Move saved Opus 5.5 settings to Sonnet 5.5 (data migration, after #164)

.claude/skills/verify-debatelab/features/model-defaults.md

@@ -21,4 +21,4 @@ Every AI tool has a model selector. Basic accounts can pick Claude Haiku 5.5, GP
 ## Gotchas
 
 - Fake mode records the requested model but answers with fake text, and live mode rewrites every chat call to the Muse Spark contributor pin. Neither proves that OpenRouter accepts the Claude 5.5 IDs; that needs a direct OpenRouter call.
-- Existing saved choices of a model still in the catalog are kept. Only retired IDs and unsaved settings move to the new defaults, so a Pro account that saved Opus 5.5 under the old default keeps it.
+- Existing saved choices of a model still in the catalog are kept. Only retired IDs and unsaved settings move to the new defaults. Saved Opus 5.5 settings from the old Pro default are moved to Sonnet 5.5 once, by the `20261022120000_opus_default_to_sonnet.sql` data migration, not by the client.

package.json

@@ -27,7 +27,7 @@
     "start:collaboration": "tsx services/collaboration/src/index.ts",
     "test:watch": "vitest",
     "test:edge": "deno test --allow-read --allow-env=DEMO_CODE_PEPPER,STRIPE_SECRET_KEY,STRIPE_PRICE_ID,STRIPE_PRICE_LOOKUP_KEY,EXA_API_KEY,SUPABASE_URL,SUPABASE_ANON_KEY,SUPABASE_SERVICE_ROLE_KEY,SPARRING_INTEGRITY_SECRET,ELEVENLABS_API_KEY,ELEVENLABS_VOICE_ID,OPENROUTER_API_KEY,OPENROUTER_API_URL,WORKSPACE_INVITE_SECRET,WORKSPACE_INVITE_MAILER_URL,WORKSPACE_INVITE_MAILER_TOKEN,WORKSPACE_INVITE_MAILER_FORMAT,WORKSPACE_INVITE_BASE_URL,WORKSPACE_INVITE_ALLOWED_ORIGINS,WORKSPACE_INVITE_SERVICE_ROLE_KEY --allow-net=127.0.0.1 supabase/functions/",
-    "test:db": "supabase test db && bash scripts/test-daily-quota.sh && bash scripts/test-workspace-invite-concurrency.sh && bash scripts/test-workspace-mutation-concurrency.sh",
+    "test:db": "supabase test db && bash scripts/test-daily-quota.sh && bash scripts/test-opus-default-migration.sh && bash scripts/test-workspace-invite-concurrency.sh && bash scripts/test-workspace-mutation-concurrency.sh",
     "test:e2e": "playwright test --project=desktop-chromium --project=mobile-chromium",
     "test:e2e:smoke": "playwright test --project=desktop-chromium --grep @smoke",
     "test:e2e:webkit": "playwright test --project=webkit",

scripts/agent-stack.sh

@@ -87,7 +87,7 @@ case "$cmd" in
     ;;
   test)
     sb test db "$@"
-    for script in test-daily-quota test-workspace-invite-concurrency test-workspace-mutation-concurrency; do
+    for script in test-daily-quota test-opus-default-migration test-workspace-invite-concurrency test-workspace-mutation-concurrency; do
       SUPABASE_DB_URL="$(db_url)" bash "$root/scripts/$script.sh"
     done
     ;;

