@rulemetric/local 0.10.0 → 0.12.0

package/dist/supabase/migrations/00087_cleanup_test_data_fix.sql

@@ -1,7 +1,7 @@
 -- Fix cleanup_stale_test_users: it failed nightly 2026-06-07..09 on
 -- projects_created_by_fkey because projects / project_instructions gained
 -- NO ACTION FKs to auth.users after 00062 was written. Also extend the
--- sweep to delete leaked smoke-test sessions — scripts/smoke-test.sh's
+-- sweep to delete leaked smoke-test sessions — scripts/verify/smoke-test.sh's
 -- hook-execution section creates sessions under the dev user
 -- (external_session_id '00000000-0000-4000-8000-…') that the teardown
 -- only closed, never deleted.

package/dist/supabase/migrations/00184_auto_accept_budget_settings.sql

@@ -0,0 +1,113 @@
+-- 00184 — the auto-accept budget becomes a setting, and the producer stops
+-- starving the source it was built to serve.
+--
+-- Three facts measured on 2026-08-12, all from the same project:
+--
+--   1. The per-window budget was counted by RAW project_path string equality.
+--      `/Code/agents/momento-mori` and `/Code/agents/momento-mori/apps/cli`
+--      are one repo and resolve to ONE projects row, but each drew its own
+--      allowance and each hit exactly 5/5 in the same 7 days — the repo
+--      adopted 10 rules under a policy that intends 5. Any repo whose
+--      sessions start in a subdirectory has as many budgets as it has
+--      subdirectories. Fixed in auto-accept-eligibility.ts by counting
+--      through instruction_suggestions.project_id; nothing to do here.
+--
+--   2. The budget was a compile-time constant, so raising it for one noisy
+--      repo meant a deploy. It is now a setting: NULL columns here mean "use
+--      the shipped default", per-project overrides live in
+--      projects.metadata.autoAcceptLimits and win over these.
+--
+--   3. THIS producer only ever queued a run when the project held a
+--      suggestion scoring >= 0.8. But GET /api/instruction-suggestions/
+--      auto-acceptable deliberately exempts insights-authored rows from the
+--      score gate (they are filed at 0.5 by the nomination endpoint). So in a
+--      project whose only proposals came from insights, the authoritative
+--      gate said "eligible" and this function never queued the job that would
+--      have asked it. Every insights nomination in such a project was
+--      unreachable — not declined, not surfaced, just never considered.
+
+-- ── Settable budget ─────────────────────────────────────────────────────────
+alter table public.profiles
+  add column if not exists auto_accept_min_score real,
+  add column if not exists auto_accept_max_per_run integer,
+  add column if not exists auto_accept_max_per_window integer,
+  add column if not exists auto_accept_window_days integer;
+
+comment on column public.profiles.auto_accept_min_score is
+  'Account override for the auto-accept score gate. NULL = shipped default (0.8). Bounded 0..1 by the API on read AND write — a settable brake still has to be a brake.';
+comment on column public.profiles.auto_accept_max_per_run is
+  'Account override for auto-accepts per nightly run per project. NULL = shipped default (3). Bounded 0..25.';
+comment on column public.profiles.auto_accept_max_per_window is
+  'Account override for auto-accepts per project per window. NULL = shipped default (15). Bounded 0..100. The brake on CLAUDE.md bloat: an over-large CLAUDE.md measured -22.1% (stratified, significant).';
