Tracer A: user_activity_day capture — live unflagged write in Pasaport.validateSession

[usirin]

Stories: 3
TDD: yes
Containment: exempt (founder ruling R1.2 on #7028, 2026-08-23: capture ships live on deploy, no flag — activity days are forward-only and cannot be backfilled)

What to build

The visit-return data seam of epic #6767: one append-only D1 table user_activity_day (user_id, day, PRIMARY KEY (user_id, day)) and one memoized upsert wired at the end of Pasaport.validateSession (apps/web/worker/features/pasaport/Pasaport.ts, the success path where session?.user resolves).

• Schema export in apps/web/worker/db/drizzle/schema.ts plus migration numbered off the existing sequence in apps/web/worker/db/drizzle/migrations/.
• On each validated session: compute today's UTC day bucket, check an isolate-local memo (user_id → day), skip when already touched today, else upsert ON CONFLICT DO NOTHING and record the memo. The memo is load-bearing — this sits on the hottest path in the worker and must cost ~one D1 write per active user per day, never per request.
• Any failure of the capture is caught, logged through the existing worker error pipeline (Effect.logError, surfaced to Sentry), and swallowed: the capture never fails a login.
• No flag, no config surface — live on deploy per founder ruling R1.2 (Week-1 survival cohort funnel on /funnel #7028).

Acceptance criteria

• a validated session for user X on day N produces exactly one user_activity_day (X, N) row, and repeated same-isolate validations that day produce no further writes
• the upsert builder is .toSQL()-asserted with no engine, carrying ON CONFLICT DO NOTHING
• an injected capture failure leaves validateSession returning the session unchanged, with the error visible on the worker error pipeline
• no feature flag or gate stands between a deployed worker and the capture write

[usirin]

build-claim: build:01a02c43-d33d-70fd-9b36-f8850a03a5f8:ef429d0f-386f-40f2-a0bd-c851d06364bd · 2026-08-23T03:12:44.124Z

[usirin]

build-deviations: #7029

Deviations

• Said: Tracer A: user_activity_day capture — live unflagged write in Pasaport.validateSession #7029 orders the seam as "check the memo, skip when already touched today, else upsert ON CONFLICT DO NOTHING and record the memo". Did: recordCaptured runs BEFORE the D1 write, not after, so a failing capture is spent once per isolate per day. Why: this sits on the hottest path in the worker; recording first bounds it to at most one write attempt per user per day even under sustained D1 failure, instead of one failed write per request until midnight. A post-restart re-attempt stays idempotent via ON CONFLICT DO NOTHING. Disposition: stated here.
• Said: Tracer A: user_activity_day capture — live unflagged write in Pasaport.validateSession #7029 specifies an isolate-local memo (user_id → day) with no size bound. Did: the memo drops its entire map past 50,000 entries rather than growing unboundedly over a long-lived isolate's user population. Why: an unbounded Map on the hot path is a slow memory leak; worst case after a drop is a bounded burst of no-op upserts, never unbounded memory. Disposition: stated here.
• Said: Tracer A: user_activity_day capture — live unflagged write in Pasaport.validateSession #7029 asks for "migration numbered off the existing sequence in apps/web/worker/db/drizzle/migrations/". Did: wrote 0034_user_activity_day.sql by hand in the exact format of its predecessors (0033 is the prior head); the repo has no drizzle-kit generate step for these files. Why: matches every existing migration's provenance and shape. Disposition: stated here.

[usirin]

review-code: PASS range:f1889e26049103fdf31057e0137b2929ce37c34f..8600f4c content:5d96a1da3d67 — capture seam meets all four criteria; disclosures verified against substance

Range-scoped review-code verdict for epic #6767 child #7029, judged over f1889e2..8600f4c (5 changed files: migration 0034, schema export, capture module, seam wiring, unit tests). Governance derived not-required over this range; self false. All five new tests were executed at the tip in a detached checkout of this worktree: 5 passed.

Per-criterion

• [PASS] AC1 — exactly one (X, N) row per validated session/day; same-isolate repeats write nothing. The capture block sits at the end of Pasaport.validateSession after the ban gate (apps/web/worker/features/pasaport/Pasaport.ts, tip lines ~640–654): shouldCapture gates, recordCaptured + one upsertUserActivityDay run. The composite PK (user_id, day) plus ON CONFLICT DO NOTHING makes any cross-isolate repeat a no-op, so "exactly one row" holds structurally, not just per-memo. The seam test scripts two validations over a counting fake DrizzleAccess and asserts the tally [2, 1] — ban-read + upsert, then ban-read alone.
• [PASS] AC2 — .toSQL()-asserted upsert with no engine, carrying ON CONFLICT DO NOTHING. user-activity-day.unit.test.ts renders through a real drizzle client over a no-op D1 double and asserts insert into "user_activity_day", both columns, on conflict do nothing, and params [USER, DAY].
• [PASS] AC3 — injected capture failure leaves the session unchanged, error visible on the worker pipeline. The run is wrapped in Effect.catchCause(… Effect.logError("[pasaport.captureUserActivityDay]", …)); because feature services die infra failures via orDieAccess (db/Drizzle.ts), catchCause covers both errors and defects. The test forces call 1 to fail with DrizzleError (→ defect) and asserts (a) the returned value is the same object as the input session, (b) the tagged line is captured by an Error-level Logger.make layer. The "Sentry-surfaced" claim is grounded: worker/index.ts merges SentryEffectLive unconditionally (ADR 0118), whose SentryEffectLogger is additive to console logging.
• [PASS] AC4 — no flag or gate before the write. No config/flag read anywhere in the capture path; it executes unconditionally for any resolved session user. Matches the stated containment (exempt, founder ruling R1.2 on Week-1 survival cohort funnel on /funnel #7028).

Standing checks

• Test honesty: all tests are new; no pre-existing test touched or rewritten.
• Staleness traps: memo is keyed by UTC day bucket and re-checked every request; the fresh-read ban gate above it is untouched.
• Comment discipline: comments carry constraints code cannot show (memo-before-write rationale, R1.2 pointer) and earn their place.
• Type design: builder exported engine-free for .toSQL(); test seam (resetActivityMemoForTests) documented as such.

Deviations disclosure vs substance (#7029, comment 5384008490)

Entry	Substance in diff	Verdict
recordCaptured BEFORE the D1 write	matches Pasaport.ts: record runs synchronously before run(...)	disclosed, disposition stated
memo cap 50k with whole-map drop	matches MEMO_CAP / touchedDays.clear() in user-activity-day.ts	disclosed, disposition stated
hand-written migration 0034 off sequence	matches: 0033 is prior head, repo has no drizzle-kit journal; alchemy scans migrationsDir	disclosed, disposition stated

Nothing undisclosed that this gate could see. Known trade-off of entry 1 (a failed capture is spent until isolate restart or day rollover) is named in the disclosure itself.

Non-blocking observations (out of scope — not traceable to an acceptance criterion)

• The MEMO_CAP eviction path (whole-map drop past 50k) has no test.
• 0034_user_activity_day.sql omits the issue-reference header comment its predecessors (e.g. 0033) carry.