scripts/test-opus-default-migration.sh

@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# Runs the Opus-to-Sonnet settings migration and its rollback against seeded
+# accounts, each twice, inside one transaction that is rolled back at the end.
+# now() is fixed inside a transaction, so "changed nothing" compares row
+# versions (ctid), which every UPDATE replaces.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+database_url="${SUPABASE_DB_URL:-postgresql://postgres:postgres@127.0.0.1:54322/postgres}"
+database_password="${SUPABASE_DB_PASSWORD:-postgres}"
+
+cd "$repo_root"
+PGPASSWORD="$database_password" psql "$database_url" -qX --set ON_ERROR_STOP=1 <<'SQL'
+BEGIN;
+
+CREATE FUNCTION pg_temp.check(passed boolean, message text) RETURNS void
+LANGUAGE plpgsql AS $$
+BEGIN
+  IF passed IS NOT TRUE THEN RAISE EXCEPTION 'FAIL: %', message; END IF;
+END;
+$$;
+
+CREATE FUNCTION pg_temp.configs(p_user uuid) RETURNS jsonb
+LANGUAGE sql AS $$ SELECT feature_configs FROM public.user_settings WHERE user_id = p_user $$;
+
+CREATE FUNCTION pg_temp.model(p_user uuid, p_feature text) RETURNS text
+LANGUAGE sql AS $$ SELECT feature_configs->p_feature->>'model' FROM public.user_settings WHERE user_id = p_user $$;
+
+CREATE FUNCTION pg_temp.tool(p_model text, p_effort text DEFAULT 'medium') RETURNS jsonb
+LANGUAGE sql AS $$ SELECT jsonb_build_object('provider', 'openrouter', 'model', p_model, 'reasoningEffort', p_effort) $$;
+
+-- a: every tool on Opus (the old Pro default)
+-- b: Opus on some tools, other models on the rest, one already on Sonnet
+-- c: a retired Opus ID, which the client already maps to Opus 5.5 as a pick
+-- d: never saved
+-- e: a lapsed Basic account with Opus still saved
+-- f: a malformed scalar value
+INSERT INTO auth.users (id) VALUES
+  ('a0000000-0000-4000-8000-00000000000a'),
+  ('b0000000-0000-4000-8000-00000000000b'),
+  ('c0000000-0000-4000-8000-00000000000c'),
+  ('d0000000-0000-4000-8000-00000000000d'),
+  ('e0000000-0000-4000-8000-00000000000e'),
+  ('f0000000-0000-4000-8000-00000000000f');
+
+CREATE TEMP TABLE seeded (user_id uuid PRIMARY KEY, feature_configs jsonb NOT NULL);
+INSERT INTO seeded VALUES
+  ('a0000000-0000-4000-8000-00000000000a', (
+    SELECT jsonb_object_agg(feature, pg_temp.tool('anthropic/claude-opus-5.5'))
+    FROM unnest(ARRAY['generate', 'attack', 'brainstorm', 'factoids', 'ask', 'sparring']) AS feature
+  )),
+  ('b0000000-0000-4000-8000-00000000000b', jsonb_build_object(
+    'generate', pg_temp.tool('anthropic/claude-opus-5.5', 'high'),
+    'attack', pg_temp.tool('anthropic/claude-haiku-5.5', 'low'),
+    'brainstorm', pg_temp.tool('anthropic/claude-sonnet-5.5', 'low'),
+    'ask', pg_temp.tool('auto-pro')
+  )),
+  ('c0000000-0000-4000-8000-00000000000c', jsonb_build_object('generate', pg_temp.tool('anthropic/claude-opus-5'))),
+  ('d0000000-0000-4000-8000-00000000000d', '{}'::jsonb),
+  ('e0000000-0000-4000-8000-00000000000e', jsonb_build_object('ask', pg_temp.tool('anthropic/claude-opus-5.5', 'low'))),
+  ('f0000000-0000-4000-8000-00000000000f', '"anthropic/claude-opus-5.5"'::jsonb);
+
+UPDATE public.user_settings AS settings
+SET feature_configs = seeded.feature_configs,
+    updated_at = '2026-01-01T00:00:00Z',
+    subscription_tier = CASE WHEN settings.user_id = 'e0000000-0000-4000-8000-00000000000e' THEN 'trial' ELSE 'pro' END
+FROM seeded
+WHERE settings.user_id = seeded.user_id;
+SELECT pg_temp.check(count(*) = 6, 'six seeded settings rows')
