@rulemetric/local 0.11.0 → 0.12.1

package/dist/supabase/migrations/00191_recommendation_applications_effect_ledger.sql

@@ -0,0 +1,106 @@
+-- Turn `recommendation_applications` into the effect ledger.
+--
+-- 00187 shipped this table with the apply → measure → revert lifecycle, the
+-- before/after hashes, and a CAS transition guard — and then nothing ever wrote
+-- a row (0 in prod as of 2026-08-16). The multi-artifact actuator plan
+-- specified a second table, `applied_artifacts`, for the same job. Two empty
+-- ledgers and two dead read surfaces is the outcome nobody wanted, so the
+-- columns that plan needed are added here instead.
+--
+-- What was missing, and why each one is load-bearing:
+--
+--   boundary_class  Whether the actuator owned its targets. `inside` means an
+--                   exact inverse was possible and is therefore required;
+--                   `outside` means the user/git/another tool also writes there,
+--                   so the row owes a compensation instead. Declared per
+--                   artifact rather than rediscovered per actuator.
+--
+--   targets         EVERY path the apply path wrote. `target_path` (00187) holds
+--                   one, which is fine for a single-file recommendation and
+--                   wrong for a skill that lands in two locations. `target_path`
+--                   stays as the primary target so the existing unique index and
+--                   its callers keep working; `targets` is the complete set.
+--
+--   inverse         How to undo this row, RECORDED AT WRITE TIME. The system's
+--                   other undos are reconstructed — `removeHookByCommand`
+--                   searches a settings file for a command substring, and skill
+--                   retraction searches six directories by name. A search is not
+--                   an inverse: it misses silently when the thing was renamed
+--                   and removes the wrong entry when it matches twice.
+--
+--   requires        The coeffect declaration. Two rules make it load-bearing:
+--   provides        do not apply a dependent before its dependency is present,
+--                   and do not withdraw a provider while an applied dependent
+--                   names it. The second closes a live hole — archiving is a
+--                   soft delete, so archiving a skill today leaves every
+--                   instruction naming it pointing at nothing, silently.
+--
+--   apply_batch_id  The ordering. Not decoration: inverses must run LIFO,
+--   apply_seq       because a batch can install a provider and its dependent
+--                   moments apart, and undoing in application order withdraws
+--                   the provider while the dependent is still live. It is also
+--                   the only thing that can answer "undo everything last
+--                   night's loop applied", a question that currently has no
+--                   answer for any artifact type.
+--
+-- Every column is nullable or defaulted: the 00187 rows that do not exist yet,
+-- and any that appear between deploy and this migration, stay readable.
+
+alter table public.recommendation_applications
+  add column if not exists boundary_class text,
+  add column if not exists targets text[] not null default '{}',
+  add column if not exists inverse jsonb,
+  add column if not exists requires text[] not null default '{}',
+  add column if not exists provides text[] not null default '{}',
+  add column if not exists apply_batch_id uuid,
+  add column if not exists apply_seq integer;
+
+do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+     where conname = 'recommendation_applications_boundary_class_check'
+  ) then
+    alter table public.recommendation_applications
+      add constraint recommendation_applications_boundary_class_check
+      check (boundary_class is null or boundary_class in ('inside', 'outside'));
+  end if;
+end $$;
+
+-- A row that reached `applied` must carry the inverse it recorded at that
+-- moment. Enforced in the database rather than only in the actuator because the
+-- actuator is one of several writers-to-be (CLI accept, worker auto-apply, the
+-- API's own transition endpoint), and "we forgot to record the undo" is not a
+-- failure any of them would notice at the time — it surfaces months later when
+-- someone asks to revert and the row cannot say how.
+--
+-- Statuses before `applied` (proposed, ready) and the terminal `failed` are
+-- exempt: nothing was written, so there is nothing to undo.
