collavre 0.24.0 → 0.25.0

data/db/migrate/20260810000000_split_agent_workspace_identity_axes.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+# The CLI proxy now carries two identity axes: X-CLI-Proxy-User-ID selects the
+# OS worker holding the engine credentials, and X-CLI-Proxy-Workspace-ID selects
+# a path workspace below that worker's HOME. Split the single proxy_user_id into
+# those axes so engine login is per Collavre user while skills and workspace
+# config stay per agent.
+#
+# Expand only. bin/docker-entrypoint runs db:migrate while the previous release
+# is still serving requests against the same database, so proxy_user_id has to
+# stay readable and writable until every process runs the new code. The new
+# columns are therefore nullable here and the old one merely loses its NOT NULL,
+# which also keeps a Kamal rollback working. The contract half — dropping
+# proxy_user_id and adding NOT NULL to the two new columns — belongs to a later
+# release, once no process writes the legacy column anymore.
+class SplitAgentWorkspaceIdentityAxes < ActiveRecord::Migration[8.0]
+  class MigrationWorkspace < ActiveRecord::Base
+    self.table_name = "agent_workspaces"
+  end
+
+  def up
+    add_column :agent_workspaces, :proxy_credential_id, :string
+    add_column :agent_workspaces, :proxy_workspace_id, :string
+
+    MigrationWorkspace.reset_column_information
+    MigrationWorkspace.find_each do |workspace|
+      workspace.update_columns(
+        proxy_workspace_id: "agent-#{workspace.agent_id}",
+        proxy_credential_id: credential_id_for(workspace)
+      )
+    end
+
+    change_column_null :agent_workspaces, :proxy_user_id, true
+  end
+
+  def down
+    MigrationWorkspace.reset_column_information
+    MigrationWorkspace.where(proxy_user_id: nil).find_each do |workspace|
+      workspace.update_columns(proxy_user_id: legacy_proxy_user_id_for(workspace))
+    end
+
+    change_column_null :agent_workspaces, :proxy_user_id, false
+    remove_column :agent_workspaces, :proxy_workspace_id
+    remove_column :agent_workspaces, :proxy_credential_id
+  end
+
+  private
+
+  def credential_id_for(workspace)
+    workspace.user_id ? "user-#{workspace.user_id}" : "agent-#{workspace.agent_id}"
+  end
+
+  def legacy_proxy_user_id_for(workspace)
+    return "agent-#{workspace.agent_id}" unless workspace.user_id
+
+    "agent-#{workspace.agent_id}--user-#{workspace.user_id}"
+  end
+end

data/db/migrate/20260810000001_seed_codex_custom_proxy_llm_models.rb

@@ -0,0 +1,28 @@
+class SeedCodexCustomProxyLlmModels < ActiveRecord::Migration[8.1]
+  MAX_SUGGESTIONS = 100
+  DEFAULT_MODELS = [
+    "paperclip/codex_custom/anthropic/claude-sonnet-4.5",
+    "paperclip/codex_custom/openai/gpt-5"
+  ].freeze
+
+  def up
+    DEFAULT_MODELS.each do |name|
+      model = llm_model_class.find_or_create_by!(llm_vendor: "cli_proxy", name:)
+      model.touch unless model.previously_new_record?
+    end
+
+    keep_ids = llm_model_class.order(updated_at: :desc, id: :desc).limit(MAX_SUGGESTIONS).select(:id)
+    llm_model_class.where.not(id: keep_ids).delete_all
+  end
+
+  # Keep shared, user-created model suggestions intact if this data migration is rolled back.
+  def down; end
+
+  private
+
+  def llm_model_class
+    @llm_model_class ||= Class.new(ActiveRecord::Base) do
+      self.table_name = "llm_models"
+    end
+  end
+end

data/db/migrate/20260810010000_add_last_visited_creative_to_users.rb

@@ -0,0 +1,8 @@
+class AddLastVisitedCreativeToUsers < ActiveRecord::Migration[8.0]
+  def change
+    add_reference :users, :last_visited_creative, foreign_key: {
+      to_table: :creatives,
+      on_delete: :nullify
+    }
+  end
+end

data/db/migrate/20260810020000_add_last_visited_creative_at_to_users.rb

@@ -0,0 +1,5 @@
+class AddLastVisitedCreativeAtToUsers < ActiveRecord::Migration[8.0]
+  def change
+    add_column :users, :last_visited_creative_at, :datetime
+  end
+end

data/db/migrate/20260810030000_add_last_visited_creative_navigation_order_to_users.rb

