@@ -149,6 +149,13 @@ Pescamar remains a named implementation inside the broader Seafood Intelligence
 
 The rollout and productization plan is maintained in [`ROADMAP.md`](./ROADMAP.md). Pilot acceptance remains governed by [`PILOT_ACCEPTANCE.md`](./PILOT_ACCEPTANCE.md).
 
+### Alta de usuarios piloto
+
+1. Un administrador entra a **Operadores** (`/operadores`) y crea la identidad con nombre, correo, rol y plantas (Ancud/Quellón) asignando una **contraseña temporal**; el servidor la marca siempre como temporal (`must_change_password`) y registra el alta en `auth_events`.
+2. Se entrega el correo y la contraseña temporal al usuario por un canal privado (no hay envío de correo automático ni tokens de invitación).
+3. Al primer login la aplicación exige definir contraseña propia antes de mostrar nada (`/api/password` verifica la temporal, limpia el flag y audita `password_changed`); después muestra una bienvenida mínima con los caminos primarios del rol.
+4. Roles del piloto: operador de planta → `operations` (o `quality` para calidad), responsable comercial/administrativo → `finance`, gestión por excepción → `admin` (o `viewer` para sólo lectura). Altas y cambios de contraseña quedan en **Auditoría de acceso** (`/modulos`).
+
 ---
 
 ## Product principles
 
@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { getSql } from "./_db.js";
 
 type Request = { headers?: Record<string, string | string[] | undefined> };
-type EventType = "login_success" | "login_failure" | "login_rate_limited" | "logout";
+type EventType = "login_success" | "login_failure" | "login_rate_limited" | "logout" | "operator_created" | "password_reset" | "password_changed";
 
 const WINDOW_MINUTES = 15;
 const PAIR_LIMIT = 5;
 
@@ -6,7 +6,7 @@ type Headers = Record<string, string | string[] | undefined>;
 declare const process: { env: Record<string, string | undefined> };
 export type AuthRequest = { headers?: Headers };
 export type OperatorRole = "admin" | "operations" | "finance" | "quality" | "viewer";
-export type SessionOperator = { id: string; fullName: string; email: string; role: OperatorRole; plantIds: string[]; organizationId: string; executiveExperience: boolean };
+export type SessionOperator = { id: string; fullName: string; email: string; role: OperatorRole; plantIds: string[]; organizationId: string; executiveExperience: boolean; mustChangePassword: boolean };
 
 // The executive (CEO) experience is determined server-side so the client bundle never
 // carries the identifying email. Override with the CEO_OPERATOR_EMAIL env var when needed.
@@ -81,16 +81,16 @@ export async function requireOperator(request: AuthRequest, roles?: OperatorRole
 
   const hash = tokenHash(token);
   const rows = await getSql()`
-    select o.id,o.full_name,o.email,o.role,o.plant_ids,s.last_seen_at
+    select o.id,o.full_name,o.email,o.role,o.plant_ids,o.must_change_password,s.last_seen_at
     from operator_sessions s join operators o on o.id=s.operator_id
     where s.token_hash=${hash} and s.expires_at>now() and o.active=true limit 1`;
-  const row = Array.isArray(rows) ? rows[0] as {id:string;full_name:string;email:string;role:OperatorRole;plant_ids:string[];last_seen_at:string|Date|null}|undefined : undefined;
+  const row = Array.isArray(rows) ? rows[0] as {id:string;full_name:string;email:string;role:OperatorRole;plant_ids:string[];must_change_password:boolean;last_seen_at:string|Date|null}|undefined : undefined;
   if (!row || (roles && !roles.includes(row.role))) return null;
 
   const lastSeenMs = row.last_seen_at ? new Date(row.last_seen_at).getTime() : 0;
   if (!Number.isFinite(lastSeenMs) || Date.now() - lastSeenMs >= SESSION_TOUCH_INTERVAL_MS) {
     await getSql()`update operator_sessions set last_seen_at=now() where token_hash=${hash}`;
   }
 