+comment on column public.profiles.auto_accept_window_days is
+  'Account override for the budget window. NULL = shipped default (7). Bounded 1..90.';
+
+-- ── Producer ────────────────────────────────────────────────────────────────
+-- Same cheap-gates-only contract as 00170: this decides whether to ASK, never
+-- whether to adopt. The authoritative check stays server-side.
+create or replace function public.enqueue_auto_accept_suggestions()
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with eligible as (
+    select s.user_id, s.project_path
+    from instruction_suggestions s
+    join profiles p on p.id = s.user_id
+    join instructions i on i.id = s.instruction_id
+    left join projects proj on proj.id = s.project_id
+    where
+          s.kind = 'add'
+      -- Score OR provenance. Insights nominations are filed at 0.5 by
+      -- POST /api/insights/recommendations/nominate and exempted from the
+      -- score gate by the authoritative endpoint; requiring 0.8 here made
+      -- that exemption unreachable in any project without a high-scoring
+      -- catalog proposal. The per-window budget still bounds what a run may
+      -- take, so a permissive trigger cannot become a permissive adoption.
+      and (s.score >= 0.8 or i.frontmatter->>'source' = 'insights')
+      -- Instruction bodies only, mirroring the endpoint: a skill pasted into
+      -- CLAUDE.md is a category error, and queueing a job that can only refuse
+      -- is how the loop reported "nothing eligible" for three days.
+      and i.type = 'instruction'
+      and i.archived = false
+      and s.accepted_at is null
+      and s.dismissed_at is null
+      and s.declined_at is null
+      and s.is_stale = false
+      -- Consent: per-project override wins, else the user default (true).
+      and coalesce(
+            proj.metadata->>'autoAcceptSuggestions',
+            p.auto_accept_suggestions::text
+          ) = 'true'
+      -- One in flight per (user, project), per the 00083/00086 pattern.
+      and not exists (
+        select 1 from agent_jobs j
+        where j.task_kind = 'cron_auto_accept_suggestions'
+          and j.status in ('pending', 'claimed', 'running')
+          and j.payload->>'projectPath' = s.project_path
+          and j.user_id = s.user_id
+      )
+    group by s.user_id, s.project_path
+  ),
+  ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_auto_accept_suggestions',
+           'pending',
+           jsonb_build_object('projectPath', e.project_path),
+           'auto-accept:' || e.user_id::text || ':' || e.project_path
+    from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_auto_accept_suggestions() is
+  'Nightly producer for cron_auto_accept_suggestions. One row per (user, project) holding at least one consented ADD proposal that is either high-confidence (>= 0.8) or insights-authored, and whose instruction is a non-archived instruction body. Cheap gates only — the authoritative eligibility check is GET /api/instruction-suggestions/auto-acceptable, which also applies the per-project budget. Budget overrides: profiles.auto_accept_max_per_window (account) and projects.metadata.autoAcceptLimits (project). Turn it off for one repo: update projects set metadata = coalesce(metadata,''{}''::jsonb) || ''{"autoAcceptSuggestions":false}''::jsonb where id = ...; or globally: update profiles set auto_accept_suggestions = false where id = ...';

