. pool filterable by modulo — reverses confirmed §9, needs Sebastian go

VENUS-47 venus Backlog low

C2 shared tratamiento pool Quistes/Tumores/Cancer — reverses confirmed §10, needs Sebastian go

VENUS-48 venus Backlog low

D1 patient localidad field for residence distribution — ask Sebastian

VENUS-49 venus Backlog low

D3 Infecciones cervicofaciales tratamientos — ask Sebastian

VENUS-51 venus Backlog low

D4 keep/drop Enucleacion coadyuvante (Tumores) — ask Sebastian

VENUS-52 venus Backlog low

D5 Otros modulo empty ok? — ask Sebastian

VENUS-53 venus Backlog low

log-error/log-toast/log-client-env: realUserId attribution under view-as (parity with MARS-352 log-ux-event). MARS-352 fixed /api/log-ux-event to credit session.realUserId (the real admin) not session.id (the impersonated target) under view-as, so UX-pain abandon-derivation isn't poisoned by events the target never triggered. The sibling client-log sinks log-error/log-toast/log-client-env share the same target-attribution-under-view-as property (the UX-pain miner groups by user) — apply the same realUserId fold-in + isViewAs-in-detail to those 3 routes for parity. Out of MARS-352 scope (security invariant + nav UX were the gate); forensic-attribution hygiene. Surfaced by coder during MARS-352 Class-A review.

MARS-354 mars Backlog low

Audit + sync prod public-fn DDL drift to checked-in migrations (search_path pins) — pluto mirror of venus EVO-8

PLUTO-153 pluto Backlog low

Conform Mars monitoring/notifications to fleet scrp- standard (bs-mqmr47bwkk4)

MARS-155 mars Backlog low

Add unit-test harness + normalizeEmail parity tests

MARS-152 mars Backlog low

Logging-hardening: clientError:global-error rows persist with EMPTY detail (no digest/errorName/message/route) — un-diagnosable from appEvents alone. Capture digest+message+route at the global-error boundary so future global-error volume is triageable. Low-pri; only escalate if global-error volume rises (currently sparse/benign: 2-4/day transient).

PLUTO-221 pluto Backlog low

student-assignment-tcm.ts peer-inference fallback (L188-234) seeds a NULL SA from OTHER students' practicas.jtpUserId/ayudanteUserId snapshot; TCM-gated (deletedAt IS NULL + role-matched) so stale teachers rejected — NOT a rule-(b) violation, low risk. Tighten to prefer live peer SA over práctica snapshot.

MARS-22 mars Backlog low ↳ MARS-21

Sibling-gate-consistency lint: every /admin/* route must resolve isAdmin; flag any route with a weaker guard than its siblings (catches AYUD-110-class omission bugs deterministically in the push gate)

AYUD-111 ayudarg Backlog low

ADVISORY-ONLY (do not hard-fail push lane): soft-delete-filter static lint - flag FROM/JOIN on a soft-deletable table without deletedAt IS NULL / active-view. Split out of MARS-373 because it's inherently false-positive-heavy (can't statically prove filtering across multi-line/dynamic SQL) and has NO proven source (pluto never shipped one, contrary to an earlier relay). Real soft-delete-leak coverage already exists via auditsolo negative-assertion (seed a deleted row, assert excluded) + the MARS-202 active-view-by-default epic. Only worth building as an added-lines-only advisory heuristic IF the leak class recurs; otherwise MARS-202 is the structural fix. Source: MARS-373 recon 2026-07-02.

MARS-374 mars Backlog low

bug(auth): seed scripts use raw admin.createUser → NULL-token login-lockout in seeded users

VENUS-20 venus Backlog low

getJtpStats PENDING axis is SA-populated while admin-delta-report + vPracticasSinEvaluar are SA-free — informes oracle can miss a picked-but-no-active-SA práctica

MARS-138 mars Backlog low

Orphaned-pending picks: reassign-pending-practicas handling after write-path retire (MARS-136)

MARS-137 mars Backlog low

Rotate Mars Supabase DB (postgres) password — leaked in git history

MARS-135 mars Backlog low

.llmmsg-aros cleanup: remove 16 repo-tracked copies in pensanta website repos (#631 tail)

MSG-225 llmmsg-srv Backlog low ↳ MSG-220

Evaluar estado del equipo y del disco (¿bootea? ¿disco legible?)