+do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+     where conname = 'recommendation_applications_applied_has_inverse'
+  ) then
+    alter table public.recommendation_applications
+      add constraint recommendation_applications_applied_has_inverse
+      check (
+        status in ('proposed', 'ready', 'failed')
+        or inverse is not null
+      ) not valid;
+  end if;
+end $$;
+
+-- NOT VALID above, validated here: the constraint applies to every future write
+-- immediately, and the validation pass confirms the (currently empty) backlog
+-- without taking an ACCESS EXCLUSIVE lock for the scan.
+alter table public.recommendation_applications
+  validate constraint recommendation_applications_applied_has_inverse;
+
+-- The withdrawal guard's query: "which applied rows require any of these keys?"
+create index if not exists idx_recommendation_applications_requires
+  on public.recommendation_applications using gin (requires);
+
+-- The reversal query: one batch, newest first.
+create index if not exists idx_recommendation_applications_batch
+  on public.recommendation_applications (user_id, apply_batch_id, apply_seq desc);

package/dist/supabase/migrations/00192_cleanup_reaps_memberless_orgs.sql

@@ -0,0 +1,142 @@
+-- cleanup_stale_test_users cannot reach an org whose members are already gone.
+--
+-- The org sweep (00087, unchanged through 00121) elects orgs by joining
+-- `user_organizations` to the set of users it is about to delete:
+--
+--     and exists (select 1 from user_organizations uo
+--                  where uo.org_id = o.id and uo.user_id = any(v_user_ids))
+--
+-- That arm only ever matches while the membership row still exists. Anything
+-- that deletes the user first — the e2e suites' own `deleteTestUser`, an admin
+-- delete, a user deleting their account — cascades `user_organizations` away,
+-- and from that moment the org is invisible to every subsequent sweep. It has no
+-- members, so nobody can see it, join it, or delete it through the product; it
+-- is unreachable and permanent.
+--
+-- Measured in prod 2026-08-16: 30,276 memberless orgs of 30,307 total,
+-- accumulating since 2026-07-12 (30,261 of them named "…'s Workspace", the
+-- signup default; the other 15 are timestamp-suffixed org/team test fixtures).
+-- They hold nothing — 0 projects, 0 sessions, 0 invitations, 0 agent_runs,
+-- 3 test teams.
+--
+-- The fix is a second, independent sweep: an org with zero members, older than
+-- an hour, is dead by construction. It cannot arise from normal use — the
+-- `check_last_owner` trigger refuses to remove an org's final owner, so the only
+-- way to reach zero members is the cascade above — and the hour of grace keeps a
+-- signup that inserts the org before the membership safe.
+--
+-- Note this sweep is deliberately NOT restricted to test-shaped names. The
+-- defect is not "test orgs leak"; it is "an org outlives its last member". A
+-- real user who deletes their account leaves exactly the same corpse, and it
+-- should be reaped for exactly the same reason.
+--
+-- Two other changes, both forced by the first:
+--
+--   * The `v_user_ids is null` early return (00087) skipped everything below it.
+--     A quiet hour with no test users to reap would have skipped the memberless
+--     sweep too, which is the one that has 30k rows of backlog. The early return
+--     is gone; the user sweep is now guarded in place.
+--   * `superadmin_audit_log.target_org_id` is ON DELETE NO ACTION, so it is
+--     nulled for the memberless set before the delete, the same way the existing
+--     path does it for the membered set.
+--
+-- Return signature is unchanged (callers: `crons run cleanup_stale_test_users`).
+-- `deleted_orgs` now counts both sweeps.
+
+drop function if exists public.cleanup_stale_test_users();
+
+create function public.cleanup_stale_test_users()
+returns table(deleted_users int, deleted_orgs int, deleted_smoke_sessions int) as $$
+declare
+  v_user_ids uuid[];
+  v_org_ids uuid[];
+  v_orphan_org_ids uuid[];
+  v_deleted_users int := 0;
+  v_deleted_orgs int := 0;
+  v_deleted_orphan_orgs int := 0;
+  v_deleted_smoke int := 0;
+begin
+  -- Smoke-test session residue (any user). 1h threshold keeps an
+  -- in-flight smoke run safe.