package/dist/supabase/migrations/00185_trial_throughput_settings.sql

@@ -0,0 +1,43 @@
+-- Randomised measurement gets a throughput dial.
+--
+-- ## The complaint, and what actually caused it
+--
+-- "One a day per project takes forever." Correct, and it was not the
+-- concurrency ceiling that caused it. Two constants in
+-- `routes/instruction-suggestions/loop.ts` compose badly:
+--
+--   TRIAL_MAX_CONCURRENT = 3   how many rules may be under measurement at once
+--   TRIAL_MAX_PER_RUN    = 1   how many NEW trials one cycle may start
+--
+-- The producer runs nightly, so `per run` is really `per night`. Starting from
+-- zero, a project needs THREE NIGHTS to reach a ceiling of three — the first
+-- two nights leave measurement capacity deliberately idle. That is pure
+-- latency: it buys no statistical protection, because the steady state it
+-- ramps toward is the same either way.
+--
+-- The ceiling is a real trade and stays put by default: every running
+-- experiment withholds its rule from ~half that project's sessions, so
+-- concurrency is context the agent does not get. The RAMP is not a trade at
+-- all. So the default for per-run rises to fill the ceiling in one cycle
+-- (3 nights -> 1), and both numbers become settings for anyone who wants to
+-- spend more context to answer more questions at once.
+--
+-- What this does NOT touch: GRADUATION_MIN_N (25 measured sessions per arm).
+-- Sessions are the scarce resource and that gate is what keeps a verdict from
+-- enshrining noise. Testing faster must mean asking more questions in
+-- parallel, never accepting thinner evidence for each.
+--
+-- NULL = use the shipped default, so an untouched account tracks changes to
+-- the default instead of freezing today's value at signup. Per-project
+-- overrides live in `projects.metadata.trialLimits` and win over these.
+-- Mirrors 00184's auto-accept budget settings exactly.
+
+ALTER TABLE public.profiles
+  ADD COLUMN IF NOT EXISTS trial_max_concurrent integer,
+  ADD COLUMN IF NOT EXISTS trial_max_per_run integer;
+
+COMMENT ON COLUMN public.profiles.trial_max_concurrent IS
+  'Account override for how many instruction experiments may run at once on one project. NULL = shipped default (3). Each running experiment withholds its rule from ~half that project''s sessions, so this is a context-vs-questions trade. Per-project override: projects.metadata.trialLimits.maxConcurrent.';
+
+COMMENT ON COLUMN public.profiles.trial_max_per_run IS
+  'Account override for how many NEW experiments one training cycle may start. NULL = shipped default (3, i.e. fill the concurrency ceiling in a single run). Raising this shortens ramp latency only; it cannot exceed the concurrency ceiling, which is what actually bounds context withholding. Per-project override: projects.metadata.trialLimits.maxPerRun.';

