@k2b/cloud 0.23.0 → 0.25.0

package/src/ai/live-events.ts

@@ -1,5 +1,4 @@
 import { z } from "zod";
-import type { AiStreamEvent } from "./protocol";
 
 export const AI_INVALIDATION_DOMAINS = [
   "conversation-list",
@@ -17,8 +16,8 @@ export const AiInvalidationDomainSchema = z.enum(AI_INVALIDATION_DOMAINS);
 export type AiInvalidationDomain = z.infer<typeof AiInvalidationDomainSchema>;
 
 export const AiResourceIdSchema = z.string().regex(/^[0-9A-Za-z]{6}$/);
-export const AiLiveCursorSchema = z.string().regex(/^s6t\.[a-zA-Z0-9_-]+\.\d+$/);
 
+/** The data of one AI live update on the `user` channel of `/api/ai/live`: which views of the user's AI data changed. */
 export const AiInvalidationSchema = z
   .object({
     type: z.literal("ai.invalidated"),
@@ -31,263 +30,3 @@ export const AiInvalidationSchema = z
   .strict();
 
 export type AiInvalidation = z.infer<typeof AiInvalidationSchema>;
-
-export const AI_LIVE_WS_TYPE = {
-  subscribe: "ai.live.subscribe",
-  ready: "ai.live.ready",
-  event: "ai.live.event",
-  scopeChanged: "ai.live.scope_changed",
-  revoked: "ai.live.revoked",
-  error: "ai.live.error",
-  turnSubscribe: "ai.turn.subscribe",
-  turnUnsubscribe: "ai.turn.unsubscribe",
-  turnEvent: "ai.turn.event",
-  turnError: "ai.turn.error",
-} as const;
-
-const AiLiveSubscribeMessageSchema = z
-  .object({
-    type: z.literal(AI_LIVE_WS_TYPE.subscribe),
-    payload: z.object({ fromCursor: AiLiveCursorSchema.nullable(), recover: z.boolean() }).strict(),
-  })
-  .strict();
-
-const AiTurnSubscribeMessageSchema = z
-  .object({
-    type: z.literal(AI_LIVE_WS_TYPE.turnSubscribe),
-    payload: z.object({ conversationId: AiResourceIdSchema }).strict(),
-  })
-  .strict();
-
-const AiTurnUnsubscribeMessageSchema = z
-  .object({
-    type: z.literal(AI_LIVE_WS_TYPE.turnUnsubscribe),
-    payload: z.object({ conversationId: AiResourceIdSchema }).strict(),
-  })
-  .strict();
-
-export const AiLiveClientMessageSchema = z.discriminatedUnion("type", [
-  AiLiveSubscribeMessageSchema,
-  AiTurnSubscribeMessageSchema,
-  AiTurnUnsubscribeMessageSchema,
-]);
-export type AiLiveClientMessage = z.infer<typeof AiLiveClientMessageSchema>;
-
-const AiLiveRevocationCodeSchema = z.enum(["login_required", "access_denied"]);
-const AiLiveErrorCodeSchema = z.enum(["invalid_json", "invalid_message", "backpressure", "internal_error", "stream_failed"]);
-const AiTurnErrorCodeSchema = z.enum(["not_found", "access_denied", "stream_failed"]);
-
-export type AiLiveRevocationCode = z.infer<typeof AiLiveRevocationCodeSchema>;
-export type AiLiveErrorCode = z.infer<typeof AiLiveErrorCodeSchema>;
-export type AiTurnErrorCode = z.infer<typeof AiTurnErrorCodeSchema>;
-
-const AiTurnBlockSchema = z.discriminatedUnion("kind", [
-  z.object({ id: z.string(), kind: z.literal("text"), text: z.string() }).strict(),
-  z.object({ id: z.string(), kind: z.literal("thinking"), text: z.string() }).strict(),
-  z
-    .object({
-      id: z.string(),
-      kind: z.literal("steer_message"),
-      steerId: z.string(),
-      text: z.string(),
-      status: z.enum(["pending", "consumed", "failed"]),
-    })
-    .strict(),
-  z.object({ id: z.string(), kind: z.literal("steer_applied"), steerId: z.string() }).strict(),
-  z
-    .object({
-      id: z.string(),
-      kind: z.literal("tool"),
-      callId: z.string(),
-      name: z.string(),
-      args: z.unknown().optional(),
-      status: z.enum(["running", "awaiting_approval", "awaiting_client", "completed", "failed", "rejected"]),
-      result: z.unknown().optional(),
-      isError: z.boolean().optional(),
-      approval: z.unknown().optional(),
-      frontendMode: z.enum(["client", "client_view", "client_interaction"]).optional(),
-      presentation: z.unknown().optional(),
-    })
-    .strict(),
-  z
-    .object({
-      id: z.string(),
-      kind: z.literal("compaction"),
-      status: z.enum(["running", "completed", "skipped", "failed"]),
-      result: z.unknown().optional(),
-    })
-    .strict(),
-]);
-
-const AiConversationSchema = z
-  .object({
-    id: AiResourceIdSchema,
-    shortId: AiResourceIdSchema,
-    title: z.string(),
-    titleSource: z.enum(["default", "auto", "user"]),
-    description: z.string(),
-    descriptionSource: z.enum(["default", "auto", "user"]),
-    keywords: z.array(z.string()),
-    pinnedAt: z.string().nullable(),
-    archivedAt: z.string().nullable(),
-    done: z.boolean().nullable(),
-    isDone: z.boolean(),
-    lastUsedAt: z.string(),
-    runStatus: z.enum(["idle", "queued", "running", "needs_attention", "waiting_for_browser", "failed"]),
-    runError: z.string().nullable(),
-    unreadCompletion: z.boolean(),
-    projectId: z.string().nullable(),
-    draft: z.object({ content: z.array(z.unknown()), revision: z.number().int(), updatedAt: z.string().nullable() }).strict(),
-    createdByUserId: z.string().nullable(),
-    createdAt: z.string(),
