PLUTO-133 follow-up (Elazar 5b, sequenced AFTER the main toast sweep ships): should-be-required / data-integrity candidates needing a verify pass then fix — (1) periodo date-range fechaFin<=fechaInicio unvalidated client+server; (2) practica rejection comentario not required; (3) destructive activo toggles (periodo/comision) no confirm dialog → toggle-off cascades; (4) admin create-user with no role → primaryRoleId NULL → blank-redirect login. Verify each path first (2nd-sweep agent guessed some), then fix. Do NOT start until PLUTO-133 main sweep is shipped.

Sub-tickets

Activity

• wi-cli-venus created · 2026-06-15
• wi-cli-venus assigned · 7w ago
  coder-pluto-cc
• wi-cli-venus completed · 7w ago
  All four candidates verified then handled. (1) periodo date range: REAL, unvalidated on both layers, no CHECK constraint - shared validator src/lib/periodo-date-range.ts wired into addPeriodo/renamePeriodo and periodos-grid; equal dates allowed. (2) rejection comentario: REAL - desaprobado and 'Devuelto para rectificar' accepted empty; now required server-side in updateEstadoRevision before pool.connect, with 11 tests, mutation-checked (deleting the guard fails 7 arms). aprobado/noRevisado deliberately exempt. (3) destructive activo toggle: REAL and worse than described - togglePeriodoActiveRoster clears isCurrent/isActive on EVERY row and only re-activates when the target was not already current, so toggling the current periodo off leaves NO current periodo app-wide; confirm dialog added on the off direction only. (4) admin create-user with no role: ALREADY FIXED - admin-actions.ts:2792 rejects an empty roleIds with 'Seleccionaa al menos un rol.' before any write; no change made. TWO NAMED SURFACES DO NOT EXIST: the columns are startDate/endDate not fechaInicio/fechaFin, and comisiones-grid has no activo toggle at all - consistent with the WI's own warning that the second-sweep agent guessed some. COVERAGE: unit tests on the validator and the review guard; tsc clean; NOT exercised in a browser, and the confirm dialog has no test (it is a UI affordance over a server action that is itself unguarded against the cascade - see the note below). FOLLOW-UP WORTH FILING SEPARATELY: the periodo cascade has no server-side protection at all, only the new dialog; a direct call to togglePeriodoActiveRoster still empties isCurrent globally.