@@ -0,0 +1,6 @@
+class AddLastVisitedCreativeNavigationOrderToUsers < ActiveRecord::Migration[8.0]
+  def change
+    add_column :users, :last_visited_creative_client_id, :string
+    add_column :users, :last_visited_creative_visit_sequence, :bigint
+  end
+end

data/db/migrate/20260810060000_add_last_visited_creative_issued_sequence_to_users.rb

@@ -0,0 +1,5 @@
+class AddLastVisitedCreativeIssuedSequenceToUsers < ActiveRecord::Migration[8.0]
+  def change
+    add_column :users, :last_visited_creative_issued_sequence, :bigint
+  end
+end

data/db/migrate/20260810100000_add_desktop_managed_to_agent_gateways.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+class AddDesktopManagedToAgentGateways < ActiveRecord::Migration[8.1]
+  def up
+    add_column :agent_gateways, :desktop_managed, :boolean, default: false, null: false unless column_exists?(:agent_gateways, :desktop_managed)
+    backfill_legacy_desktop_gateway
+    add_index :agent_gateways, :desktop_managed, unique: true, where: "desktop_managed", name: "index_agent_gateways_on_desktop_managed" unless index_exists?(:agent_gateways, name: "index_agent_gateways_on_desktop_managed")
+  end
+
+  def down
+    remove_index :agent_gateways, name: "index_agent_gateways_on_desktop_managed" if index_exists?(:agent_gateways, name: "index_agent_gateways_on_desktop_managed")
+    remove_column :agent_gateways, :desktop_managed if column_exists?(:agent_gateways, :desktop_managed)
+  end
+
+  private
+
+  def backfill_legacy_desktop_gateway
+    # Legacy records have no dedicated marker. A generated CLI preset linked
+    # to the gateway is the durable signature; tenant ID and display fields
+    # alone remain user-editable and must not cause a gateway to be adopted.
+    legacy_gateway_ids = select_values(<<~SQL.squish)
+      SELECT id FROM agent_gateways
+      WHERE desktop_managed = FALSE
+      AND base_url LIKE 'http://127.0.0.1:%'
+      AND EXISTS (
+        SELECT 1 FROM users
+        WHERE users.agent_gateway_id = agent_gateways.id
+        AND users.created_by_id = agent_gateways.owner_id
+        AND users.email IN (
+          'collavre-desktop-claude-code@ai.local',
+          'collavre-desktop-codex@ai.local'
+        )
+        AND users.llm_vendor = 'cli_proxy'
+      )
+    SQL
+    return unless legacy_gateway_ids.one?
+
+    execute "UPDATE agent_gateways SET desktop_managed = TRUE WHERE id = #{connection.quote(legacy_gateway_ids.first)}"
+  end
+end

data/db/migrate/20260810100001_add_desktop_preset_adapter_to_users.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+class AddDesktopPresetAdapterToUsers < ActiveRecord::Migration[8.1]
+  PRESET_EMAILS = {
+    "claude" => "collavre-desktop-claude-code@ai.local",
+    "codex" => "collavre-desktop-codex@ai.local"
+  }.freeze
+
+  def up
+    add_column :users, :desktop_preset_adapter, :string unless column_exists?(:users, :desktop_preset_adapter)
+    backfill_legacy_desktop_presets
+    add_index :users, :desktop_preset_adapter, unique: true,
+                                               where: "desktop_preset_adapter IS NOT NULL",
+                                               name: "index_users_on_desktop_preset_adapter" unless index_exists?(:users, name: "index_users_on_desktop_preset_adapter")
+  end
+
+  def down
+    remove_index :users, name: "index_users_on_desktop_preset_adapter" if index_exists?(:users, name: "index_users_on_desktop_preset_adapter")
+    remove_column :users, :desktop_preset_adapter if column_exists?(:users, :desktop_preset_adapter)
+  end
+
+  private
+
+  def backfill_legacy_desktop_presets
+    PRESET_EMAILS.each do |adapter, email|
+      execute <<~SQL.squish
+        UPDATE users
+        SET desktop_preset_adapter = #{connection.quote(adapter)}
+        WHERE desktop_preset_adapter IS NULL
+        AND email = #{connection.quote(email)}
+        AND llm_vendor = 'cli_proxy'
+        AND agent_gateway_id IN (
+          SELECT id FROM agent_gateways WHERE desktop_managed = TRUE
+        )
+      SQL
+    end
+  end
+end