-    updatedAt: z.string(),
-  })
-  .strict();
-
-const AiStoredMessageSchema = z
-  .object({
-    id: AiResourceIdSchema,
-    shortId: AiResourceIdSchema,
-    conversationId: AiResourceIdSchema,
-    seq: z.number().int().nonnegative(),
-    kind: z.enum(["message", "summary"]),
-    message: z.unknown(),
-    loopId: AiResourceIdSchema.nullable(),
-    modelProfileId: z.string().nullable(),
-    providerModel: z.string().nullable(),
-    usage: z.unknown().nullable(),
-    stopReason: z.string().nullable(),
-    loopAggregate: z.unknown().nullable(),
-    loopDoneReason: z.string().nullable(),
-    compactedAt: z.string().nullable(),
-    meta: z.unknown().nullable(),
-    createdAt: z.string(),
-  })
-  .strict();
-
-const AiTurnSnapshotSchema = z
-  .object({
-    turnId: AiResourceIdSchema,
-    attempt: z.number().int().nonnegative(),
-    status: z.enum(["queued", "running", "waiting_for_action", "completed", "failed", "aborted"]),
-    seq: z.number().int().nonnegative(),
-    blocks: z.array(AiTurnBlockSchema),
-    modelProfileId: z.string().nullable(),
-    createdAt: z.string(),
-  })
-  .strict();
-
-const AiWireEventBaseSchema = {
-  v: z.literal(1),
-  conversationId: AiResourceIdSchema,
-  turnId: AiResourceIdSchema,
-  attempt: z.number().int().nonnegative(),
-  seq: z.number().int().nonnegative(),
-} as const;
-
-const AiStreamEventWireSchema = z.union([
-  z
-    .object({
-      type: z.literal("state"),
-      conversation: AiConversationSchema,
-      messages: z.array(AiStoredMessageSchema),
-      hasMoreMessages: z.boolean().optional(),
-      activeTurn: AiTurnSnapshotSchema.nullable(),
-    })
-    .strict(),
-  z
-    .object({
-      ...AiWireEventBaseSchema,
-      type: z.literal("turn_started"),
-      modelProfileId: z.string(),
-      providerModel: z.string(),
-      blocks: z.array(AiTurnBlockSchema).optional(),
-    })
-    .strict(),
-  z.object({ ...AiWireEventBaseSchema, type: z.literal("block_set"), block: AiTurnBlockSchema }).strict(),
-  z
-    .object({
-      ...AiWireEventBaseSchema,
-      type: z.literal("block_delta"),
-      blockId: z.string(),
-      blockKind: z.enum(["text", "thinking"]),
-      delta: z.string(),
-    })
-    .strict(),
-  z
-    .object({
-      ...AiWireEventBaseSchema,
-      type: z.literal("turn_finished"),
-      status: z.enum(["completed", "failed", "aborted"]),
-      error: z.string().nullable(),
-      messages: z.array(AiStoredMessageSchema).optional(),
-    })
-    .strict(),
-]);
-
-export const AiStreamEventSchema = z.custom<AiStreamEvent>((value) => AiStreamEventWireSchema.safeParse(value).success);
-
-export const AiLiveServerMessageSchema = z.discriminatedUnion("type", [
-  z
-    .object({
-      type: z.literal(AI_LIVE_WS_TYPE.ready),
-      payload: z.object({ cursor: AiLiveCursorSchema, recovered: z.boolean() }).strict(),
-    })
-    .strict(),
-  z
-    .object({
-      type: z.literal(AI_LIVE_WS_TYPE.event),
-      payload: z.object({ cursor: AiLiveCursorSchema, event: AiInvalidationSchema }).strict(),
-    })
-    .strict(),
-  z
-    .object({
-      type: z.literal(AI_LIVE_WS_TYPE.scopeChanged),
-      payload: z.object({ at: z.string().datetime() }).strict(),
-    })
-    .strict(),
-  z
-    .object({
-      type: z.literal(AI_LIVE_WS_TYPE.revoked),
-      payload: z.object({ code: AiLiveRevocationCodeSchema, message: z.string().min(1).max(500) }).strict(),
-    })
-    .strict(),
-  z
-    .object({
-      type: z.literal(AI_LIVE_WS_TYPE.error),
-      payload: z.object({ code: AiLiveErrorCodeSchema, message: z.string().min(1).max(500) }).strict(),
-    })
-    .strict(),
-  z
-    .object({
-      type: z.literal(AI_LIVE_WS_TYPE.turnEvent),
-      payload: z.object({ conversationId: AiResourceIdSchema, event: AiStreamEventSchema }).strict(),
-    })
-    .strict(),
-  z
-    .object({
-      type: z.literal(AI_LIVE_WS_TYPE.turnError),
-      payload: z.object({ conversationId: AiResourceIdSchema, code: AiTurnErrorCodeSchema, message: z.string().min(1).max(500) }).strict(),
-    })
-    .strict(),
-]);
-
-export type AiLiveServerMessage = z.infer<typeof AiLiveServerMessageSchema>;
-
-export const aiTurnEventMessage = (conversationId: string, event: AiStreamEvent): AiLiveServerMessage => ({
-  type: AI_LIVE_WS_TYPE.turnEvent,
-  payload: { conversationId, event },
-});
-
-export const parseAiLiveServerMessage = (raw: string): AiLiveServerMessage | null => {
-  try {
-    const parsed = AiLiveServerMessageSchema.safeParse(JSON.parse(raw));
-    if (!parsed.success) return null;
-    if (parsed.data.type !== AI_LIVE_WS_TYPE.turnEvent) return parsed.data;
-    const eventConversationId =
-      parsed.data.payload.event.type === "state" ? parsed.data.payload.event.conversation.id : parsed.data.payload.event.conversationId;
-    return eventConversationId === parsed.data.payload.conversationId ? parsed.data : null;
-  } catch {
-    return null;
-  }
-};