-  return { id: row.id, fullName: row.full_name, email: row.email, role: row.role, plantIds: row.plant_ids ?? [], organizationId: organization.organizationId, executiveExperience: executiveExperienceFor(row) } satisfies SessionOperator;
+  return { id: row.id, fullName: row.full_name, email: row.email, role: row.role, plantIds: row.plant_ids ?? [], organizationId: organization.organizationId, executiveExperience: executiveExperienceFor(row), mustChangePassword: row.must_change_password === true } satisfies SessionOperator;
 }
@@ -1,5 +1,5 @@
 export const expectedMigrations=[
-  '001_core.sql','002_settlement_workflow.sql','003_operator_auth.sql','004_reception_plant_evidence.sql','005_auth_abuse_audit.sql','006_historical_production.sql','007_live_lot_memory.sql','008_dispatches_sales.sql','009_sales_orders_inventory_daily_close.sql','010_transformation_costs.sql','011_reception_evidence_files.sql','012_plant_identity_links.sql','013_fix_create_lot_sale.sql','014_reception_evidence_ownership.sql','015_production_lines.sql','016_operator_audit_identity.sql','017_operational_operator_identity.sql','020_whatsapp_intelligence.sql','021_whatsapp_directory_seed.sql','022_sea_urchin_process_control.sql','023_product_labels.sql','024_label_release_gate.sql','025_partners_profitability_inventory.sql','026_historical_intelligence.sql','027_historical_record_eligibility.sql','028_uni_vision_station.sql','029_uni_vision_source_image_hash.sql','030_production_support_evidence.sql','031_production_support_resolutions.sql','032_production_support_blocks.sql','033_plant_execution_foundation.sql','034_label_engine.sql','035_pallets.sql','036_cold_chain.sql','037_regulatory_holds.sql','038_regulatory_pallet_membership_freeze.sql','039_cold_asset_active_run_exclusion.sql','040_cold_sensor_station_scope.sql','041_schema_migration_baseline.sql','042_japan_export_release_gate.sql','043_japan_dispatch_fail_closed.sql','044_sea_urchin_sequence_fail_closed.sql','045_japan_cold_chain_fail_closed.sql','046_lot_operational_lifecycle.sql','047_reconcile_post_baseline_migration_registry.sql','048_reception_vision_provenance.sql','049_reception_vision_file_provenance.sql','050_uni_vision_quality_feedback.sql','051_sea_urchin_external_references.sql','052_sea_urchin_external_reference_reviews.sql','053_gs1_identity_registry.sql','054_design_assets.sql','055_ml_human_feedback.sql','056_pilot_events.sql','057_pilot_heartbeat.sql'
+  '001_core.sql','002_settlement_workflow.sql','003_operator_auth.sql','004_reception_plant_evidence.sql','005_auth_abuse_audit.sql','006_historical_production.sql','007_live_lot_memory.sql','008_dispatches_sales.sql','009_sales_orders_inventory_daily_close.sql','010_transformation_costs.sql','011_reception_evidence_files.sql','012_plant_identity_links.sql','013_fix_create_lot_sale.sql','014_reception_evidence_ownership.sql','015_production_lines.sql','016_operator_audit_identity.sql','017_operational_operator_identity.sql','020_whatsapp_intelligence.sql','021_whatsapp_directory_seed.sql','022_sea_urchin_process_control.sql','023_product_labels.sql','024_label_release_gate.sql','025_partners_profitability_inventory.sql','026_historical_intelligence.sql','027_historical_record_eligibility.sql','028_uni_vision_station.sql','029_uni_vision_source_image_hash.sql','030_production_support_evidence.sql','031_production_support_resolutions.sql','032_production_support_blocks.sql','033_plant_execution_foundation.sql','034_label_engine.sql','035_pallets.sql','036_cold_chain.sql','037_regulatory_holds.sql','038_regulatory_pallet_membership_freeze.sql','039_cold_asset_active_run_exclusion.sql','040_cold_sensor_station_scope.sql','041_schema_migration_baseline.sql','042_japan_export_release_gate.sql','043_japan_dispatch_fail_closed.sql','044_sea_urchin_sequence_fail_closed.sql','045_japan_cold_chain_fail_closed.sql','046_lot_operational_lifecycle.sql','047_reconcile_post_baseline_migration_registry.sql','048_reception_vision_provenance.sql','049_reception_vision_file_provenance.sql','050_uni_vision_quality_feedback.sql','051_sea_urchin_external_references.sql','052_sea_urchin_external_reference_reviews.sql','053_gs1_identity_registry.sql','054_design_assets.sql','055_ml_human_feedback.sql','056_pilot_events.sql','057_pilot_heartbeat.sql','058_operator_password_rotation.sql'
 ] as const
 
 export const migrationLandmarks=['parties','receptions','operators','historical_production_records','canonical_production_support_blocks','plant_stations','packing_units','label_templates','pallets','cold_runs','regulatory_holds','japan_export_release_evidence','lot_lifecycle_events','sea_urchin_external_references','gs1_identity_links'] as const
@@ -35,8 +35,8 @@ export default async function handler(request:Request,response:Response){
         return response.status(429).json({ok:false,error:"Demasiados intentos. Intenta nuevamente más tarde."});
       }
 