+FROM public.user_settings WHERE user_id IN (SELECT user_id FROM seeded);
+
+-- Migration, first run.
+\i supabase/migrations/20261022120000_opus_default_to_sonnet.sql
+
+SELECT pg_temp.check(
+  (SELECT bool_and(value->>'model' = 'anthropic/claude-sonnet-5.5' AND value->>'reasoningEffort' = 'medium')
+   FROM jsonb_each(pg_temp.configs('a0000000-0000-4000-8000-00000000000a')))
+  AND (SELECT count(*) FROM jsonb_object_keys(pg_temp.configs('a0000000-0000-4000-8000-00000000000a'))) = 6,
+  'a: all six tools move to Sonnet with their reasoning effort'
+);
+SELECT pg_temp.check(
+  pg_temp.configs('b0000000-0000-4000-8000-00000000000b') = jsonb_build_object(
+    'generate', pg_temp.tool('anthropic/claude-sonnet-5.5', 'high'),
+    'attack', pg_temp.tool('anthropic/claude-haiku-5.5', 'low'),
+    'brainstorm', pg_temp.tool('anthropic/claude-sonnet-5.5', 'low'),
+    'ask', pg_temp.tool('auto-pro')
+  ),
+  'b: only the Opus tool moves'
+);
+-- A client only saves its cleanup while updated_at is unchanged since its read,
+-- so the bump is what stops an older client writing Opus back.
+SELECT pg_temp.check(
+  (SELECT bool_and(updated_at > '2026-01-01T00:00:00Z') FROM public.user_settings
+   WHERE user_id IN ('a0000000-0000-4000-8000-00000000000a', 'b0000000-0000-4000-8000-00000000000b', 'e0000000-0000-4000-8000-00000000000e'))
+  AND (SELECT bool_and(updated_at = '2026-01-01T00:00:00Z') FROM public.user_settings
+   WHERE user_id IN ('c0000000-0000-4000-8000-00000000000c', 'd0000000-0000-4000-8000-00000000000d', 'f0000000-0000-4000-8000-00000000000f')),
+  'migrated rows get a new updated_at and the rest keep theirs'
+);
+SELECT pg_temp.check(pg_temp.model('e0000000-0000-4000-8000-00000000000e', 'ask') = 'anthropic/claude-sonnet-5.5', 'e: a Basic row with Opus moves too');
+SELECT pg_temp.check(
+  (SELECT bool_and(pg_temp.configs(user_id) = feature_configs) FROM seeded
+   WHERE user_id IN ('c0000000-0000-4000-8000-00000000000c', 'd0000000-0000-4000-8000-00000000000d', 'f0000000-0000-4000-8000-00000000000f')),
+  'c, d, f: retired Opus, empty and malformed settings are untouched'
+);
+SELECT pg_temp.check(
+  (SELECT array_agg(backup.user_id ORDER BY backup.user_id) FROM private.opus_default_backup AS backup
+   WHERE backup.user_id IN (SELECT user_id FROM seeded))
+    = ARRAY['a0000000-0000-4000-8000-00000000000a', 'b0000000-0000-4000-8000-00000000000b', 'e0000000-0000-4000-8000-00000000000e']::uuid[],
+  'backup holds exactly the migrated users'
+);
+SELECT pg_temp.check(
+  (SELECT bool_and(backup.feature_configs = seeded.feature_configs AND backup.migrated_feature_configs = pg_temp.configs(backup.user_id))
+   FROM private.opus_default_backup AS backup JOIN seeded USING (user_id)),
+  'backup holds the original and the migrated settings'
+);
+
+-- A picks Opus again for one tool. A second run must not undo that or touch anyone else.
+UPDATE public.user_settings
+SET feature_configs = jsonb_set(feature_configs, '{generate,model}', '"anthropic/claude-opus-5.5"')
+WHERE user_id = 'a0000000-0000-4000-8000-00000000000a';
+CREATE TEMP TABLE before_second_run AS
+  SELECT user_id, feature_configs, ctid AS row_version FROM public.user_settings WHERE user_id IN (SELECT user_id FROM seeded);
+CREATE TEMP TABLE backup_before_second_run AS
+  SELECT * FROM private.opus_default_backup WHERE user_id IN (SELECT user_id FROM seeded);
+
+-- Migration, second run.
+\i supabase/migrations/20261022120000_opus_default_to_sonnet.sql
+
+SELECT pg_temp.check(
+  NOT EXISTS (