package/src/ai/live.ts

@@ -1,2 +1,31 @@
-export { latestAiInvalidationCursor } from "./live-outbox";
-export { type AiLiveRoutes, type AiLiveRoutesConfig, aiLiveRoutes } from "./live-routes";
+import { z } from "zod";
+import { defineLive, type LiveViewer } from "../events/live";
+import { AiInvalidationSchema } from "./live-events";
+
+/**
+ * Live updates of a user's AI data. Core publishes and serves them at
+ * `/api/ai/live`; the AI's database triggers write them, keyed `u:<user ID>`,
+ * in the transaction of every change. Other applications, such as Assistant,
+ * read `cursor()` before their snapshot.
+ */
+export const aiLive = defineLive({ appId: "core", event: AiInvalidationSchema });
+
+/** The user an AI request acts for: the user, or the user a credential is delegated by. */
+const ownerOf = (viewer: LiveViewer): string | null => (viewer.accessSubject.type === "user" ? viewer.accessSubject.userId : null);
+
+/**
+ * `user` follows the viewer's own AI data: conversations, their files, tasks and
+ * dictations, and the Projects the viewer can read. Its single key admits only
+ * that user; who receives a Project change was decided when it was written.
+ */
+export const aiLiveChannels = {
+  user: {
+    scope: z.object({}).strict(),
+    keys: async (_scope: unknown, viewer: LiveViewer) => {
+      const owner = ownerOf(viewer);
+      return owner ? [`u:${owner}`] : null;
+    },
+    authorize: async (key: string, viewers: readonly LiveViewer[]) =>
+      new Set(viewers.filter((viewer) => `u:${ownerOf(viewer)}` === key).map((viewer) => viewer.id)),
+  },
+};