ADRIANAP-10 adriana-pavon Backlog low ↳ ADRIANAP-9

Extraer almacén local de correos — Apple Mail: ~/Library/Mail/, o .pst si era Outlook

ADRIANAP-11 adriana-pavon Backlog low ↳ ADRIANAP-9

Importar mensajes recuperados a cuenta activa actual via IMAP

ADRIANAP-12 adriana-pavon Backlog low ↳ ADRIANAP-9

KPI weekly-cron staleness alert: last-success-timestamp check that pages if no kpiCronReport appEvent in >8 days. Weekly crons (0 9 * * 1) can fail silently for ~7d before anyone notices (PLUTO-39 showed how easily a weekly gap reads as 'dead'). Defensive observability add, NOT a bugfix. Touches email/alert path → audit pre-push.

PLUTO-45 pluto Backlog low

Generar informe de volumen y fechas de correos recuperados

ADRIANAP-13 adriana-pavon Backlog low ↳ ADRIANAP-9

DB-health sweep follow-ups (from PLUTO-138, non-urgent): (1) verify practicas.idx_practicas_editlocked query path — drop if genuinely cold; (2) confirm userAuditLogLegacy table is retired → archival candidate (table+idx); (3) FK-usage audit: of 64 advisor-flagged unindexed FKs, identify which appear in live WHERE/JOIN (hot) vs audit/write-path (createdBy/deletedBy/archivedBy — leave cold), index only the hot ones via migration w/ archive-context. Don't index/drop blindly — query-path verify first.

PLUTO-139 pluto Backlog low

MSG-30 lezama: coordinated full-tree pull-forward (shim v2.9.47 + bootstrap v1.19 + package.json, atomic) - replaces nw-lezama hand-patch, un-dirties staged v1.18 bootstrap

MSG-47 llmmsg-srv Backlog low

Mars DB hygiene (no IO risk, found in 06-15 Disk-IO self-check): (1) VACUUM ANALYZE teacherComisionMemberships (65d stale, 19.7% dead); (2) lower autovacuum_vacuum_scale_factor on notifications (high churn); (3) drop unused idx_st_createdbyuserid on supportTickets (0 scans, 13 rows); (4) index users.comisionId when query plans warrant. All reversible, audit pre-apply DDL review.

MARS-131 mars Backlog low

Down-tier callbackMissingCode error→warn at /auth/callback (bare-callback bot/consent-cancel hits, PLUTO-461-class) — only if it recurs at volume; 1 all-time hit as of 2026-07-02

PLUTO-466 pluto Backlog low

Real-time error push + observe-only auto-heal protocol (bs-mqn2ze006f7 fleet-ratified)

MARS-160 mars Backlog low

cdw: Caddy flush_interval -1 for SSE reconnecting issue (Caddyfile)

MSG-73 llmmsg-srv Backlog low

Advisory (low pri): enable auth_leaked_password_protection (HaveIBeenPwned check) in Supabase auth — currently disabled. Low value for Pluto (allowlist-only, no open signup) but a free defense-in-depth toggle. From PLUTO-123 security sweep.

PLUTO-125 pluto Backlog low

Phase-2 demo cleanup (BLOCKED on demo-row purge): strip the now-unneeded demo filters/labels/tab once Elazar purges demo rows. These are PROTECTIVE while rows exist — removing earlier leaks demo data into real reports. Sites: admin/page.tsx:11 (@demo pendingUsers filter), informes/page.tsx:117-121 + practicas/page.tsx:139-142 ('Demo ' comision filter), admin-user-detail.tsx:68/127 + audit-log.tsx:122 (isDemo/demo_seed label map), complication-rate/dificultad-distribution/procedure-type cards '(no demo)' text, admin/usuarios 'Usuarios demo' tab. Coupled to PLUTO-118 phase-1 + the row purge.

PLUTO-120 pluto Backlog low

llmmsg-kpi-report.sh: strip dead -small ARO branch from §PM .aro action list (lanes retired MSG-17)

MSG-26 llmmsg-srv Backlog low

CI/lint guard: flag raw-email ('email =' / lower(email) =) compares in auth + lookup paths; force normalizedEmail-column compares

MARS-154 mars Backlog low

Mars: track index/DDL changes in-repo — schema.md omits indexes (0 index refs) and DDL is applied via Supabase MCP (recorded only in Supabase migrations table), so index changes like ix_appEvents_category_action_createdAt have no git-side record. Add index export to export-db.py OR adopt a db/migrations file convention so DDL is reproducible/reviewable from the repo.