data/db/migrate/20260811000000_make_agent_gateway_completion_key_nullable.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class MakeAgentGatewayCompletionKeyNullable < ActiveRecord::Migration[8.0]
+  def change
+    change_column_null :agent_gateways, :completion_key, true
+  end
+end

data/db/migrate/20260812000000_remove_workflow_columns_from_tasks.rb

@@ -0,0 +1,101 @@
+class RemoveWorkflowColumnsFromTasks < ActiveRecord::Migration[8.1]
+  # The /work command and its WorkflowExecutor are gone, and they were the only
+  # producers of parent_task_id / workflow_context / workflow_state / retry_count.
+  # Nothing reads these columns anymore, so drop them.
+
+  IN_FLIGHT_STATUSES = %w[pending queued running delegated pending_approval].freeze
+
+  # AiAgentJob reserves the agent's ResourceTracker slot under task.id once the
+  # job starts, so only these statuses can still hold one; pending and queued
+  # never reached reserve!. release! on an unreserved id is a no-op anyway.
+  RESERVED_STATUSES = %w[running delegated pending_approval].freeze
+
+  def up
+    cancel_in_flight_workflow_tasks
+
+    remove_foreign_key :tasks, :tasks, column: :parent_task_id, if_exists: true
+    remove_column :tasks, :parent_task_id, :integer
+    remove_column :tasks, :workflow_context, :text
+    remove_column :tasks, :workflow_state, :json
+    remove_column :tasks, :retry_count, :integer, default: 0, null: false
+  end
+
+  def down
+    add_column :tasks, :parent_task_id, :integer
+    add_column :tasks, :workflow_context, :text
+    add_column :tasks, :workflow_state, :json
+    add_column :tasks, :retry_count, :integer, default: 0, null: false
+    add_index :tasks, :parent_task_id
+    add_foreign_key :tasks, :tasks, column: :parent_task_id, on_delete: :nullify
+  end
+
+  private
+
+  # Any workflow still mid-flight loses the state that would let it advance.
+  # Cancel those rows before the columns disappear so they cannot linger as
+  # permanently "running" tasks holding a topic slot.
+  def cancel_in_flight_workflow_tasks
+    rows = select_all(<<~SQL.squish).to_a
+      SELECT id, agent_id, topic_id, creative_id, status
+      FROM tasks
+      WHERE status IN (#{quoted_in_flight_statuses})
+        AND (parent_task_id IS NOT NULL
+             OR trigger_event_name IN ('work_command', 'workflow_subtask'))
+    SQL
+    return if rows.empty?
+
+    ids = rows.map { |row| row["id"].to_i }.join(", ")
+    execute(<<~SQL.squish)
+      UPDATE tasks
+      SET status = 'cancelled', updated_at = #{connection.quote(Time.current)}
+      WHERE id IN (#{ids})
+    SQL
+
+    release_slots(rows)
+  end
+
+  # A raw UPDATE only settles the row. Every other bulk cancellation in the app
+  # (TasksController#cancel, CancelOfflineDelegatedTasksJob, stuck recovery)
+  # also hands back the agent's ResourceTracker slot and drains the topic queue,
+  # because these tasks were paused with no live worker to run AiAgentJob's
+  # ensure-block. Skipping that here would keep a cancelled task counting
+  # against the agent's max_concurrent_jobs until the cache entry expires an
+  # hour later — long enough, with a limit of 1, to freeze the agent right after
+  # deploy. Reaching into app classes from a migration is unusual, but the
+  # reservation lives in Rails.cache and there is no SQL equivalent.
+  def release_slots(rows)
+    return unless defined?(Collavre::Orchestration::ResourceTracker)
+
+    rows.group_by { |row| row["agent_id"] }.each do |agent_id, agent_rows|
+      next if agent_id.blank?
+
+      agent = Collavre::User.find_by(id: agent_id)
+      next unless agent
+
+      tracker = Collavre::Orchestration::ResourceTracker.for(agent)
+      agent_rows.each do |row|
+        tracker.release!(row["id"]) if RESERVED_STATUSES.include?(row["status"])
+      end
+    end
+
+    drain_topics(rows)
+  rescue StandardError => e
+    # Cache/orchestration cleanup is best effort: stuck recovery still sweeps
+    # whatever is left. Never fail the schema change over it.
+    say("Slot release after workflow cancellation failed: #{e.class}: #{e.message}")
+  end
+
+  # Freeing the slot is only half of it — a waiter queued behind the cancelled
+  # holder stays queued until stuck recovery notices, which can take minutes.
+  def drain_topics(rows)
+    rows.filter_map { |row| [ row["topic_id"], row["creative_id"] ] if row["topic_id"].present? }
+        .uniq
+        .each do |topic_id, creative_id|
+      Collavre::Orchestration::AgentOrchestrator.dequeue_next_for_topic(topic_id, creative_id)
+    end
+  end
+
+  def quoted_in_flight_statuses
+    IN_FLIGHT_STATUSES.map { |status| connection.quote(status) }.join(", ")
+  end
+end