package/src/ai/memory-learning.ts

@@ -16,6 +16,7 @@ import {
   listAiTurnWorkflowEvidence,
   markAiWorkflowPatternReviewed,
 } from "./memory-workflow-evidence";
+import { AI_MEMORY_LEARNING_DEFAULT_ENABLED, aiUserPrefs } from "./prefs";
 import { aiConversations } from "./store";
 import type { RunAiStructuredInput, RunAiStructuredResult } from "./structured";
 import { resolveAiBackgroundModel, runAiStructured } from "./structured";
@@ -148,11 +149,11 @@ export const listAiMemoryLearningCandidates = async (limit: number, monthlyToken
         ) AS user_rank
       FROM ai.turns turn
       JOIN ai.conversations conversation ON conversation.id = turn.conversation_id
-      JOIN ai.user_prefs prefs ON prefs.user_id = conversation.created_by_user_id
+      LEFT JOIN ai.user_prefs prefs ON prefs.user_id = conversation.created_by_user_id
       LEFT JOIN monthly_usage usage ON usage.user_id = conversation.created_by_user_id
       WHERE conversation.created_by_user_id IS NOT NULL
         AND conversation.archived_at IS NULL
-        AND prefs.memory_learning_enabled = TRUE
+        AND COALESCE(prefs.memory_learning_enabled, ${AI_MEMORY_LEARNING_DEFAULT_ENABLED})
         AND turn.status = 'completed'
         AND COALESCE(turn.run_config->>'kind', 'chat') = 'chat'
         AND turn.memory_learned_at IS NULL
@@ -196,14 +197,7 @@ const markFailed = async (candidate: Candidate): Promise<void> => {
   `;
 };
 
-const learningEnabled = async (userId: string): Promise<boolean> => {
-  const [row] = await sql<{ enabled: boolean }[]>`
-    SELECT COALESCE(memory_learning_enabled, FALSE) AS enabled
-    FROM ai.user_prefs
-    WHERE user_id = ${userId}::uuid
-  `;
-  return Boolean(row?.enabled);
-};
+const learningEnabled = async (userId: string): Promise<boolean> => (await aiUserPrefs.get(userId)).memoryLearningEnabled;
 
 const monthlyAccountedTokens = async (userId: string): Promise<number> => {
   const [row] = await sql<{ tokens: number }[]>`
@@ -447,7 +441,6 @@ export const learnAiMemoriesFromPrivateChats = async (
     let runId: string | null = null;
     let changes: AiMemoryLearningChange[] = [];
     try {
-      if (!(await learningEnabled(candidate.userId))) continue;
       const evidence = await loadTurnEvidence(candidate);
       if (!evidence.userText) {
         await markLearned(candidate);
@@ -465,6 +458,8 @@ export const learnAiMemoriesFromPrivateChats = async (
       });
       const reservedTokens = estimatedTokens(systemPrompt, taskInput);
       if ((await readMonthlyUsage(candidate.userId)) + reservedTokens > monthlyTokenBudget) continue;
+      // Read the choice again right before the turn can reach the model.
+      if (!(await learningEnabled(candidate.userId))) continue;
       runId = await aiMemoryLearningRuns.start({
         userId: candidate.userId,
         conversationId: candidate.conversationId,
@@ -550,7 +545,6 @@ export const learnAiMemoriesFromPrivateChats = async (
     let runId: string | null = null;
     const startedAt = Date.now();
     try {
-      if (!(await learningEnabled(pattern.userId))) continue;
       const context = await workflowPatternInput(pattern);
       if (!context.source) {
         await markAiWorkflowPatternReviewed(pattern);
@@ -564,6 +558,7 @@ export const learnAiMemoriesFromPrivateChats = async (
       });
       const reservedTokens = estimatedTokens(workflowPrompt, context.input);
       if ((await readMonthlyUsage(pattern.userId)) + reservedTokens > monthlyTokenBudget) continue;
+      if (!(await learningEnabled(pattern.userId))) continue;
       runId = await aiMemoryLearningRuns.start({
         userId: pattern.userId,
         conversationId: context.source.candidate.conversationId,