MARS-117 mars Backlog low

Hygiene: vPracticaParticipantFacts counts demo-practica-by-real-student in scoped teacher stats (pre-existing, surfaced during PLUTO-97 gate-A)

PLUTO-103 pluto Backlog low

D8 Tier-3: batch sequential per-row write loops (personas-actions:378/388 role add/remove) into set-based INSERT VALUES / UPDATE WHERE id=ANY

PLUTO-100 pluto Backlog low ↳ PLUTO-304

PLUTO-89 fast-follow hardening: multi-pieza dup-guard is order-sensitive ('11,12' vs '12,11' evades tier-1 because piezas keep insertion order). Canonicalize the pieza set for the dedup KEY only (sorted), preserving as-entered display/storage order. Needs functional index or normalized key column

PLUTO-91 pluto Backlog low

api-images: immediate-erasure endpoint (GDPR/right-to-erasure) — DELETE /{id}?purge=1 or /erase/{id} that skips _trash + unlinks immediately, tenant-scoped, audit-logged.

EVO-3 evolutiva Backlog low

Dead code cleanup: NecesidadesView + getNecesidadesForVolunteer/getNecesidadesPendientes never mounted/called

AYUD-105 ayudarg Backlog low

Drop legacy accessRequests.status text col — statusOptionId FK is the enforced gate; plain text col is unconstrained dead weight (surfaced during Pluto PLUTO-22 cross-app alignment)

MARS-92 mars Backlog low

api-images: reconcile 67 orphan images in flat uploads/2026/ with no mars/pluto DB owner — decide trash vs reassign

EVO-2 evolutiva Backlog low

informes follow-up: grader keeps credit even after student SA lapses (LEFT-JOIN vStudentAssignments on the graded axis)

MARS-5 mars Backlog low

Pluto P3: getCurrentPeriodoId + getComisionesForCurrentPeriodo no auth guard — comision enumeration

PLUTO-27 pluto Backlog low

Pluto P3: denyAccess UUID-in-URL + deny-vs-404 — practica-existence probe

PLUTO-28 pluto Backlog low

Pluto P3: vPracticas* views don't filter isDemo — demo inflates grader stats (fix at vPracticas base)

PLUTO-29 pluto Backlog low

Pluto P3: periodos.isCurrent no uniqueness constraint — two isCurrent=true rows possible

PLUTO-30 pluto Backlog low

Pluto P3: cold audit FK cols (createdBy/updatedBy) unindexed — defer to post-go-live advisor run

PLUTO-31 pluto Backlog low

CR65: nueva pagina /mi-panel (necesidades tomadas/pendientes del user, personas visitadas/creadas sin revisita)

AYUD-109 ayudarg Backlog low

Pluto P3 residual: bulkInviteUsers welcome-email loop bypasses the /send-email HTTP rate limiter (PLUTO-20) — uncapped in-process sends on bulk invite. Decide cap (e.g. 100/batch or inter-send delay) vs accept (admin-initiated, low-freq, in-process-mail-undroppable per PLUTO-20 design). From audit round-1.

PLUTO-32 pluto Backlog low

Regen schema.md (stale on personaEventPhotos line) — export-db.py blocked on venus (psycopg2 missing); run elsewhere or fix venv

AYUD-10 ayudarg Backlog low

fn_detectRateSpike cadence: every-2min cron is 91% of DB-time (frequency-driven, ~7.6s/day absolute) - weigh fraud-detection latency vs cost

PLUTO-67 pluto Backlog low

log-toast ingest: no server-side rate limit (anon-flood appEvents amplification)

PLUTO-66 pluto Backlog low

/notificaciones modest payload trim: paginate the 100-row list + replace 100 per-row server-action-bound <form>s with one delegated action/link nav (smaller RSC payload + less hydration). Not a perf bug — cold-start was the 6s cause; this is opportunistic. No DB/infra change.

