<!-- source: openspec/changes/add-user-last-seen-at/tasks.md -->

# Tasks — add-user-last-seen-at

> Dependency-aware checklist. Each task is independently shippable unless noted.

- [ ] 1. Create Supabase migration `<timestamp>_add_user_last_seen_at.sql` with `ALTER TABLE public.users ADD COLUMN IF NOT EXISTS last_seen_at timestamptz DEFAULT NULL;`
- [ ] 2. Add fire-and-forget `last_seen_at` update in the authenticated middleware path (after session validation, non-blocking)
- [ ] 3. Add RLS integration test: authenticated user can read own `last_seen_at`; update to another user's row is blocked
- [ ] 4. Run `supabase db reset` or equivalent locally to verify migration applies cleanly
- [ ] 5. Open PR, confirm CI passes (migration + RLS test)