package/dist/supabase/migrations/00186_canonical_checkout_prefers_live.sql

@@ -0,0 +1,256 @@
+-- One authority for "which path is this project", and it may never be a dead one.
+--
+-- THE DEFECT (measured against production 2026-08-13).
+--
+-- Five call sites resolved a project's canonical checkout with the same
+-- hand-copied rule: `distinct on (project_id) ... order by is_worktree asc,
+-- last_seen desc`. Non-worktree first, most-recent second. `project_checkouts`
+-- for momento-mori holds three rows:
+--
+--   /Users/nickyeager/Code/agents/momento-mori                 is_worktree=TRUE   2026-08-10
+--   /Users/nickyeager/Code/agents/momento-mori/.worktrees/…    is_worktree=true   2026-05-04
+--   /Users/nickyeager/Code/agents/momento-mori/apps/cli        is_worktree=false  2026-05-01
+--
+-- Session ingest upserts `is_worktree` from each session's own metadata on
+-- every create (routes/sessions/ingest/create.ts), so ONE session that reported
+-- `isWorktree: true` while its projectPath was the repo root flipped the root's
+-- flag. `is_worktree ASC` then outranks recency absolutely, and the crown went
+-- to `apps/cli` — a path no session has rendered from since 2026-05-01.
+--
+-- Consequences, all silent, all of them looking like "nothing eligible":
+--
+--   * `regenerate_insights_jobs` analysed apps/cli every 6h from 2026-08-10
+--     onward — 136 completed jobs re-deriving the same May-era conclusions
+--     ("Across 13 CLI sessions…") while the repo they describe moved on.
+--   * The insights-authored suggestions those runs produce are filed under
+--     project_path=…/apps/cli, so `cron_auto_accept_suggestions` writes
+--     apps/cli/CLAUDE.md and reports `nothing-eligible` for the repo root
+--     every single night.
+--   * 00175 pinned trial nomination to this same rule. Its own comment
+--     diagnoses the apps/cli experiment as undead ("no session has rendered
+--     from apps/cli in months") and then adopts the rule that elects it.
+--
+-- tinyworlds is mis-routed identically, to `…/tinyworlds/src` (2026-05-04).
+--
+-- THE RULE. Recency outranks the worktree flag, but only when the gap is
+-- material: a path may not win if it is more than 30 days staler than the
+-- freshest path that project has. Stated against the project's OWN freshest
+-- path rather than against `now()`, so a project dormant for a year still
+-- resolves to the checkout it was last worked in instead of falling back to
+-- whichever dead sibling happens to carry is_worktree=false.
+--
+-- Within a staleness tier the original intent survives untouched: a real
+-- checkout beats a worktree, and the most recently seen breaks the tie.
+--
+-- This is a VIEW rather than a sixth copy of the ORDER BY on purpose. The
+-- rule has now been wrong in five places at once; the repo's own recorded
+-- lesson for two-copies drift (00177's comment) is that the copies disagree
+-- in the silent direction. TypeScript callers select from this view too.
+
+create or replace view public.project_canonical_checkouts as
+select distinct on (project_id)
+       project_id,
+       path,
+       is_worktree,
+       last_seen,
+       -- Exposed so callers can SAY the path is stale rather than silently
+       -- acting on it. /api/loop/status renders this; a canonical path that
+       -- has gone quiet while the project has not is how this defect hid.
+       (last_seen < freshest - interval '30 days') as is_stale,
+       freshest as project_last_seen
+  from (
+    select pc.project_id,
+           pc.path,
+           pc.is_worktree,
+           pc.last_seen,
+           max(pc.last_seen) over (partition by pc.project_id) as freshest
+      from public.project_checkouts pc
+     where pc.path is not null
+       and pc.path <> ''
+  ) q
+ order by project_id,
+          (last_seen < freshest - interval '30 days') asc,  -- live before stale
+          is_worktree asc,                                  -- checkout before worktree
+          last_seen desc;                                   -- then most recent
+
+comment on view public.project_canonical_checkouts is
+  'The single authority for a project''s canonical checkout path. Ranks live paths above ones more than 30 days staler than the project''s freshest, THEN non-worktree, THEN most-recently-seen. Replaces the hand-copied `order by is_worktree asc, last_seen desc` in regenerate_insights_jobs, enqueue_instruction_training, routes/insights/jobs.ts and routes/sessions/query.ts (x3), which elected a path dead since 2026-05-01 for momento-mori and tinyworlds because one session flipped the live root''s is_worktree flag. See 00186.';
+
+grant select on public.project_canonical_checkouts to authenticated, service_role;
+
+-- ── The insights producer ───────────────────────────────────────────────────
+-- Body unchanged from 00176 except that `canonical` now selects from the view.
+
+create or replace function public.regenerate_insights_jobs(
+  p_min_sessions integer default 3,
+  p_freshness_hours integer default 6
+)
+returns text
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_inserted int := 0;
+  v_skipped_fresh int := 0;
+  v_skipped_queued int := 0;
+  v_reclaimed int := 0;
+  v_id uuid;
+  r record;
+begin
+  for r in
+    with eligible as (
+      select s.user_id, s.project_id
+      from sessions s
+      where s.project_id is not null
+      group by s.user_id, s.project_id
+      having count(*) >= p_min_sessions