MARS-103 mars Backlog low

PLUTO-34 contract step: DROP flat columns on 7 archive tables after jsonb expand verified in prod (irreversible)

PLUTO-65 pluto Backlog low

Weekly ux-pain digest delivery: move to Vercel-cron→authenticated-POST-to-hub→PM-drains-on-reconnect (remove relay-row/always-on-agent dependency). Blocked on llmmsg-maintainer answers: (1) can Vercel POST to hub from outside the reverse tunnel with an auth key, (2) unread-buffer retention/TTL must exceed weekly digest interval so an offline PM still receives it. Applies to mars (replace MARS-84 relay-row) + venus + pluto toast-ports. db agents are NOT 24/7 so a db-host cron is not viable; only nw agents + maybe PMs run 24/7.

MARS-102 mars Backlog low

/informes table overflows 43px @360 (861px table-wrap) — needs mobile card/scroll mode

MARS-100 mars Backlog low

Convenience VIEW joining clientError.digest -> serverError.detail (full message+stack) for client-error diagnosis

PLUTO-59 pluto Backlog low

UX: pre-filter practica list-row links by viewer scope so out-of-scope rows aren't clickable (avoids working-as-designed scope-deny on /practicas/[id])

PLUTO-57 pluto Backlog low

Migrate all touch primitives (Button/Select/Input) to uniform pointer-coarse:min-h-11 for 44px touch targets — replaces the 3-way convention (Button h-11 sm:h-9 / Select flat h-11 / Input sm:-gated); keys on input modality not viewport so a narrowed desktop window stays 36px. Ref Venus impl. Do AFTER PLUTO-40 lands.

PLUTO-41 pluto Backlog low

Phase 2 (ONLY after vanilla index.html ships + verifies): build index-new.html as a from-scratch redesign PROPOSAL to present to client; keep noindex,nofollow until client approves

HOAC-13 ha Backlog low ↳ HOAC-1

Proxy viewport tooling: chrome-devtools-mcp (CDP) for Pluto needs an auth path — Pluto is OAuth-only

PLUTO-51 pluto Backlog low

Bound uploadImage/deleteImage timeout (data-driven, not guessed)

MARS-630 mars Backlog someday

errscan.sh digest mislabels signature-rollup occurrence count as a per-path count -> false per-path warn spikes (e.g. 'page_not_found x42 @/email/sendgrid.env' when that path has 2 rows; 42 = aggregate env-shape warn occurrences across N paths under one message-derived signature). Lane 1 (bin-whey, errscan.sh ~L244/L309): relabel so count reads as signature rollup + path as a SAMPLE ('[42x total] page_not_found e.g. action=/email/sendgrid.env'). Lane 2 (per-project db: vAppAlertsRecent/vAppErrorsRecent): expose distinctPaths so display can render '42x / 7 paths'. Affects all 3 apps (shared errscan + EVO-12 scanner down-tier shape). Triage-noise only, no data/security. Low-pri.

EVO-46 evolutiva Backlog someday

OPTIONAL cosmetic: converge SCANNER_PROBE_RE env alts to the single fleet-canonical literal. Pluto's live v1.95.3 form is two alts (/\.env(?:$|[./~0-9_-])/ + /(^|/)env(?:$|[./~0-9_-])/), audit-proven coverage-EQUIVALENT (in fact a superset) to the published fleet canonical /(^|/)(?:[\w.~-]*\.env|env)(?:$|[./~0-9_-])/. ZERO coverage change — purely so the canonical-owner's code is byte-identical to the SSOT it publishes (cleaner mars/venus cloning + future audits). NOT worth a dedicated deploy: ride-along ONLY on the next touch of not-found-classify.ts. Audit adjudicated 2026-06-29.

PLUTO-452 pluto Backlog someday

rule-21 standalone-ack gate misses 'ack <noun>' shape

MSG-276 llmmsg-srv Backlog someday

Should info/malicious page_not_found bulk (8304 rows) be visible on any digest/surface

PLUTO-660 pluto Backlog someday

PM retirement doesn't clear aros.pm_agent seat

MSG-274 llmmsg-srv Backlog someday

MARS-532 import-preview surfacing: bulk CSV interlock shows per-row fail-closed apply but no batch preview of would-be-halted rows — PARKED (Elazar: bulk not operationally important)

MARS-538 mars Backlog someday

Impersonation banner 'Volver a mi cuenta' button: verify mobile touch-target — CDP click() no-op, JS element.click() worked

PLUTO-574 pluto Backlog someday

VENUS-4-E relay sidecar (deferred)

VENUS-218 venus Backlog someday