data/db/migrate/20260812000001_remove_android_devices.rb

@@ -0,0 +1,24 @@
+class RemoveAndroidDevices < ActiveRecord::Migration[8.0]
+  ANDROID_DEVICE_CONSTRAINT = "devices_no_android_device_type".freeze
+
+  def up
+    if connection.supports_validate_constraints?
+      # PostgreSQL can enforce a not-yet-validated constraint. This closes the
+      # rolling-deploy window before removing existing registrations: an old
+      # container may finish a request, but cannot recreate an Android token.
+      add_check_constraint :devices, "device_type != 2", name: ANDROID_DEVICE_CONSTRAINT, validate: false
+      execute "DELETE FROM devices WHERE device_type = 2"
+      validate_check_constraint :devices, name: ANDROID_DEVICE_CONSTRAINT
+    else
+      # SQLite rebuilds the table to add a check constraint, so it cannot add
+      # one while Android rows exist. The migration transaction serializes
+      # writers, making the delete and constraint addition atomic here.
+      execute "DELETE FROM devices WHERE device_type = 2"
+      add_check_constraint :devices, "device_type != 2", name: ANDROID_DEVICE_CONSTRAINT
+    end
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration, "Android device tokens cannot be restored"
+  end
+end

data/db/migrate/20260812010000_drop_inbox_items.rb

@@ -0,0 +1,22 @@
+class DropInboxItems < ActiveRecord::Migration[8.0]
+  def up
+    drop_table :inbox_items
+  end
+
+  def down
+    create_table :inbox_items do |t|
+      t.references :comment, foreign_key: { on_delete: :nullify }
+      t.references :creative, foreign_key: { on_delete: :nullify }
+      t.text :message
+      t.string :message_key
+      t.jsonb :message_params, default: {}, null: false
+      t.references :owner, null: false, foreign_key: { to_table: :users }
+      t.string :link
+      t.string :state, default: "new", null: false
+
+      t.timestamps
+    end
+
+    add_index :inbox_items, :state
+  end
+end

data/db/migrate/20260813000000_clear_claude_channel_presence_routing_expressions.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class ClearClaudeChannelPresenceRoutingExpressions < ActiveRecord::Migration[8.0]
+  def up
+    execute <<~SQL.squish
+      UPDATE users
+      SET routing_expression = NULL
+      WHERE llm_model = 'claude-code'
+        AND routing_expression = 'true'
+    SQL
+  end
+
+  def down
+    # Presence rows, not routing_expression, now own Claude Channel liveness.
+  end
+end

data/db/migrate/20260813000001_add_last_topic_revision_to_user_creative_preferences.rb

@@ -0,0 +1,5 @@
+class AddLastTopicRevisionToUserCreativePreferences < ActiveRecord::Migration[8.0]
+  def change
+    add_column :user_creative_preferences, :last_topic_revision, :integer, null: false, default: 0
+  end
+end

data/db/migrate/20260813000002_add_last_topic_save_order_to_user_creative_preferences.rb