+    )
+    select e.user_id, e.project_id, c.path as project_path
+    from eligible e
+    join public.project_canonical_checkouts c on c.project_id = e.project_id
+    -- ACTIVITY since this project's last analysis — start, progress, or end.
+    where exists (
+      select 1 from sessions s2
+      where s2.user_id = e.user_id
+        and s2.project_id = e.project_id
+        and greatest(
+              s2.started_at,
+              coalesce(s2.ended_at, s2.started_at)
+            ) > coalesce(
+          (select max(j.completed_at)
+             from insights_jobs j
+            where j.user_id = e.user_id
+              and j.project_path = c.path
+              and j.status = 'completed'),
+          now() - interval '30 days'
+        )
+    )
+  loop
+    if exists (
+      select 1 from insights_jobs j
+      where j.user_id = r.user_id
+        and j.project_path = r.project_path
+        and j.status = 'completed'
+        and j.completed_at > now() - (p_freshness_hours || ' hours')::interval
+    ) then
+      v_skipped_fresh := v_skipped_fresh + 1;
+      continue;
+    end if;
+
+    update insights_jobs j
+    set status = 'failed',
+        completed_at = now(),
+        error = 'reclaimed by regenerate_insights_jobs: queued/in-flight >24h with no progress — worker likely died before any state write'
+    where j.user_id = r.user_id
+      and j.project_path = r.project_path
+      and j.status in ('pending', 'claimed', 'running')
+      and j.created_at < now() - interval '24 hours';
+    if found then
+      v_reclaimed := v_reclaimed + 1;
+    end if;
+
+    if exists (
+      select 1 from insights_jobs j
+      where j.user_id = r.user_id
+        and j.project_path = r.project_path
+        and j.status in ('pending', 'claimed', 'running')
+    ) then
+      v_skipped_queued := v_skipped_queued + 1;
+      continue;
+    end if;
+
+    v_id := gen_random_uuid();
+    insert into insights_jobs (id, user_id, project_id, status, project_path, task_kind, payload)
+    values (
+      v_id,
+      r.user_id,
+      r.project_id,
+      'pending',
+      r.project_path,
+      'process_insights',
+      jsonb_build_object('mirrorId', v_id, 'projectPath', r.project_path)
+    );
+    v_inserted := v_inserted + 1;
+  end loop;
+
+  return format(
+    'regenerated: %s inserted, %s skipped (fresh), %s skipped (queued), %s reclaimed (stale)',
+    v_inserted, v_skipped_fresh, v_skipped_queued, v_reclaimed
+  );
+end;
+$$;
+
+comment on function public.regenerate_insights_jobs(integer, integer) is
+  'Every-6h producer for process_insights. Enqueues one job per (user, project) with >= p_min_sessions sessions and activity since that project''s last completed analysis. As of 00186 the canonical path comes from public.project_canonical_checkouts, so the analysis can no longer be aimed at a checkout dead for months.';
+
+-- ── The training producer ───────────────────────────────────────────────────
+-- Body unchanged from 00175 except that `canonical` now selects from the view.
+-- The settle half stays ungated and per-path so off-canonical experiments
+-- retire rather than orphan.
+
+create or replace function public.enqueue_instruction_training(p_active_days integer default 7)
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with eligible as (
+    select s.user_id, s.project_path
+      from instruction_suggestions s
+      join public.project_canonical_checkouts c on c.path = s.project_path
+     where s.kind = 'add'
+       and s.accepted_at is null
+       and s.dismissed_at is null
+       and s.declined_at is null
+       and s.is_stale = false
+       and exists (
+         select 1 from sessions se
+          where se.project_id = c.project_id
+            and se.user_id = s.user_id
+            and se.started_at > now() - (p_active_days || ' days')::interval
+       )
+       and not exists (
+         select 1 from agent_jobs j
+          where j.task_kind = 'cron_instruction_training'
+            and j.status in ('pending', 'claimed', 'running')
+            and j.payload->>'projectPath' = s.project_path
+            and j.user_id = s.user_id
+       )
+     group by s.user_id, s.project_path
+
+    union
+
+    select e.user_id, e.project_path
+      from instruction_experiments e
+     where e.status = 'running'
+       and not exists (
+         select 1 from agent_jobs j
+          where j.task_kind = 'cron_instruction_training'
+            and j.status in ('pending', 'claimed', 'running')
+            and j.payload->>'projectPath' = e.project_path
+            and j.user_id = e.user_id
+       )
+     group by e.user_id, e.project_path
+  ),
+  ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_instruction_training',
+           'pending',
+           jsonb_build_object('projectPath', e.project_path),
+           'instruction-training:' || e.user_id::text || ':' || e.project_path
+      from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_instruction_training(integer) is
+  'Nightly producer for cron_instruction_training. The TRIAL half nominates only on a project''s canonical checkout path with a session inside p_active_days (default 7); SETTLE stays ungated and per-path so existing off-path experiments retire rather than orphan. As of 00186 canonical comes from public.project_canonical_checkouts — 00175 pinned this to a rule that elected the very apps/cli path its own comment describes as undead.';