+    SELECT 1 FROM before_second_run AS before JOIN public.user_settings AS now USING (user_id)
+    WHERE before.feature_configs IS DISTINCT FROM now.feature_configs OR before.row_version IS DISTINCT FROM now.ctid
+  ),
+  'second migration run changes no settings, including an Opus pick made after the first run'
+);
+SELECT pg_temp.check(
+  (SELECT count(*) FROM private.opus_default_backup WHERE user_id IN (SELECT user_id FROM seeded)) = 3
+  AND NOT EXISTS (
+    SELECT 1 FROM backup_before_second_run AS before JOIN private.opus_default_backup AS now USING (user_id)
+    WHERE before.feature_configs IS DISTINCT FROM now.feature_configs
+      OR before.migrated_feature_configs IS DISTINCT FROM now.migrated_feature_configs
+  ),
+  'second migration run leaves the backup alone'
+);
+
+-- Changes after the migration that a rollback must keep: A raises one tool's
+-- effort but stays on Sonnet; B moves its migrated tool to GPT-6.1 Sol.
+UPDATE public.user_settings
+SET feature_configs = jsonb_set(feature_configs, '{brainstorm,reasoningEffort}', '"high"')
+WHERE user_id = 'a0000000-0000-4000-8000-00000000000a';
+UPDATE public.user_settings
+SET feature_configs = jsonb_set(feature_configs, '{generate,model}', '"openai/gpt-6.1-sol"')
+WHERE user_id = 'b0000000-0000-4000-8000-00000000000b';
+
+-- Rollback, first run.
+\i supabase/rollbacks/20261022120000_opus_default_to_sonnet.down.sql
+
+SELECT pg_temp.check(
+  (SELECT bool_and(value->>'model' = 'anthropic/claude-opus-5.5') FROM jsonb_each(pg_temp.configs('a0000000-0000-4000-8000-00000000000a')))
+  AND pg_temp.configs('a0000000-0000-4000-8000-00000000000a')->'brainstorm'->>'reasoningEffort' = 'high',
+  'a: every tool is back on Opus and the later effort change is kept'
+);
+SELECT pg_temp.check(
+  pg_temp.configs('b0000000-0000-4000-8000-00000000000b') = jsonb_build_object(
+    'generate', pg_temp.tool('openai/gpt-6.1-sol', 'high'),
+    'attack', pg_temp.tool('anthropic/claude-haiku-5.5', 'low'),
+    'brainstorm', pg_temp.tool('anthropic/claude-sonnet-5.5', 'low'),
+    'ask', pg_temp.tool('auto-pro')
+  ),
+  'b: a model picked after the migration and a tool already on Sonnet before it are kept'
+);
+SELECT pg_temp.check(
+  pg_temp.configs('e0000000-0000-4000-8000-00000000000e') = (SELECT feature_configs FROM seeded WHERE user_id = 'e0000000-0000-4000-8000-00000000000e'),
+  'e: restored to its original settings'
+);
+SELECT pg_temp.check(
+  (SELECT bool_and(pg_temp.configs(user_id) = feature_configs) FROM seeded
+   WHERE user_id IN ('c0000000-0000-4000-8000-00000000000c', 'd0000000-0000-4000-8000-00000000000d', 'f0000000-0000-4000-8000-00000000000f')),
+  'c, d, f: rollback leaves unmigrated users alone'
+);
+SELECT pg_temp.check(NOT EXISTS (SELECT 1 FROM private.opus_default_backup), 'rollback empties the backup');
+
+-- Rollback, second run.
+CREATE TEMP TABLE before_second_rollback AS
+  SELECT user_id, feature_configs, ctid AS row_version FROM public.user_settings WHERE user_id IN (SELECT user_id FROM seeded);
+\i supabase/rollbacks/20261022120000_opus_default_to_sonnet.down.sql
+SELECT pg_temp.check(
+  NOT EXISTS (
+    SELECT 1 FROM before_second_rollback AS before JOIN public.user_settings AS now USING (user_id)
+    WHERE before.feature_configs IS DISTINCT FROM now.feature_configs OR before.row_version IS DISTINCT FROM now.ctid
+  ),
+  'second rollback run changes nothing'
+);
+
+ROLLBACK;
+SQL
+
+echo "Opus default migration: migrate, rerun, rollback and rerun passed"