package/src/ai/memory-workflow-evidence.ts

@@ -1,5 +1,6 @@
 import { sql } from "bun";
 import { type CloudResourceRef, CloudResourceRefSchema } from "../contracts/capabilities";
+import { AI_MEMORY_LEARNING_DEFAULT_ENABLED } from "./prefs";
 
 const MAX_RECEIPT_RESOURCES = 20;
 const MAX_CAPABILITY_ID_CHARS = 180;
@@ -22,7 +23,11 @@ export type AiMemoryWorkflowPattern = {
   turnIds: string[];
 };
 
-/** Persist only successful, schema-valid capability/resource receipts. */
+/**
+ * Persist only successful, schema-valid capability/resource receipts, and only
+ * while learning is on for the user: receipts from a time it was off never
+ * count toward a workflow pattern.
+ */
 export const recordAiMemoryWorkflowEvidence = async (input: {
   userId: string;
   conversationId: string;
@@ -61,9 +66,11 @@ export const recordAiMemoryWorkflowEvidence = async (input: {
           ${resource.ref.type}, ${resource.ref.id}, ${resource.title ?? null}
         FROM ai.turns turn
         JOIN ai.conversations conversation ON conversation.id = turn.conversation_id
+        LEFT JOIN ai.user_prefs prefs ON prefs.user_id = conversation.created_by_user_id
         WHERE turn.id = ${input.turnId}::uuid
           AND conversation.id = ${input.conversationId}::uuid
           AND conversation.created_by_user_id = ${input.userId}::uuid
+          AND COALESCE(prefs.memory_learning_enabled, ${AI_MEMORY_LEARNING_DEFAULT_ENABLED})
         ON CONFLICT (turn_id, capability_id, resource_type, resource_id)
         DO UPDATE SET resource_title = COALESCE(EXCLUDED.resource_title, ai.memory_workflow_evidence.resource_title)
       `;
@@ -116,10 +123,11 @@ export const listAiPendingWorkflowPatterns = async (limit = 5): Promise<AiMemory
              FILTER (WHERE evidence.resource_title IS NOT NULL))[1] AS resource_title,
            count(*)::int AS observation_count
     FROM ai.memory_workflow_evidence evidence
-    JOIN ai.user_prefs prefs ON prefs.user_id = evidence.user_id AND prefs.memory_learning_enabled = TRUE
+    LEFT JOIN ai.user_prefs prefs ON prefs.user_id = evidence.user_id
     JOIN ai.conversations conversation
       ON conversation.id = evidence.conversation_id AND conversation.created_by_user_id = evidence.user_id
     WHERE evidence.reviewed_at IS NULL
+      AND COALESCE(prefs.memory_learning_enabled, ${AI_MEMORY_LEARNING_DEFAULT_ENABLED})
     GROUP BY evidence.user_id, evidence.capability_id, evidence.resource_type, evidence.resource_id
     HAVING count(*) >= 3
     ORDER BY min(evidence.observed_at), evidence.user_id, evidence.capability_id, evidence.resource_type, evidence.resource_id

package/src/ai/migrate.ts

@@ -13,6 +13,14 @@ const backfillAiShortIds = async (
 };
 
 export const migrateCloudAi = async (): Promise<void> => {
+  // AI writes its live updates to Core's platform outbox, in the transaction of every
+  // AI write: without events.enqueue(), every one of them would fail.
+  const [outbox] = await sql<{ ready: boolean }[]>`
+    SELECT to_regprocedure('events.enqueue(uuid,text,text,text,jsonb,text)') IS NOT NULL AS ready
+  `;
+  if (!outbox?.ready) {
+    throw new Error("AI live updates write to events.outbox, which does not exist. Run Core's events migration before the AI migration.");
+  }
   await sql`CREATE SCHEMA IF NOT EXISTS ai`.simple();
   console.log("  ✓ ai schema");
 