package/dist/supabase/migrations/00187_recommendation_applications.sql

@@ -0,0 +1,32 @@
+create table public.recommendation_applications (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null references public.profiles(id) on delete cascade,
+  instruction_id uuid not null references public.instructions(id) on delete cascade,
+  project_id uuid references public.projects(id) on delete set null,
+  project_path text not null,
+  harness text not null check (harness in ('claude_code', 'codex', 'shared')),
+  target_path text not null,
+  status text not null default 'proposed' check (status in ('proposed', 'ready', 'applied', 'measuring', 'improved', 'inconclusive', 'harmful', 'rollback_ready', 'reverted', 'failed')),
+  apply_mode text not null check (apply_mode in ('auto', 'human')),
+  before_hash text,
+  applied_hash text,
+  applied_at timestamptz,
+  measurement_started_at timestamptz,
+  measurement_ended_at timestamptz,
+  verdict text check (verdict is null or verdict in ('improved', 'inconclusive', 'harmful')),
+  verdict_detail text,
+  reverted_at timestamptz,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (user_id, instruction_id, project_path, harness, target_path)
+);
+
+create index idx_recommendation_applications_user_status on public.recommendation_applications(user_id, status, updated_at desc);
+create index idx_recommendation_applications_user_harness on public.recommendation_applications(user_id, harness, updated_at desc);
+create index idx_recommendation_applications_project on public.recommendation_applications(project_id, updated_at desc);
+
+alter table public.recommendation_applications enable row level security;
+create policy "Users manage own recommendation applications"
+  on public.recommendation_applications for all
+  using (auth.uid() = user_id)
+  with check (auth.uid() = user_id);

package/dist/supabase/migrations/00188_training_producer_canonical_path.sql

@@ -0,0 +1,117 @@
+-- The training producer's ACTIVE gate passes for paths nobody works in.
+--
+-- ## Measured 2026-08-14
+--
+-- 00174 added the gate that stops undead trials, and it resolves
+-- `suggestion.project_path → project_checkouts → project_id → sessions`. That
+-- last hop is the defect: it asks "has this PROJECT been active?", not "has
+-- this PATH been active?". Every checkout of an active repo therefore passes,
+-- including ones with no session in months.
+--
+-- Concretely, `/Users/nickyeager/Code/agents/momento-mori/apps/cli` maps to the
+-- momento-mori project, whose ROOT is worked in daily, so the subpath cleared
+-- the gate and the producer enqueued a training job for it every night. Those
+-- jobs nominated real trials against a checkout with no session since
+-- 2026-05-01: 6 running experiments were sitting on it tonight, holding slots,
+-- unable to ever enroll an arm — the exact "undead" failure 00174 was written
+-- to end, arriving through the one hop it did not close. (They were stopped by
+-- hand under `inactive_project`; this stops them being created again.)
+--
+-- ## The rule
+--
+-- A suggestion's path may start a trial only if it IS the project's canonical
+-- checkout. `public.project_canonical_checkouts` (00186) is the single
+-- authority — CLAUDE.md's hard invariant is that this is never re-derived, and
+-- 00174's hand-rolled join is precisely a re-derivation. The view already ranks
+-- live-before-stale, so "canonical" cannot silently mean a dead path.
+--
+-- The per-path activity check is KEPT as well: canonical and recently active
+-- are different claims, and a project that has gone quiet entirely should still
+-- start no new trials.
+--
+-- The SETTLE half stays ungated, unchanged, for 00174's reason: gating it would
+-- orphan an experiment whose project went quiet mid-trial.
+
+create or replace function public.enqueue_instruction_training(p_active_days integer default 7)
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with eligible as (
+    select s.user_id, s.project_path
+      from instruction_suggestions s
+     where s.kind = 'add'
+       and s.accepted_at is null
+       and s.dismissed_at is null
+       and s.declined_at is null
+       and s.is_stale = false
+       -- CANONICAL (new in 00188): this path is the project's canonical
+       -- checkout, per the view that owns that answer. Without it, every
+       -- subdirectory of an active repo is treated as its own live project.
+       and exists (
+         select 1
+           from project_checkouts pc
+           join project_canonical_checkouts c on c.project_id = pc.project_id
+          where pc.path = s.project_path
+            and c.path = s.project_path
+       )
+       -- ACTIVE (00174, unchanged in intent): the project produced a session
+       -- inside the window. An experiment enrolls sessions at render time, so a
+       -- project with none coming can only ever produce an undead trial.
+       and exists (
+         select 1
+           from project_checkouts pc
+           join sessions se on se.project_id = pc.project_id
+          where pc.path = s.project_path
+            and se.user_id = s.user_id
+            and se.started_at > now() - (p_active_days || ' days')::interval
+       )
+       and not exists (
+         select 1 from agent_jobs j
+          where j.task_kind = 'cron_instruction_training'
+            and j.status in ('pending', 'claimed', 'running')
+            and j.payload->>'projectPath' = s.project_path
+            and j.user_id = s.user_id
+       )
+     group by s.user_id, s.project_path
+
+    union
+
+    -- Settle half: deliberately NOT gated (neither on activity nor on
+    -- canonicality). One cheap API call per project per night, and gating it
+    -- would orphan a running experiment the moment its project went quiet — or,
+    -- with the new gate, the moment its checkout stopped being canonical.
+    select e.user_id, e.project_path
+      from instruction_experiments e
+     where e.status = 'running'
+       and not exists (
+         select 1 from agent_jobs j
+          where j.task_kind = 'cron_instruction_training'
+            and j.status in ('pending', 'claimed', 'running')
+            and j.payload->>'projectPath' = e.project_path
+            and j.user_id = e.user_id
+       )
+     group by e.user_id, e.project_path
+  ),
+  ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_instruction_training',
+           'pending',
+           jsonb_build_object('projectPath', e.project_path),
+           'instruction-training:' || e.user_id::text || ':' || e.project_path
+      from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_instruction_training(integer) is
+  'Nightly producer for cron_instruction_training. TRIAL half requires (a) the path IS the project canonical checkout per project_canonical_checkouts (00188 — the project-level activity join in 00174 let every subpath of an active repo through, and apps/cli collected 6 undead trials that way), and (b) a session on the project within p_active_days (default 7). SETTLE half stays ungated so a quiet or non-canonical project cannot orphan a running experiment. Widen deliberately: select enqueue_instruction_training(30).';