@@ -0,0 +1,6 @@
+class AddLastTopicSaveOrderToUserCreativePreferences < ActiveRecord::Migration[8.0]
+  def change
+    add_column :user_creative_preferences, :last_topic_save_session_id, :string
+    add_column :user_creative_preferences, :last_topic_save_sequence, :integer
+  end
+end

data/db/migrate/20260813000003_add_last_topic_save_sequences_to_user_creative_preferences.rb

@@ -0,0 +1,5 @@
+class AddLastTopicSaveSequencesToUserCreativePreferences < ActiveRecord::Migration[8.0]
+  def change
+    add_column :user_creative_preferences, :last_topic_save_sequences, :json, null: false, default: {}
+  end
+end

data/db/migrate/20260813000004_add_last_topic_save_fences_to_user_creative_preferences.rb

@@ -0,0 +1,6 @@
+class AddLastTopicSaveFencesToUserCreativePreferences < ActiveRecord::Migration[8.0]
+  def change
+    add_column :user_creative_preferences, :last_topic_save_fence_issued, :bigint, null: false, default: 0
+    add_column :user_creative_preferences, :last_topic_save_fence_applied, :bigint, null: false, default: 0
+  end
+end

data/db/migrate/20260814000000_add_topic_to_comment_read_pointers.rb

@@ -0,0 +1,79 @@
+class AddTopicToCommentReadPointers < ActiveRecord::Migration[8.0]
+  def up
+    add_reference :comment_read_pointers, :topic,
+                  foreign_key: { to_table: :topics, on_delete: :cascade }, null: true
+    remove_index :comment_read_pointers, column: %i[user_id creative_id]
+
+    execute <<~SQL.squish
+      INSERT INTO comment_read_pointers
+        (user_id, creative_id, topic_id, last_read_comment_id, created_at, updated_at)
+      SELECT pointers.user_id, pointers.creative_id, topics.id,
+             pointers.last_read_comment_id, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+      FROM comment_read_pointers AS pointers
+      INNER JOIN topics ON topics.creative_id = pointers.creative_id
+      WHERE pointers.topic_id IS NULL
+    SQL
+
+    add_index :comment_read_pointers, %i[user_id creative_id topic_id], unique: true,
+              name: "index_comment_read_pointers_on_user_creative_and_topic"
+    add_index :comment_read_pointers, %i[user_id creative_id], unique: true,
+              where: "topic_id IS NULL", name: "index_comment_read_pointers_on_legacy_pointer"
+  end
+
+  def down
+    remove_index :comment_read_pointers, name: "index_comment_read_pointers_on_legacy_pointer"
+    remove_index :comment_read_pointers, name: "index_comment_read_pointers_on_user_creative_and_topic"
+    consolidate_topic_watermarks
+    execute "DELETE FROM comment_read_pointers WHERE topic_id IS NOT NULL"
+    remove_reference :comment_read_pointers, :topic, foreign_key: true
+    add_index :comment_read_pointers, %i[user_id creative_id], unique: true
+  end
+
+  private
+
+  def consolidate_topic_watermarks
+    create_missing_legacy_pointers
+
+    execute <<~SQL.squish
+      UPDATE comment_read_pointers AS legacy_pointers
+      SET last_read_comment_id = COALESCE((
+        SELECT MIN(COALESCE(topic_pointers.last_read_comment_id, 0))
+        FROM topics
+        LEFT JOIN comment_read_pointers AS topic_pointers
+          ON topic_pointers.user_id = legacy_pointers.user_id
+          AND topic_pointers.creative_id = legacy_pointers.creative_id
+          AND topic_pointers.topic_id = topics.id
+        WHERE topics.creative_id = legacy_pointers.creative_id
+      ), 0)
+      WHERE legacy_pointers.topic_id IS NULL
+        AND COALESCE(legacy_pointers.last_read_comment_id, 0) > COALESCE((
+          SELECT MIN(COALESCE(topic_pointers.last_read_comment_id, 0))
+          FROM topics
+          LEFT JOIN comment_read_pointers AS topic_pointers
+            ON topic_pointers.user_id = legacy_pointers.user_id
+            AND topic_pointers.creative_id = legacy_pointers.creative_id
+            AND topic_pointers.topic_id = topics.id
+          WHERE topics.creative_id = legacy_pointers.creative_id
+        ), 0)
+    SQL
+  end
+
+  def create_missing_legacy_pointers
+    execute <<~SQL.squish
+      INSERT INTO comment_read_pointers (user_id, creative_id, last_read_comment_id, created_at, updated_at)
+      SELECT pointer_pairs.user_id, pointer_pairs.creative_id,
+             0,
+             CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+      FROM (
+        SELECT DISTINCT user_id, creative_id
+        FROM comment_read_pointers
+        WHERE topic_id IS NOT NULL
+      ) AS pointer_pairs
+      LEFT JOIN comment_read_pointers AS legacy_pointers
+        ON legacy_pointers.user_id = pointer_pairs.user_id
+        AND legacy_pointers.creative_id = pointer_pairs.creative_id
+        AND legacy_pointers.topic_id IS NULL
+      WHERE legacy_pointers.id IS NULL
+    SQL
+  end
+end

