<!-- source: openspec/changes/add-user-last-seen-at/verification.md -->

# Verification — add-user-last-seen-at

> Companion to proposal.md / design.md / tasks.md. Lists the deterministic
> acceptance assertions Forge runs at the spec-acceptance checkpoint (#2.5)
> before opening the PR.

## Spec alignment

Done means: the `users` table has a `last_seen_at timestamptz` column, the authenticated middleware updates it on every request via a fire-and-forget call, and an RLS integration test proves row-level isolation. No UI, no analytics, no debouncing.

## Hallucination risks

- MUST appear: a migration file under `supabase/migrations/` containing `last_seen_at`.
- MUST appear: a fire-and-forget Supabase `.update()` call in the middleware path.
- MUST appear: at least one test file exercising RLS on `last_seen_at`.
- MUST NOT appear: any admin dashboard route or UI component for `last_seen_at`.
- MUST NOT appear: any debounce/throttle logic around the update.

## Pattern references

- Existing Supabase migrations in `supabase/migrations/` — naming convention and SQL style.
- Existing middleware auth flow — placement of the fire-and-forget call.

## Acceptance

- Done when: ls supabase/migrations/*last_seen_at* returns at least 1 file
- Done when: grep -c 'last_seen_at' supabase/migrations/*last_seen_at*.sql returns >= 1
- Done when: grep -rc 'last_seen_at' src/ returns >= 1
- Reviewer confirms: middleware update is fire-and-forget and does not add latency to the response path
- Reviewer confirms: no UI or dashboard components reference last_seen_at
- Done when: gh pr list --head add-user-last-seen-at returns >=1
- Done when: jq -r '.outcome' ~/.forge/state/RAP-NN.json returns 'completed-with-pr'