package/dist/supabase/migrations/00189_limit_obs_window_index.sql

@@ -0,0 +1,37 @@
+-- 00189: make GET /api/usage/current-limits index-bounded instead of
+-- partition-scanning.
+--
+-- Measured on prod 2026-08-15 with EXPLAIN (ANALYZE, BUFFERS): 133 ms and
+-- 155,494 shared buffer hits PER CALL, x 122,479 calls = 19.0B buffer hits.
+-- That matched the 19.3B in pg_stat_statements exactly and made this the #1
+-- query by total DB time (25.3%) — ahead of realtime WAL decode and far ahead
+-- of the context_snapshots inserts everyone was looking at.
+--
+-- The cost was never the row count of the ANSWER (3 rows). It was that both
+-- LATERAL probes read the ENTIRE (user, provider, source_type, limit_type)
+-- partition — 37,946 index tuples x 3 limit types x 2 probes = 227,676 tuples
+-- to return 3 rows:
+--   * probe 1 is `max(resets_at)`, an aggregate with no LIMIT, so it must visit
+--     every row in the prefix;
+--   * probe 2 filters `resets_at >= <window> - interval '5 minutes'`, which is
+--     NOT sargable against idx_limit_obs_current — that index orders its
+--     trailing column by observed_at, so resets_at is only ever a filter.
+--
+-- Ordering the trailing column by resets_at makes both probes index-bounded:
+-- probe 1 becomes ORDER BY ... LIMIT 1 (one tuple), probe 2 becomes a range
+-- scan over just the current window. NULLS LAST is load-bearing — Postgres
+-- defaults DESC to NULLS FIRST, which would put legacy null-window rows at the
+-- head and make `ORDER BY resets_at DESC LIMIT 1` return NULL instead of the
+-- live window.
+--
+-- INCLUDE (value, observed_at) keeps it index-only: those are the only other
+-- columns the endpoint reads.
+--
+-- idx_limit_obs_current is NOT dropped — the legacy null-window fallback path
+-- still orders by observed_at DESC, and the ingest dedup path uses it too.
+--
+-- CONCURRENTLY; run OUTSIDE a transaction (same convention as 00094/00182).
+
+CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_limit_obs_window
+  ON limit_observations (user_id, provider, source_type, limit_type, resets_at DESC NULLS LAST)
+  INCLUDE (value, observed_at);