data/db/migrate/20260814000001_add_creative_topic_private_id_index_to_comments.rb

@@ -0,0 +1,37 @@
+class AddCreativeTopicPrivateIdIndexToComments < ActiveRecord::Migration[8.1]
+  # Badge fanout counts per-topic suffixes after a reader watermark. The former
+  # creative/private/id index still needs to scan every newer topic in a busy
+  # creative, while this index lets the database seek directly to that topic's
+  # suffix.
+  disable_ddl_transaction!
+
+  def up
+    options = { name: index_name, if_not_exists: true }
+
+    if postgresql?
+      options.merge!(where: "private = false", algorithm: :concurrently)
+      add_index :comments, %i[creative_id topic_id id], **options
+    else
+      add_index :comments, %i[creative_id private topic_id id], **options
+    end
+  end
+
+  def down
+    options = { name: index_name, algorithm: concurrent_algorithm, if_exists: true }
+    remove_index :comments, **options
+  end
+
+  private
+
+  def index_name
+    "index_comments_on_creative_topic_private_and_id"
+  end
+
+  def postgresql?
+    connection.adapter_name.match?(/postgres/i)
+  end
+
+  def concurrent_algorithm
+    :concurrently if postgresql?
+  end
+end

data/db/migrate/20260816000000_add_watermark_index_to_comment_read_pointers.rb

@@ -0,0 +1,27 @@
+class AddWatermarkIndexToCommentReadPointers < ActiveRecord::Migration[8.1]
+  # Both receipt paths — rendering a page and repainting after a read — select a
+  # creative's pointers by watermark range. The existing indexes are keyed by
+  # user first, so those range scans read every pointer row on the creative and
+  # filtered in memory. Pointer rows are now per user *and* per topic, so that
+  # set grows multiplicatively.
+  disable_ddl_transaction!
+
+  def up
+    add_index :comment_read_pointers, %i[creative_id last_read_comment_id],
+      name: index_name, if_not_exists: true, algorithm: concurrent_algorithm
+  end
+
+  def down
+    remove_index :comment_read_pointers, name: index_name, if_exists: true, algorithm: concurrent_algorithm
+  end
+
+  private
+
+  def index_name
+    "index_comment_read_pointers_on_creative_and_watermark"
+  end
+
+  def concurrent_algorithm
+    :concurrently if connection.adapter_name.match?(/postgres/i)
+  end
+end