@@ -943,7 +951,7 @@ export const migrateCloudAi = async (): Promise<void> => {
     CREATE TABLE IF NOT EXISTS ai.user_prefs (
       user_id UUID PRIMARY KEY REFERENCES auth.users(id) ON DELETE CASCADE,
       memory_enabled BOOLEAN NOT NULL DEFAULT TRUE,
-      memory_learning_enabled BOOLEAN NOT NULL DEFAULT FALSE,
+      memory_learning_enabled BOOLEAN,
       updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
     )
   `.simple();
@@ -952,7 +960,16 @@ export const migrateCloudAi = async (): Promise<void> => {
   // memory blob. Deliberately discard it instead of migrating ambiguous lines.
   await sql`ALTER TABLE ai.user_prefs DROP COLUMN IF EXISTS memory`.simple();
   await sql`ALTER TABLE ai.user_prefs DROP COLUMN IF EXISTS instructions`.simple();
-  await sql`ALTER TABLE ai.user_prefs ADD COLUMN IF NOT EXISTS memory_learning_enabled BOOLEAN NOT NULL DEFAULT FALSE`.simple();
+  await sql`ALTER TABLE ai.user_prefs ADD COLUMN IF NOT EXISTS memory_learning_enabled BOOLEAN`.simple();
+  // NULL means the user never chose, so the default (on) applies. Earlier
+  // releases stored FALSE for every new row, and an explicit "off" looks the
+  // same, so existing FALSE rows stay as they are rather than being switched on.
+  // memory_learning_chosen_at, added below, tells later explicit choices apart.
+  await sql`
+    ALTER TABLE ai.user_prefs
+      ALTER COLUMN memory_learning_enabled DROP NOT NULL,
+      ALTER COLUMN memory_learning_enabled DROP DEFAULT
+  `.simple();
 
   // Last model the user actually ran a turn with — preselected for new chats.
   await sql`ALTER TABLE ai.user_prefs ADD COLUMN IF NOT EXISTS last_model_id TEXT NOT NULL DEFAULT ''`.simple();
@@ -1117,6 +1134,40 @@ export const migrateCloudAi = async (): Promise<void> => {
     WHERE reviewed_at IS NULL
   `.simple();
 
+  // Learning considers only turns that finish while it is on: completeTurn marks
+  // the others, and receipts are recorded only while it is on. When learning
+  // became the default, every earlier turn and receipt of a person without an
+  // explicit "on" came from a time it was off, so they are marked as considered
+  // exactly once, when the column that records explicit choices is introduced.
+  await sql`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'ai' AND table_name = 'user_prefs' AND column_name = 'memory_learning_chosen_at'
+      ) THEN
+        ALTER TABLE ai.user_prefs ADD COLUMN memory_learning_chosen_at TIMESTAMPTZ;
+        UPDATE ai.turns turn
+        SET memory_learned_at = COALESCE(turn.completed_at, turn.created_at)
+        FROM ai.conversations conversation
+        WHERE conversation.id = turn.conversation_id
+          AND turn.status = 'completed'
+          AND turn.memory_learned_at IS NULL
+          AND NOT EXISTS (
+            SELECT 1 FROM ai.user_prefs prefs
+            WHERE prefs.user_id = conversation.created_by_user_id AND prefs.memory_learning_enabled
+          );
+        UPDATE ai.memory_workflow_evidence evidence
+        SET reviewed_at = now()
+        WHERE evidence.reviewed_at IS NULL
+          AND NOT EXISTS (
+            SELECT 1 FROM ai.user_prefs prefs
+            WHERE prefs.user_id = evidence.user_id AND prefs.memory_learning_enabled
+          );
+      END IF;
+    END $$
+  `.simple();
+
   await sql`
     CREATE TABLE IF NOT EXISTS ai.memory_learning_runs (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -1722,10 +1773,12 @@ export const migrateCloudAi = async (): Promise<void> => {
     WHERE project_id IS NOT NULL AND archived_at IS NULL
   `.simple();
 
-  // Durable Realtime UI invalidations. Triggers live at the persistence seam so
-  // route, worker, tool, enrichment, and scheduler writes cannot bypass them.
-  // The outbox row commits or rolls back with the authoritative domain write;
-  // publishing remains an after-commit runtime responsibility.
+  // Live updates. Triggers live at the persistence seam so route, worker, tool,
+  // enrichment, and scheduler writes cannot bypass them. They write to Core's
+  // platform outbox in the transaction of the domain write (see the start of this migration).
+
+  // The previous outbox. Nothing writes it anymore; an older Core that still runs during
+  // an update finds it empty. The cleanup release drops it with the topic cloud-ai-invalidations.
   await sql`
     CREATE TABLE IF NOT EXISTS ai.live_invalidation_outbox (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -1786,6 +1839,10 @@ export const migrateCloudAi = async (): Promise<void> => {
     DROP FUNCTION IF EXISTS ai.enqueue_live_for_user(UUID, TEXT, UUID, TEXT, TEXT, TEXT[])
   `.simple();
 