+  delete from sessions
+  where created_at < now() - interval '1 hour'
+    and (
+      external_session_id like '00000000-0000-4000-8000-%'
+      or project_path = '/tmp/smoke-test-project'
+      or metadata->>'clientName' = 'smoke-test'
+    );
+  get diagnostics v_deleted_smoke = row_count;
+
+  -- Candidates: obvious test users older than 1h, excluding the pinned dev
+  -- login. See 00121 for why each arm can't hit a real signup.
+  select array_agg(id) into v_user_ids
+  from auth.users
+  where email != 'nick@rulemetric.test'
+    and created_at < now() - interval '1 hour'
+    and (
+      email ~* '\.(test|example|invalid|localhost|local)$'
+      or email ~* '@(example\.(com|net|org))$'
+      or email ~ '1[0-9]{12}@'
+    );
+
+  if v_user_ids is not null and array_length(v_user_ids, 1) > 0 then
+    -- Orgs whose every member is in the to-delete set. Cascade carve-out in
+    -- check_last_owner lets the user_organizations rows go when the parent
+    -- org is being deleted.
+    select array_agg(o.id) into v_org_ids
+    from organizations o
+    where not exists (
+      select 1 from user_organizations uo
+      where uo.org_id = o.id
+        and uo.user_id != all(v_user_ids)
+    )
+    and exists (
+      select 1 from user_organizations uo
+      where uo.org_id = o.id and uo.user_id = any(v_user_ids)
+    );
+
+    -- 1. NULL test-user references on NO ACTION FKs (preserve content)
+    update instructions set created_by = null where created_by = any(v_user_ids);
+    update instructions set archived_by = null where archived_by = any(v_user_ids);
+    update instruction_versions set created_by = null where created_by = any(v_user_ids);
+    update projects set created_by = null where created_by = any(v_user_ids);
+    update project_instructions set added_by = null where added_by = any(v_user_ids);
+
+    -- 2. Scrub superadmin_audit_log (actor_id is NOT NULL → delete; targets nullable)
+    delete from superadmin_audit_log where actor_id = any(v_user_ids);
+    update superadmin_audit_log set target_user_id = null where target_user_id = any(v_user_ids);
+    if v_org_ids is not null then
+      update superadmin_audit_log set target_org_id = null where target_org_id = any(v_org_ids);
+    end if;
+
+    -- 3. Delete orphan orgs
+    if v_org_ids is not null then
+      delete from organizations where id = any(v_org_ids);
+      get diagnostics v_deleted_orgs = row_count;
+    end if;
+
+    -- 4. Delete users (cascades to profiles, user_organizations, sessions, ...)
+    delete from auth.users where id = any(v_user_ids);
+    get diagnostics v_deleted_users = row_count;
+  end if;
+
+  -- 5. Memberless orgs, whoever emptied them and whenever. This runs on every
+  --    sweep, independent of whether step 4 deleted anyone, because the orgs it
+  --    reaps were emptied by an EARLIER run (or by a delete this function never
+  --    saw) and no later run can otherwise reach them.
+  select array_agg(o.id) into v_orphan_org_ids
+  from organizations o
+  where o.created_at < now() - interval '1 hour'
+    and not exists (select 1 from user_organizations uo where uo.org_id = o.id);
+
+  if v_orphan_org_ids is not null then
+    update superadmin_audit_log set target_org_id = null
+     where target_org_id = any(v_orphan_org_ids);
+    delete from organizations where id = any(v_orphan_org_ids);
+    get diagnostics v_deleted_orphan_orgs = row_count;
+    v_deleted_orgs := v_deleted_orgs + v_deleted_orphan_orgs;
+  end if;
+
+  return query select v_deleted_users, v_deleted_orgs, v_deleted_smoke;
+end;
+$$ language plpgsql security definer set search_path = public, auth;

package/dist/supabase/migrations/00193_judge_segment_pin_and_anchors.sql

@@ -0,0 +1,367 @@
+-- The judge segment gets ONE definition, and a pin outranks anything observed.
