<!-- source: openspec/changes/add-user-last-seen-at/proposal.md -->

# Add user last_seen_at column

> **Affects capability spec:** `openspec/current/db/entities.md`, `openspec/current/auth.md`

## Why

We have no visibility into when a user last interacted with the platform. `last_seen_at` is a lightweight activity signal useful for future analytics, stale-session cleanup, and admin dashboards. This change also serves as a minimal end-to-end smoke test of the OpenSpec change pipeline (Muse → promote → Forge → PR).

## What Changes

- **New column `last_seen_at`** (`timestamptz`, nullable, default `NULL`) on the `users` table in Supabase.
- **Supabase migration** to add the column.
- **Middleware update** — on every authenticated request, update `last_seen_at` to `now()` for the current user. Use a fire-and-forget pattern to avoid adding latency to the request path.
- **RLS test** — one test asserting that a user can read their own `last_seen_at` but cannot write to another user's row.

## Impact

- **Database**: new migration file under `supabase/migrations/`.
- **Middleware**: touch to the auth-gated middleware layer (Next.js `middleware.ts` or equivalent Supabase client call).
- **Spec files**: no capability-spec changes required — this is additive infrastructure, not a new user-facing capability.

## Out of scope

- Admin UI or dashboard displaying `last_seen_at`.
- Debouncing / throttling the update (acceptable overhead for now; optimise later if needed).
- Backfilling `last_seen_at` for existing users.
- Any analytics or reporting built on top of this column.