data/db/migrate/20260816000001_add_private_recipient_topic_index_to_comments.rb

@@ -0,0 +1,48 @@
+class AddPrivateRecipientTopicIndexToComments < ActiveRecord::Migration[8.1]
+  # Badge fanout asks which topics hold private comments for each recipient. The
+  # existing private index is keyed by topic before recipient, so answering that
+  # per user meant scanning every private comment on the creative.
+  disable_ddl_transaction!
+
+  RECIPIENT_COLUMNS = %i[user_id approver_id].freeze
+
+  def up
+    RECIPIENT_COLUMNS.each do |recipient_column|
+      add_index :comments, index_columns(recipient_column), **index_options(recipient_column).merge(if_not_exists: true)
+    end
+  end
+
+  def down
+    RECIPIENT_COLUMNS.each do |recipient_column|
+      remove_index :comments, name: index_name(recipient_column), if_exists: true, algorithm: concurrent_algorithm
+    end
+  end
+
+  private
+
+  # On PostgreSQL the predicate carries `private`, so it stays out of the key.
+  def index_columns(recipient_column)
+    return [ :creative_id, recipient_column, :topic_id ] if postgresql?
+
+    [ :creative_id, :private, recipient_column, :topic_id ]
+  end
+
+  def index_options(recipient_column)
+    options = { name: index_name(recipient_column) }
+    return options unless postgresql?
+
+    options.merge(where: "private = true", algorithm: :concurrently)
+  end
+
+  def index_name(recipient_column)
+    "index_comments_on_creative_private_#{recipient_column}_and_topic"
+  end
+
+  def postgresql?
+    connection.adapter_name.match?(/postgres/i)
+  end
+
+  def concurrent_algorithm
+    :concurrently if postgresql?
+  end
+end

data/db/migrate/20260820000000_add_topic_assigned_at_to_comments.rb

@@ -0,0 +1,13 @@
+class AddTopicAssignedAtToComments < ActiveRecord::Migration[8.1]
+  def up
+    add_column :comments, :topic_assigned_at, :datetime, precision: 6
+    execute "UPDATE comments SET topic_assigned_at = created_at"
+    change_column_null :comments, :topic_assigned_at, false
+    add_index :comments, %i[topic_id topic_assigned_at], name: "index_comments_on_topic_and_assigned_at"
+  end
+
+  def down
+    remove_index :comments, name: "index_comments_on_topic_and_assigned_at"
+    remove_column :comments, :topic_assigned_at
+  end
+end

data/db/seeds.rb

@@ -17,54 +17,4 @@ module Collavre
 end
 
 Collavre::ChannelBotSeed.call
-
-module Collavre
-  # Seeds the "Typo Corrector" agent. Unlike event-routed agents (e.g. the GitHub
-  # PR Analyzer) this agent has no routing_expression — it is never dispatched by
-  # comment events. It exists purely as a user-configurable holder for the LLM
-  # vendor/model/system_prompt that Collavre::TypoCorrector invokes directly.
-  module TypoCorrectorSeed
-    AGENT_EMAIL = "typo-corrector@collavre.local"
-
-    SYSTEM_PROMPT = <<~PROMPT
-      You are a typo correction engine. You receive a short piece of text the user
-      is currently typing and return ONLY spelling/typo fixes as a structured edit list.
-
-      Rules:
-      - Fix only spelling mistakes and obvious typos (transposed/missing/extra letters,
-        wrong jamo, mis-spaced words). Works for any language (ko, en, ja, zh, mixed).
-      - Do NOT rewrite style, grammar, word choice, tone, or punctuation.
-      - Do NOT change meaning. Do NOT translate.
-      - Never touch code spans, URLs, @mentions, emojis, or HTML/markdown markup.
-      - `original` MUST be an exact substring copied verbatim from the input text.
-      - Keep each edit minimal: a single word or short phrase, not a whole sentence.
-
-      Return ONLY valid JSON, no markdown, in exactly this shape:
-      {"edits":[{"original":"<verbatim>","suggestion":"<fixed>","reason":"spelling","confidence":0.0}]}
-
-      `confidence` is a float 0.0-1.0 for how sure you are it is a real typo.
-      If there are no typos, return {"edits":[]}.
-    PROMPT
-
-    def self.call
-      user = User.find_or_initialize_by(email: AGENT_EMAIL)
-      return user unless user.new_record?
-
-      user.assign_attributes(
-        name: "Typo Corrector",
-        password: SecureRandom.hex(32),
-        email_verified_at: Time.current,
-        searchable: false,
-        llm_vendor: ENV.fetch("COLLAVRE_DEFAULT_LLM_VENDOR", "gemini"),
-        llm_model: ENV.fetch("COLLAVRE_DEFAULT_LLM_MODEL", "gemini-3.1-flash-lite"),
-        system_prompt: SYSTEM_PROMPT,
-        tools: []
-      )
-      user.save!
-      Rails.logger.info "[Collavre] Typo Corrector agent ensured: #{AGENT_EMAIL}"
-      user
-    end
-  end
-end
-
-Collavre::TypoCorrectorSeed.call
+Collavre::LlmModel.seed_default_suggestions!