+--
+-- §6c scopes calibration to the current judge, and until now "current judge"
+-- was hand-copied into four places (00148, 00169, 00190, judge-calibration.ts)
+-- as "the most recently stamped run". Recency asks who graded LAST when the
+-- question is whose bias we can CORRECT, and the two come apart the instant a
+-- stray run lands. Measured 2026-08-18 on the one evolve-enrolled target:
+--
+--     claude-opus-5[1m]          355 runs   Jul 30 - Aug 13
+--     claude-opus-4-8[1m]        303 runs   Jul 20 - Jul 29   <- all 37 labels
+--     (unstamped)                159 runs   Mar 25 - Aug 17
+--     claude-fable-5             113 runs   Aug 08 - Aug 14
+--     claude-haiku-4-5            80 runs   Aug 14 - Aug 16   <- elected, 0 labels
+--
+-- Recency elected the segment with zero anchors, so the adequacy gate reported
+-- `0/50 human-labeled runs` and asked for fifty more while thirty-seven sat one
+-- segment away. 00148's grader pin then pinned the NEXT batch to that same
+-- stray, making the drift self-reinforcing; #357 quarantined fallback runs from
+-- electing, but a run the producer never pinned has nothing to fall back FROM,
+-- so unpinned evolution batches walked straight through the quarantine.
+--
+-- Three tiers, descending authority:
+--   1. PIN      metadata.graderModel — a decision a person made. Nothing
+--               observed in the run table may overrule it. A pinned segment
+--               with zero runs is a correct answer: grading starts there.
+--   2. ANCHORS  the segment holding the most fully human-labeled runs — the
+--               only segment that can produce a corrected estimate at all.
+--   3. RECENCY  the old rule, surviving as the tie-break and the
+--               no-anchors-anywhere fallback.
+--
+-- Fallback runs (stamped != requested) are quarantined from ELECTING but still
+-- count as data, exactly as #357 established. If every stamped run fell back,
+-- the whole stamped set votes rather than electing nothing — an empty segment
+-- would silently drop every LLM-graded run.
+--
+-- apps/api/src/lib/judge-calibration.ts `electJudgeSegment()` implements the
+-- same three tiers for the TypeScript readers, and its unit tests pin the tier
+-- order. Change one side without the other and the scheduled path will measure
+-- a different segment than the reviewed path.
+-- ---------------------------------------------------------------------------
+
+create or replace function public.eval_target_judge_segment(p_target_id uuid)
+returns text
+language sql
+stable
+security definer
+set search_path = public
+as $$
+  with elector as (
+    select
+      r.grading->>'judge_model' as model,
+      r.created_at,
+      (
+        r.grading->>'judge_model_requested' is null
+        or r.grading->>'judge_model_requested' = r.grading->>'judge_model'
+      ) as clean,
+      -- Guarded: a grading blob whose expectations is not an array would make
+      -- jsonb_array_elements raise, and one malformed run must not take the
+      -- whole election down.