-      const rows=await getSql()`select id,full_name,email,role,password_hash,plant_ids from operators where lower(email)=${email} and active=true limit 1`;
-      const row=Array.isArray(rows)?rows[0] as {id:string;full_name:string;email:string;role:string;password_hash:string|null;plant_ids:string[]}|undefined:undefined;
+      const rows=await getSql()`select id,full_name,email,role,password_hash,plant_ids,must_change_password from operators where lower(email)=${email} and active=true limit 1`;
+      const row=Array.isArray(rows)?rows[0] as {id:string;full_name:string;email:string;role:string;password_hash:string|null;plant_ids:string[];must_change_password:boolean}|undefined:undefined;
       const passwordOk=verifyPassword(password,row?.password_hash??DUMMY_PASSWORD_HASH);
       if(!row||!passwordOk){
         await recordLoginFailure(request,email);
@@ -51,7 +51,7 @@ export default async function handler(request:Request,response:Response){
         recordAuthEvent("login_success",request,email,row.id,{role:row.role,organizationId:organization.organizationId}),
       ]);
       response.setHeader("Set-Cookie",sessionCookie(session.token,session.maxAge));
-      return response.status(200).json({ok:true,operator:{id:row.id,fullName:row.full_name,email:row.email,role:row.role,plantIds:row.plant_ids??[],organizationId:organization.organizationId,executiveExperience:executiveExperienceFor(row)}});
+      return response.status(200).json({ok:true,operator:{id:row.id,fullName:row.full_name,email:row.email,role:row.role,plantIds:row.plant_ids??[],organizationId:organization.organizationId,executiveExperience:executiveExperienceFor(row),mustChangePassword:row.must_change_password===true}});
     }
     if(request.method==="DELETE"){
       const operator=await requireOperator(request);
@@ -67,7 +67,7 @@ export default async function handler(request:Request,response:Response){
   }catch(error){
     const message=error instanceof Error?error.message:"";
     const configuration=message.includes("DATABASE_URL");
-    const migration=message.includes("operator_sessions")||message.includes("password_hash")||message.includes("auth_login_limits")||message.includes("auth_events");
+    const migration=message.includes("operator_sessions")||message.includes("password_hash")||message.includes("auth_login_limits")||message.includes("auth_events")||message.includes("must_change_password");
     return response.status(configuration||migration?503:500).json({ok:false,error:configuration?"Base de datos no conectada":migration?"Faltan migraciones de autenticación":"No fue posible autenticar"});
   }
 }
@@ -1,6 +1,8 @@
 import { hashPassword, requireOperator } from "./_auth.js";
+import { recordAuthEvent } from "./_auth-security.js";
 import { normalizePlantIds } from "./_plants.js";
 import { getSql } from "./_db.js";
+import { allowClientIp } from "./_rate-limit.js";
 
 type Request={method?:string;body?:unknown;headers?:Record<string,string|string[]|undefined>};
 type Response={status:(code:number)=>Response;setHeader:(name:string,value:string)=>void;json:(body:unknown)=>void};
@@ -18,12 +20,13 @@ export default async function handler(request:Request,response:Response){
 
     if(request.method==="GET"){
       const rows=isAdmin
-        ? await getSql()`select id,full_name,email,role,active,plant_ids,created_at,(password_hash is not null) as credentials_ready from operators order by active desc,full_name asc`
-        : await getSql()`select id,full_name,email,role,active,plant_ids,created_at,(password_hash is not null) as credentials_ready from operators where role in ('operations','quality','viewer') and plant_ids && ${actor.plantIds}::text[] order by active desc,full_name asc`;
+        ? await getSql()`select id,full_name,email,role,active,plant_ids,must_change_password,created_at,(password_hash is not null) as credentials_ready from operators order by active desc,full_name asc`
+        : await getSql()`select id,full_name,email,role,active,plant_ids,must_change_password,created_at,(password_hash is not null) as credentials_ready from operators where role in ('operations','quality','viewer') and plant_ids && ${actor.plantIds}::text[] order by active desc,full_name asc`;
       return response.status(200).json({ok:true,operators:rows});
     }
 