supabase/README.md

@@ -21,6 +21,7 @@ supabase/config.toml       local and function gateway configuration
 supabase/functions/        Deno Edge Functions
 supabase/functions/_shared shared auth, validation, prompts, research, and cost logic
 supabase/migrations/       ordered database history
+supabase/rollbacks/        down scripts for data migrations; never applied by db push
 supabase/tests/            pgTAP database and policy tests
 ```
 
@@ -128,6 +129,8 @@ The database gate proves migration replay and pgTAP assertions locally. It does
 
 `20260926090100_legacy_debate_cleanup.sql` defines `private.purge_legacy_debate_material`, which deletes legacy results, chats, flowcharts, sparring rounds, and sources that belong to no debate and had no activity in the 30 days before `20260926090000_current_debates.sql` recorded its rollout time in `private.current_debate_rollout`. The migration does not call it, so applying it deletes nothing; legacy rows stay in the Unsorted view. Running the purge on a remote project is a separate, destructive step that needs explicit authorization for that environment. Work created after the rollout is never touched, however late it runs.
 
+`20261022120000_opus_default_to_sonnet.sql` moves every saved Claude Opus 5.5 tool setting in `user_settings.feature_configs` to Claude Sonnet 5.5, because Opus was the Pro default and a saved row cannot tell a default from a pick. It first copies each changed row into `private.opus_default_backup` and skips users already there, so a second run changes nothing. Apply it only after the frontend that makes Sonnet the Pro default is live; otherwise an account that never saved settings still gets Opus on its first load. `supabase/rollbacks/20261022120000_opus_default_to_sonnet.down.sql` restores Opus wherever a tool still holds the Sonnet the migration wrote, and empties the backup. To roll back, copy it into `supabase/migrations` under a new timestamp. `scripts/test-opus-default-migration.sh`, part of `npm run test:db`, runs both twice against seeded rows.
+
 ## Adding an Edge Function
 
 A new function needs more than its own folder. In the same PR:

supabase/migrations/20261022120000_opus_default_to_sonnet.sql

@@ -0,0 +1,60 @@
+-- Claude Opus 5.5 was the Pro default until Sonnet 5.5 replaced it. A saved
+-- setting cannot tell a default from a deliberate pick, so every saved Opus 5.5
+-- tool setting moves to Sonnet 5.5. Opus stays selectable. Pro access depends
+-- on the clock and on Stripe rows, so this covers every account with Opus
+-- saved: Basic clients already map Pro-only models to Claude Haiku 5.5.
+--
+-- The original settings go to a backup table first. A user with a backup row
+-- is never migrated twice, so running this again cannot undo an Opus pick made
+-- after the first run. supabase/rollbacks/20261022120000_opus_default_to_sonnet.down.sql
+-- restores the backup.
+
+CREATE TABLE IF NOT EXISTS private.opus_default_backup (
+  user_id uuid PRIMARY KEY REFERENCES auth.users(id) ON DELETE CASCADE,
+  feature_configs jsonb NOT NULL,
+  migrated_feature_configs jsonb NOT NULL,
+  migrated_at timestamptz NOT NULL DEFAULT now()
+);
+
+ALTER TABLE private.opus_default_backup ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON private.opus_default_backup FROM PUBLIC, anon, authenticated;