+      case
+        when jsonb_typeof(r.grading->'expectations') = 'array' then (
+          select count(*)
+          from jsonb_array_elements(r.grading->'expectations') e
+          where coalesce(e->>'method', 'llm') = 'llm'
+            and coalesce(e->>'errored', 'false') <> 'true'
+        )
+        else 0
+      end as llm_total,
+      coalesce(a.llm_annotated, 0) as llm_annotated
+    from eval_runs r
+    left join (
+      select eval_run_id, count(*) filter (where judge_method = 'llm') as llm_annotated
+      from eval_grade_annotations
+      where eval_target_id = p_target_id
+      group by eval_run_id
+    ) a on a.eval_run_id = r.id
+    where r.eval_target_id = p_target_id
+      and r.status = 'completed'
+      and r.configuration in ('with_target', 'without_target')
+      and r.grading->>'judge_model' is not null
+  ),
+  has_clean as (
+    select exists (select 1 from elector where clean) as v
+  ),
+  electorate as (
+    select e.* from elector e, has_clean h where e.clean or not h.v
+  ),
+  pin as (
+    select nullif(btrim(t.metadata->>'graderModel'), '') as model
+    from eval_targets t
+    where t.id = p_target_id
+  ),
+  anchors as (
+    -- Ties broken by recency then model string: a tie-break that fell through
+    -- to nothing would leave the segment depending on row order, which is the
+    -- same instability recency had.
+    select model
+    from electorate
+    where llm_total > 0 and llm_annotated >= llm_total
+    group by model
+    order by count(*) desc, max(created_at) desc, model desc
+    limit 1
+  ),
+  recency as (
+    select model from electorate order by created_at desc, model desc limit 1
+  )
+  select coalesce(
+    (select model from pin),
+    (select model from anchors),
+    (select model from recency)
+  );
+$$;
+
+comment on function public.eval_target_judge_segment(uuid) is
+  'Canonical §6c judge segment for an eval target: metadata.graderModel pin, else the segment holding the most fully human-labeled runs, else the most recently stamped run. Fallback-graded runs (stamped <> requested) cannot elect. Mirrors electJudgeSegment() in apps/api/src/lib/judge-calibration.ts — the two must not diverge. Never re-derive this inline: the hand-copied recency rule lived in four places and elected a zero-anchor segment for four days (2026-08-18).';
+
+-- ---------------------------------------------------------------------------
+-- Both producers now ask the function instead of carrying their own copy.
+-- ---------------------------------------------------------------------------
+
+create or replace function public.enqueue_eval_autorun()
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with eligible as (
+    select t.id, t.user_id,
+      -- Canonical segment (00193). Was an inline "most recent stamped run"
+      -- subquery, which is how a credit-exhaustion fallback became the pin.
+      public.eval_target_judge_segment(t.id) as current_judge
+    from eval_targets t
+    where coalesce(t.metadata->>'autoRunEnabled', 'false') = 'true'
+      -- Gate 0 (00190): the target must be anchored to something a promotion
+      -- could land on. Without this, a batch is two LLM executions plus a
+      -- judged grade spent to rewrite a row nothing reads.
+      and (
+        t.instruction_id is not null
+        or t.project_path is not null
+        or t.name like '/%'
+      )
+      -- Gate 2a: recent grading wasn't MOSTLY ungradeable (proportional, and
+      -- identical to the evolution producer's 2a since 00163).
+      and not exists (
+        select 1 from eval_runs r
+        where r.eval_target_id = t.id
+          and r.created_at > now() - interval '7 days'
+        group by r.eval_target_id
+        having count(*) >= 5
+           and count(*) filter (
+                 where jsonb_typeof(r.grading->'expectations') = 'array'
+                   and exists (
+                     select 1 from jsonb_array_elements(r.grading->'expectations') e
+                     where coalesce(e->>'errored', 'false') = 'true'
+                   )
+               ) * 4 >= count(*)
+      )
+      -- Gate 2b: no human anchors pointing at an ungradeable assertion.
+      and not exists (
+        select 1
+        from eval_grade_annotations a
+        join eval_runs r on r.id = a.eval_run_id
+        where a.eval_target_id = t.id
+          and jsonb_typeof(r.grading->'expectations') = 'array'
+          and coalesce(
+            r.grading->'expectations'->(a.expectation_index)->>'errored', 'false'
+          ) = 'true'
+      )
+      -- Gate 2c: last week's batch wasn't mostly failures.