+  // Every AI live update goes through this function: one update for one user,
+  // keyed `u:<user>`, on Core's live topic. Its data is an `AiInvalidation`.
+  // No coalesce key: the last payload would win and drop the domains of earlier ones.
+  // Gateway health reports a body without events.enqueue: an older Core restored its own.
   await sql`
     CREATE OR REPLACE FUNCTION ai.enqueue_live_for_user(
       p_change_id UUID,
@@ -1796,11 +1853,23 @@ export const migrateCloudAi = async (): Promise<void> => {
     ) RETURNS void AS $$
     BEGIN
       IF p_user_id IS NULL OR cardinality(p_domains) = 0 THEN RETURN; END IF;
-      INSERT INTO ai.live_invalidation_outbox (
-        change_id, audience_user_id, conversation_short_id, project_short_id, domains
-      ) VALUES (
-        p_change_id, p_user_id, p_conversation_short_id, p_project_short_id,
-        ARRAY(SELECT DISTINCT domain FROM unnest(p_domains) domain ORDER BY domain)
+      PERFORM events.enqueue(
+        gen_random_uuid(),
+        'core',
+        'live',
+        'u:' || p_user_id::text,
+        jsonb_build_object(
+          'v', 1,
+          'k', 'u:' || p_user_id::text,
+          'd', jsonb_build_object(
+            'type', 'ai.invalidated',
+            'changeId', p_change_id,
+            'conversationId', p_conversation_short_id,
+            'projectId', p_project_short_id,
+            'domains', to_jsonb(ARRAY(SELECT DISTINCT domain FROM unnest(p_domains) domain ORDER BY domain)),
+            'at', to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
+          )
+        )
       );
     END
     $$ LANGUAGE plpgsql
@@ -2213,13 +2282,6 @@ export const migrateCloudAi = async (): Promise<void> => {
   )`.simple();
   await sql`CREATE INDEX IF NOT EXISTS ai_dictations_pending ON ai.dictations(conversation_id, created_at, id) WHERE disposition = 'pending'`.simple();
   await sql`CREATE INDEX IF NOT EXISTS ai_dictations_recovery ON ai.dictations(status, next_attempt_at, lease_until) WHERE status IN ('queued', 'running')`.simple();
-  await sql.begin(async (tx) => {
-    await tx`ALTER TABLE ai.live_invalidation_outbox DROP CONSTRAINT IF EXISTS ai_live_invalidation_domains_check`;
-    await tx`ALTER TABLE ai.live_invalidation_outbox ADD CONSTRAINT ai_live_invalidation_domains_check CHECK (
-      domains <@ ARRAY['conversation-list', 'conversation-detail', 'conversation-sources', 'conversation-files', 'conversation-tasks',
-        'conversation-dictations', 'project-list', 'project-detail', 'project-context']::text[] AND cardinality(domains) > 0
-    )`;
-  });
   await sql`DROP TRIGGER IF EXISTS ai_live_dictations_changed ON ai.dictations`.simple();
   await sql`DROP TRIGGER IF EXISTS ai_live_dictations_state_changed ON ai.dictations`.simple();
   await sql`CREATE TRIGGER ai_live_dictations_changed AFTER INSERT OR DELETE ON ai.dictations

package/src/ai/model-access.ts

@@ -114,13 +114,14 @@ export const aiModelAccess = {
         service_account_id: string | null;
         authenticated_only: boolean | null;
         display_name: string | null;
+        avatar_hash: string | null;
         service_account_kind: ServiceAccountKind | null;
       }[]
     >`
       SELECT resource.profile_id, resource.revision, access.id, access.created_at,
         access.user_id, access.group_id, access.service_account_id, access.authenticated_only,
-        COALESCE(users.display_name, groups.name, service_accounts.name) AS display_name,
-        service_accounts.kind AS service_account_kind
+        COALESCE(NULLIF(users.display_name, ''), users.uid, groups.name, service_accounts.name) AS display_name,
+        users.avatar_hash, service_accounts.kind AS service_account_kind
       FROM ai.model_access_resources resource LEFT JOIN ai.model_access model ON model.profile_id = resource.profile_id
       LEFT JOIN auth.access access ON access.id = model.access_id
       LEFT JOIN auth.users users ON users.id = access.user_id
@@ -148,6 +149,7 @@ export const aiModelAccess = {
         permission: "read",
         createdAt: row.created_at.toISOString(),
         ...(row.display_name ? { displayName: row.display_name } : {}),
+        ...(row.user_id ? { avatarHash: row.avatar_hash } : {}),
         ...(row.service_account_kind ? { serviceAccountKind: row.service_account_kind } : {}),
       });
     }