     if(request.method==="POST"){
+      if(!allowClientIp(request,60_000,10))return response.status(429).json({ok:false,error:"Demasiados altas o restablecimientos por minuto"});
       const input=(request.body??{}) as OperatorInput;
       const name=String(input.name??"").trim();
       const email=String(input.email??"").trim().toLowerCase();
@@ -41,16 +44,20 @@ export default async function handler(request:Request,response:Response){
       }
       if(name.length<2||name.length>120||!emailPattern.test(email)||email.length>254||!roles.has(role)||password.length<12||password.length>256)return response.status(400).json({ok:false,error:"Nombre, correo, rol y contraseña de 12 a 256 caracteres son obligatorios"});
       const passwordHash=hashPassword(password);
-      const rows=await getSql()`insert into operators (full_name,email,role,password_hash,plant_ids) values (${name},${email},${role},${passwordHash},${plantIds}) on conflict (lower(email)) do update set full_name=excluded.full_name,role=excluded.role,password_hash=excluded.password_hash,plant_ids=excluded.plant_ids,active=true,updated_at=now() returning id,full_name,email,role,active,plant_ids,created_at,true as credentials_ready`;
-      return response.status(201).json({ok:true,operator:Array.isArray(rows)?rows[0]:null});
+      // Contraseñas definidas por gestión son siempre temporales: el servidor
+      // exige el cambio al primer login (operators.must_change_password).
+      const rows=await getSql()`insert into operators (full_name,email,role,password_hash,plant_ids,must_change_password) values (${name},${email},${role},${passwordHash},${plantIds},true) on conflict (lower(email)) do update set full_name=excluded.full_name,role=excluded.role,password_hash=excluded.password_hash,plant_ids=excluded.plant_ids,must_change_password=excluded.must_change_password,active=true,updated_at=now() returning id,full_name,email,role,active,plant_ids,created_at,(password_hash is not null) as credentials_ready,(xmax=0) as inserted`;
+      const saved=Array.isArray(rows)?rows[0] as {id?:string;inserted?:boolean}|undefined:undefined;
+      await recordAuthEvent(saved?.inserted===true?"operator_created":"password_reset",request,email,saved?.id??null,{role,actorId:actor.id,actorRole:actor.role});
+      return response.status(201).json({ok:true,operator:saved??null});
     }
 
     response.setHeader("Allow","GET, POST");
     return response.status(405).json({ok:false,error:"Método no permitido"});
   }catch(error){
     const message=error instanceof Error?error.message:"";
     const configuration=message.includes("DATABASE_URL");
-    const migration=message.includes("password_hash")||message.includes("operator_sessions");
+    const migration=message.includes("password_hash")||message.includes("operator_sessions")||message.includes("must_change_password");
     return response.status(configuration||migration?503:500).json({ok:false,error:configuration?"Base de datos no conectada":migration?"Falta aplicar la migración 003_operator_auth.sql":"No fue posible administrar operadores"});
   }
 }
@@ -0,0 +1,44 @@
+import { hashPassword, requireOperator, verifyPassword } from "./_auth.js";
+import { recordAuthEvent } from "./_auth-security.js";
+import { getSql } from "./_db.js";
+import { allowClientIp } from "./_rate-limit.js";
+
+type Request={method?:string;body?:unknown;headers?:Record<string,string|string[]>};
+type Response={status:(code:number)=>Response;setHeader:(name:string,value:string)=>void;json:(body:unknown)=>void};
+type PasswordInput={currentPassword?:unknown;newPassword?:unknown};
+
+// Self-service password change with a live session. This is the only way to
+// clear operators.must_change_password, so accounts created or reset by
+// management with a temporary password cannot reach the application until the
+// operator chooses their own credential. Current password is verified against
+// the stored scrypt hash and the rotation is audit-logged.
+
+export default async function handler(request:Request,response:Response){
+  response.setHeader("Cache-Control","no-store");
+  try{
+    if(request.method!=="POST"){
+      response.setHeader("Allow","POST");
+      return response.status(405).json({ok:false,error:"Método no permitido"});
+    }
+    if(!allowClientIp(request,60_000,10))return response.status(429).json({ok:false,error:"Demasiados cambios de contraseña por minuto"});
+    const operator=await requireOperator(request);
+    if(!operator)return response.status(401).json({ok:false,error:"Sesión requerida"});
+    const input=(request.body??{}) as PasswordInput;
+    const currentPassword=String(input.currentPassword??"");
+    const newPassword=String(input.newPassword??"");
+    if(currentPassword.length<8||currentPassword.length>256||newPassword.length<12||newPassword.length>256)
+      return response.status(400).json({ok:false,error:"La contraseña actual y una nueva de 12 a 256 caracteres son obligatorias"});
+    if(currentPassword===newPassword)return response.status(400).json({ok:false,error:"La nueva contraseña debe ser distinta de la temporal"});
+    const rows=await getSql()`select password_hash from operators where id=${operator.id}::uuid limit 1`;
+    const stored=Array.isArray(rows)?(rows[0] as {password_hash?:string|null}|undefined)?.password_hash??null:null;
+    if(!verifyPassword(currentPassword,stored))return response.status(403).json({ok:false,error:"La contraseña actual no es válida"});
+    await getSql()`update operators set password_hash=${hashPassword(newPassword)},must_change_password=false,updated_at=now() where id=${operator.id}::uuid`;
+    await recordAuthEvent("password_changed",request,operator.email,operator.id,{role:operator.role});
+    return response.status(200).json({ok:true});
+  }catch(error){
+    const message=error instanceof Error?error.message:"";
+    const configuration=message.includes("DATABASE_URL");
+    const migration=message.includes("password_hash")||message.includes("must_change_password");
+    return response.status(configuration||migration?503:500).json({ok:false,error:configuration?"Base de datos no conectada":migration?"Faltan migraciones de credenciales":"No fue posible cambiar la contraseña"});
+  }
+}