+
+WITH targets AS (
+  SELECT
+    settings.user_id,
+    settings.feature_configs AS original,
+    (
+      SELECT jsonb_object_agg(
+        entry.key,
+        CASE
+          WHEN jsonb_typeof(entry.value) = 'object'
+            AND entry.value->>'model' = 'anthropic/claude-opus-5.5'
+          THEN jsonb_set(entry.value, '{model}', '"anthropic/claude-sonnet-5.5"')
+          ELSE entry.value
+        END
+      )
+      FROM jsonb_each(settings.feature_configs) AS entry
+    ) AS migrated
+  FROM public.user_settings AS settings
+  WHERE jsonb_typeof(settings.feature_configs) = 'object'
+    AND EXISTS (
+      SELECT 1 FROM jsonb_each(settings.feature_configs) AS entry
+      WHERE jsonb_typeof(entry.value) = 'object'
+        AND entry.value->>'model' = 'anthropic/claude-opus-5.5'
+    )
+    AND NOT EXISTS (
+      SELECT 1 FROM private.opus_default_backup AS backup
+      WHERE backup.user_id = settings.user_id
+    )
+  FOR UPDATE OF settings
+),
+backed_up AS (
+  INSERT INTO private.opus_default_backup (user_id, feature_configs, migrated_feature_configs)
+  SELECT user_id, original, migrated FROM targets
+  RETURNING user_id
+)
+UPDATE public.user_settings AS settings
+SET feature_configs = targets.migrated, updated_at = now()
+FROM targets
+JOIN backed_up USING (user_id)
+WHERE settings.user_id = targets.user_id;

supabase/rollbacks/20261022120000_opus_default_to_sonnet.down.sql

@@ -0,0 +1,42 @@
+-- Rolls back supabase/migrations/20261022120000_opus_default_to_sonnet.sql.
+-- Not a migration: `supabase db push` never reads this directory. To apply it,
+-- copy it into supabase/migrations under a new timestamp (a forward corrective
+-- migration) and ship that like any other migration.
+--
+-- A tool setting goes back to Opus 5.5 only where the migration moved it from
+-- Opus to Sonnet and it still holds Sonnet. Anything the user changed after the
+-- migration stays. Restored users leave the backup table, so a second run does
+-- nothing. The backup table itself stays; dropping it is a separate decision.
+
+WITH restored AS (
+  SELECT
+    settings.user_id,
+    (
+      SELECT jsonb_object_agg(
+        entry.key,
+        CASE
+          WHEN jsonb_typeof(entry.value) = 'object'
+            AND entry.value->>'model' = 'anthropic/claude-sonnet-5.5'
+            AND backup.feature_configs->entry.key->>'model' = 'anthropic/claude-opus-5.5'
+            AND backup.migrated_feature_configs->entry.key->>'model' = 'anthropic/claude-sonnet-5.5'
+          THEN jsonb_set(entry.value, '{model}', '"anthropic/claude-opus-5.5"')
+          ELSE entry.value
+        END
+      )
+      FROM jsonb_each(settings.feature_configs) AS entry
+    ) AS configs
+  FROM public.user_settings AS settings
+  JOIN private.opus_default_backup AS backup USING (user_id)
+  WHERE jsonb_typeof(settings.feature_configs) = 'object'
+    AND settings.feature_configs <> '{}'::jsonb
+  FOR UPDATE OF settings
+),
+updated AS (
+  UPDATE public.user_settings AS settings
+  SET feature_configs = restored.configs, updated_at = now()
+  FROM restored
+  WHERE settings.user_id = restored.user_id
+    AND settings.feature_configs IS DISTINCT FROM restored.configs
+  RETURNING settings.user_id
+)
+DELETE FROM private.opus_default_backup;