package/src/ai/prefs.ts

@@ -1,9 +1,16 @@
 import { sql } from "bun";
 import type { RequestActor } from "../server";
 
+/**
+ * Learning from private chats applies to everyone who has not chosen.
+ * A stored `NULL` means "never chose"; only an explicit save stores a boolean.
+ */
+export const AI_MEMORY_LEARNING_DEFAULT_ENABLED = true;
+
 export type AiUserPrefs = {
   userId: string;
   memoryEnabled: boolean;
+  /** Effective setting: the user's explicit choice, otherwise the default. */
   memoryLearningEnabled: boolean;
   /** Model profile id of the user's most recent chat turn — preselected for new chats. */
   lastModelId: string;
@@ -13,7 +20,7 @@ export type AiUserPrefs = {
 type PrefsRow = {
   user_id: string;
   memory_enabled: boolean;
-  memory_learning_enabled: boolean;
+  memory_learning_enabled: boolean | null;
   last_model_id: string | null;
   updated_at: string | Date;
 };
@@ -21,7 +28,7 @@ type PrefsRow = {
 const toPrefs = (row: PrefsRow): AiUserPrefs => ({
   userId: row.user_id,
   memoryEnabled: row.memory_enabled,
-  memoryLearningEnabled: row.memory_learning_enabled,
+  memoryLearningEnabled: row.memory_learning_enabled ?? AI_MEMORY_LEARNING_DEFAULT_ENABLED,
   lastModelId: row.last_model_id ?? "",
   updatedAt: new Date(row.updated_at).toISOString(),
 });
@@ -29,7 +36,7 @@ const toPrefs = (row: PrefsRow): AiUserPrefs => ({
 const emptyPrefs = (userId: string): AiUserPrefs => ({
   userId,
   memoryEnabled: true,
-  memoryLearningEnabled: false,
+  memoryLearningEnabled: AI_MEMORY_LEARNING_DEFAULT_ENABLED,
   lastModelId: "",
   updatedAt: new Date(0).toISOString(),
 });
@@ -56,13 +63,20 @@ export const aiUserPrefs = {
   ): Promise<AiUserPrefs> {
     const memoryEnabled = patch.memoryEnabled ?? null;
     const memoryLearningEnabled = patch.memoryLearningEnabled ?? null;
+    // Records when the person last saved the learning switch, so a stored "off"
+    // from an earlier release stays distinguishable from a choice made since.
+    const learningChosen = memoryLearningEnabled !== null;
     const lastModelId = patch.lastModelId?.trim().slice(0, 200) ?? null;
     const rows = (await sql`
-      INSERT INTO ai.user_prefs (user_id, memory_enabled, memory_learning_enabled, last_model_id, updated_at)
-      VALUES (${userId}, ${memoryEnabled ?? true}, ${memoryLearningEnabled ?? false}, ${lastModelId ?? ""}, now())
+      INSERT INTO ai.user_prefs (user_id, memory_enabled, memory_learning_enabled, memory_learning_chosen_at, last_model_id, updated_at)
+      VALUES (
+        ${userId}, ${memoryEnabled ?? true}, ${memoryLearningEnabled},
+        CASE WHEN ${learningChosen}::boolean THEN now() END, ${lastModelId ?? ""}, now()
+      )
       ON CONFLICT (user_id) DO UPDATE SET
         memory_enabled = COALESCE(${memoryEnabled}, ai.user_prefs.memory_enabled),
         memory_learning_enabled = COALESCE(${memoryLearningEnabled}, ai.user_prefs.memory_learning_enabled),
+        memory_learning_chosen_at = CASE WHEN ${learningChosen}::boolean THEN now() ELSE ai.user_prefs.memory_learning_chosen_at END,
         last_model_id = COALESCE(${lastModelId}, ai.user_prefs.last_model_id),
         updated_at = now()
       RETURNING *