+      and not exists (
+        select 1 from eval_runs r
+        where r.eval_target_id = t.id
+          and r.created_at > now() - interval '7 days'
+        group by r.eval_target_id
+        having count(*) >= 5
+           and count(*) filter (where r.status = 'failed') * 4 >= count(*)
+      )
+      -- Gate 3: the target has live cases to actually run.
+      and exists (
+        select 1 from evals ev
+        where ev.eval_target_id = t.id and ev.retired_at is null
+      )
+      -- One in flight at a time, per the 00083/00086 pattern.
+      and not exists (
+        select 1 from agent_jobs j
+        where j.task_kind = 'cron_eval_autorun'
+          and j.status in ('pending', 'claimed', 'running')
+          and j.payload->>'evalTargetId' = t.id::text
+      )
+  ), ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_eval_autorun',
+           'pending',
+           jsonb_build_object('evalTargetId', e.id::text, 'maxRuns', 12)
+             || case
+                  when e.current_judge is not null
+                    then jsonb_build_object('graderModel', e.current_judge)
+                  else '{}'::jsonb
+                end,
+           'eval-autorun:' || e.id::text
+    from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_eval_autorun() is
+  'Nightly producer for cron_eval_autorun. Enqueues one bounded depth batch per OPTED-IN, ANCHORED, healthy, under-powered eval target, with the grader pinned to the target''s canonical judge segment (public.eval_target_judge_segment, 00193 — pin > anchors > recency; was an inline recency subquery from 00148/#196). Gate 0 (00190) requires instruction_id, project_path, or an absolute-path name. Health 2a is PROPORTIONAL as of 00169. Opt in with: update eval_targets set metadata = coalesce(metadata, ''{}''::jsonb) || ''{"autoRunEnabled":true}''::jsonb where id = ...';
+
+-- ---------------------------------------------------------------------------
+-- The evolution producer never pinned a grader AT ALL.
+--
+-- 00148 pinned the autorun batch precisely so a scheduled run could not fork
+-- the segment. The evolution producer — which spends far more per night, and
+-- whose paired replays are the ONLY route to a promotion (§13, Mode A) — was
+-- never given the same treatment. Its runs therefore carried no
+-- `judge_model_requested`, so #357's fallback quarantine had nothing to compare
+-- against and they elected freely. Unpinned evolution batches are how
+-- claude-haiku-4-5 took the segment on 2026-08-14.
+--
+-- Function is otherwise byte-identical to 00183.
+-- ---------------------------------------------------------------------------
+
+create or replace function public.enqueue_instruction_evolution()
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with health_ok as (
+    -- The gates SHARED by both enrolment paths, evaluated once. All copied
+    -- byte-identical from the live definition (00163's revision): pause,
+    -- proportional 2a, absolute 2b, proportional 2c, live cases, change
+    -- budget, one-in-flight.
+    select t.id, t.user_id
+    from eval_targets t
+    where coalesce(t.metadata->>'autoEvolvePaused', 'false') <> 'true'
+      -- Health 2a: recent grading wasn't MOSTLY ungradeable (proportional, 00163).
+      and not exists (
+        select 1 from eval_runs r
+        where r.eval_target_id = t.id
+          and r.created_at > now() - interval '7 days'
+        group by r.eval_target_id
+        having count(*) >= 5
+           and count(*) filter (
+                 where jsonb_typeof(r.grading->'expectations') = 'array'
+                   and exists (
+                     select 1 from jsonb_array_elements(r.grading->'expectations') e
+                     where coalesce(e->>'errored', 'false') = 'true'
+                   )
+               ) * 4 >= count(*)
+      )
+      -- Health 2b: no human anchors pointing at an ungradeable assertion (absolute).
+      and not exists (
+        select 1
+        from eval_grade_annotations a
+        join eval_runs r on r.id = a.eval_run_id
+        where a.eval_target_id = t.id
+          and jsonb_typeof(r.grading->'expectations') = 'array'
+          and coalesce(
+            r.grading->'expectations'->(a.expectation_index)->>'errored', 'false'
+          ) = 'true'
+      )
+      -- Health 2c: last week's batch wasn't mostly failures.
+      and not exists (
+        select 1 from eval_runs r
+        where r.eval_target_id = t.id
+          and r.created_at > now() - interval '7 days'
+        group by r.eval_target_id
+        having count(*) >= 5
+           and count(*) filter (where r.status = 'failed') * 4 >= count(*)
+      )
+      -- Live cases to measure against — at least MIN_LIVE_CASES (3).
+      -- `exists` (>= 1) was the bug: see 00183's header.
+      and (
+        select count(*) from evals ev
+        where ev.eval_target_id = t.id and ev.retired_at is null
+      ) >= 3
+      -- Change budget (cheap exclusion; the API is the authority).
+      and (
+        select count(*)
+        from instruction_promotions p
+        where p.eval_target_id = t.id
+          and p.applied
+          and p.created_at > now() - interval '7 days'
+      ) < 3
+      -- One in flight at a time.
+      and not exists (
+        select 1 from agent_jobs j
+        where j.task_kind = 'cron_instruction_evolution'
+          and j.status in ('pending', 'claimed', 'running')
+          and j.payload->>'evalTargetId' = t.id::text
+      )
+  ),
+  manual as (
+    -- The hand-picked path, unchanged and uncapped.
+    select h.id, h.user_id
+    from health_ok h
+    join eval_targets t on t.id = h.id
+    where coalesce(t.metadata->>'autoEvolveEnabled', 'false') = 'true'
+  ),
+  auto_ranked as (
+    -- The stated rule. Round-robin: never-decided first (nulls first), then
+    -- least-recently-decided, so the cap rotates through the candidate pool
+    -- instead of re-measuring the same winners nightly.
+    select h.id, h.user_id,
+           row_number() over (
+             partition by h.user_id
+             order by (
+               select max(p.created_at)
+               from instruction_promotions p
+               where p.eval_target_id = h.id
+             ) asc nulls first,
+             h.id
+           ) as rn
+    from health_ok h
+    join eval_targets t on t.id = h.id
+    where t.type = 'instruction'
+      and coalesce(t.metadata->>'autoEvolveOptOut', 'false') <> 'true'
+      -- Not already covered by the manual path.
+      and coalesce(t.metadata->>'autoEvolveEnabled', 'false') <> 'true'
+      -- ACTIVE (00145's load-bearing gate): a run in the last 30 days.
+      and exists (
+        select 1 from eval_runs r
+        where r.eval_target_id = t.id
+          and r.created_at > now() - interval '30 days'
+      )
+  ),
+  eligible as (
+    select id, user_id from manual
+    union
+    select id, user_id from auto_ranked where rn <= 3
+  ),
+  ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_instruction_evolution',
+           'pending',
+           jsonb_build_object('evalTargetId', e.id::text)
+             || case
+                  when public.eval_target_judge_segment(e.id) is not null
+                    then jsonb_build_object(
+                           'graderModel', public.eval_target_judge_segment(e.id))
+                  else '{}'::jsonb
+                end,
+           'instruction-evolution:' || e.id::text
+    from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_instruction_evolution() is
+  'Nightly producer for cron_instruction_evolution. Two enrolment paths as of 00166: MANUAL (autoEvolveEnabled=true, uncapped) and the STATED RULE (type=instruction, not opted out via autoEvolveOptOut, an eval run in 30 days, capped at 3/user/night round-robin by least-recent decision). Both share the health gates (2a proportional per 00163, 2b absolute, 2c proportional), live-cases (>= 3 per 00183), change-budget and one-in-flight guards. As of 00193 the payload PINS graderModel to the canonical judge segment — without it the paired replays carried no judge_model_requested, so #357''s fallback quarantine could not see them and they forked the segment freely. Auto-enrolled cycles are measure-only: writing still requires autoEvolveApply AND an explicit immutableSections.';