Skip to content

docs(todo): cerrar los puntos revisados y anotar las decisiones - #26

Merged
bpstack merged 11 commits into
claude/compassionate-planck-gh6aoffrom
opencode/todo-closeout
Oct 12, 2026
Merged

bpstack merged 11 commits into
claude/compassionate-planck-gh6aoffrom
opencode/todo-closeout

Conversation

@bpstack

@bpstack bpstack commented Oct 12, 2026

Copy link
Copy Markdown
Owner

Cambios

  • docs/TODO.md: se cierran los puntos resueltos en las ramas de arreglo, se reescriben los que siguen abiertos y se añaden los nuevos (rotación de credenciales ampliada, zonas horarias).
  • Decisiones del dueño anotadas en la doc de cada módulo; docs/general/database/README.md: certificado de Aiven y recuento de migraciones.

Por qué

Cierre de la revisión de los informes de OpenCode (A3–A9) y de las migraciones aplicadas en Aiven el 2026-10-12.

- Remove: maintenance change and history without a transaction, incoherent
  group payments, manual notifications to inactive users.
- Replace "deleting a group deletes its history" with what is left: group
  mutations and their history outside one transaction.
- Add, high priority: apply 20261011_keep_group_history_on_delete.sql in
  Aiven before deploying the group deletion.
- Add: the groups history logs fields that did not change.

Why: these four entries sit next to each other, so editing them from four
branches made every pull request conflict. They are fixed in
opencode/fix-maintenance-history, fix-group-payments,
fix-notification-recipients and fix-group-deletion; merge this one last.
- Remove: generation leaving fixed-day and approved-request cells empty,
  a published month that could be changed, setSchedulableEmployees losing
  dates, and the non-deterministic solver.

Why: the first three are fixed in opencode/fix-scheduling; the fourth was
decided (left as it is) and recorded in docs/scheduling/decisions.md.
…10-11

- Remove: deleting comments and photos of closed checklist days; cashier
  history and totals without canViewReports.
- Narrow "voucher lifecycle and closures without a lock" to what is left:
  shift and day closures without a lock.
- Checklist manual reset: note the decision to leave the unused endpoint
  as it is and what to fix before using it.

Why: fixed in opencode/fix-checklist and opencode/fix-cashier; the reset
was decided on 2026-10-11.
… 2026-10-11

- Remove: deleting an invoice also deletes its history (kept permanent by
  decision); integrity of the validated PDF (kept by decision); no checks on
  amounts and dates; uploads and downloads without content or size checks.
- Move the monthly close of Conciliation to low priority and rewrite it:
  it has no screen and a closed month does not lock its days; left as is.
- docs/conciliation: say the monthly close exists only in the API and does
  not lock the days.

Why: fixed in opencode/fix-backoffice-files and
opencode/fix-backoffice-invoices; the rest was decided on 2026-10-11, and
both decisions are recorded in docs/backoffice/README.md.
- Rewrite "MySQL de Aiven en UTC" as the whole problem: DATE columns reach
  the client as a timestamp at Node's midnight, DATETIMEs shift when Node
  and MySQL run in different zones, and "today" is computed in UTC in the
  browser, the backend and Aiven.
- List where it shows up and the plan: DATE as YYYY-MM-DD strings, today in
  Europe/Madrid, a fixed zone between Node and MySQL.

Why: editing an invoice in local moved its dates back one day; measured on
2026-10-12 against the local database with Node in Madrid and in UTC. The
owner decided to handle it as its own task.
- Remove: conciliation list without paging and checklist_config unused
  (both left as is by decision, now noted in their module docs); month
  reset without a transaction and day ids of another month in bulk edits
  (fixed in opencode/fix-scheduling); LI as rest in the solver (kept as is,
  recorded in docs/scheduling/decisions.md).
- Keep: rejecting invoices has no screen (decided on 2026-10-04).

Why: reviewed against the code on 2026-10-12; the owner decided the three
entries that needed a decision.
- Remove: the Excel importer (deleted on 2026-10-04); the group page not
  refreshing and contacts visible to every role (fixed in
  opencode/fix-group-detail); the solver daemon queue and the repeated
  group reminders (kept as they are by decision, recorded in
  docs/scheduling/decisions.md and docs/groups/README.md).

Why: reviewed against the code on 2026-10-12; the owner decided the two
entries that needed a decision.
- Delete the two Maintenance races, sensitive data in the logs and the
  authorization log, fixed in fix-maintenance-history and fix-logging.
- Delete the unused parking procedures and the Logbook history entries,
  left as they are, and record both decisions in the module docs.
- Add the Maintenance identifier to the timezone entry: it takes the date
  of Node.

The A5.3 review checked each entry against the code and the owner decided
the ones that were not bugs.
- Delete the home panel entry, fixed in fix-home-logbooks.
- Delete the parking status map, the Logbook trash and filters, and the
  messaging features without a screen, left as they are, and record the
  decisions in the parking, Logbook and messaging docs.
- Rewrite the frontend tests entry: the tests exist in backend/tests; what
  is missing is a runner of its own.

The A5.4 review checked each entry against the code and the owner decided
the ones that were not bugs.
… Aiven CA

- TODO: the credential rotation now covers the plaintext password of an
  application user found in the published history (test-login.js, 8595ec0).
- database README: record that the Aiven CA certificate stays in the
  repository.

Why: the privacy review of the full history (A7.1-A8.2) found that password,
which the 2026-10-05 history rewrite missed; the owner chose to rotate it
instead of rewriting history again, and to keep the public CA certificate
the TLS connection needs.
…count

- TODO: remove the high-priority entry to apply
  20261011_keep_group_history_on_delete.sql on Aiven.
- database README: 26 migrations recorded and applied on Aiven, with the
  two applied on 2026-10-12.

Why: both migrations were applied on Aiven on 2026-10-12 after a dry run
and read-only checks, and verified afterwards; the README still said 15.
@bpstack
bpstack merged commit 3e945d9 into claude/compassionate-planck-gh6aof Oct 12, 2026
4 checks passed
@vercel

vercel Bot commented Oct 12, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
four-points Ready Ready Preview Oct 12, 2026 6:54pm UTC

This branch was successfully deployed

1 active deployment
Preview — 880bc217 Deployed Oct 12, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant