fix(migrations): resolve the #548/#549 collision that made the digest timezone fix inert (#563)

#548 (keyset pagination for get_daily_digest_candidates) and #549 (the
tenant-local streak-nudge comparison) were developed in parallel and landed
within hours of each other. Each merged cleanly on its own; together they left
master in a state neither PR was reviewed in.

Two problems.

1. Duplicate migration version. Both `daily_digest_candidates_pagination` and
   `league_rollover_catchup_and_bands` were stamped 20260726140000, so a fresh
   `db reset` would try to record two rows under one primary key. The league
   migration is independent of everything around it, so it moves to
   20260726140500 rather than reordering anything.

2. The #549 digest fix was inert. #548 replaced the zero-argument function with
   a three-argument keyset-paginated one, and explicitly DROPped the zero-arg
   version because an overload makes a zero-arg call ambiguous (PostgREST 300).
   #549's migration then re-created that zero-arg function. Because it sorts
   after #548's, a fresh reset ended up with both: the cron passes three named
   arguments so it kept resolving to the paginated definition, which still
   carried the `= CURRENT_DATE - 1` UTC comparison #549 exists to remove — while
   #549's own function sat unused. The bug was live and the fix looked applied.

The #549 migration now replaces the paginated signature, carrying #548's cursor
and ORDER BY over verbatim, so one function has both fixes.

Verified by applying both migrations in file order inside a rolled-back
transaction: exactly one `get_daily_digest_candidates(uuid,uuid,integer)`
survives, it contains `>= CURRENT_DATE - 2`, and it retains `_after_tenant_id`.
502/502 unit tests and typecheck green.

Cloud was already patched directly against the live paginated definition, so it
has been correct throughout; this brings the repo in line with it.


Claude-Session: https://claude.ai/code/session_01RGCEptT7pgWwRiMdB3TUCM

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: guillermoscript

supabase/migrations/20260726140100_digest_candidates_local_day.sql

@@ -1,6 +1,6 @@
 -- =============================================================================
 -- Daily digest candidates: stop pre-filtering streak risk on the UTC day
--- Issue #549 §3 (epic #540). Fixes 20260714150000_daily_digest.
+-- Issue #549 §3 (epic #540).
 --
 -- The streak-at-risk branch tested `gp.last_activity_date = CURRENT_DATE - 1`,
 -- i.e. UTC yesterday, while the send decision and the idempotency key in
@@ -20,11 +20,24 @@
 -- isStreakAtRisk(), which does know the timezone. Rows that turn out not to be
 -- at risk are dropped there before anything is sent.
 --
+-- IMPORTANT — this replaces the KEYSET-PAGINATED signature introduced by
+-- 20260726140000_daily_digest_candidates_pagination.sql (issue #548), not the
+-- original zero-argument one. #548 and #549 were developed in parallel and this
+-- file originally re-created the zero-arg function, which would have (a) added
+-- back the overload #548 deliberately dropped — a zero-arg call against both
+-- candidates is ambiguous and PostgREST answers 300 — and (b) left the
+-- three-argument definition the cron actually calls still carrying the UTC bug,
+-- making this fix inert. The pagination logic below is carried over verbatim.
+--
 -- award_xp()'s own day boundary is deliberately NOT changed here: it would
 -- shift every existing streak. See the note on isStreakAtRisk().
 -- =============================================================================
 
-CREATE OR REPLACE FUNCTION public.get_daily_digest_candidates()
+CREATE OR REPLACE FUNCTION public.get_daily_digest_candidates(
+    _after_tenant_id uuid DEFAULT NULL,
+    _after_user_id uuid DEFAULT NULL,
+    _limit integer DEFAULT 500
+)
 RETURNS TABLE (
     tenant_id uuid,
     user_id uuid,
@@ -76,14 +89,23 @@ AS $$
         COALESCE(rc.due_count, 0) > 0
         OR COALESCE(sg.pending_count, 0) > 0
         -- Superset of "streak at risk" across all tenant timezones; the exact
-        -- local-day comparison happens in isStreakAtRisk().
+        -- local-day comparison happens in isStreakAtRisk(). Was
+        -- `= CURRENT_DATE - 1` (issue #549 §3).
         OR (COALESCE(gp.current_streak, 0) >= 3
             AND gp.last_activity_date >= CURRENT_DATE - 2)
-      );
+      )
+      -- Keyset cursor from issue #548, carried over unchanged.
+      AND (
+        _after_tenant_id IS NULL
+        OR (tu.tenant_id, tu.user_id)
+             > (_after_tenant_id, COALESCE(_after_user_id, '00000000-0000-0000-0000-000000000000'::uuid))
+      )
+    ORDER BY tu.tenant_id, tu.user_id
+    LIMIT LEAST(GREATEST(COALESCE(_limit, 500), 1), 1000);
 $$;
 
 -- Service-role only: the function reads auth.users and crosses tenants.
-REVOKE ALL ON FUNCTION public.get_daily_digest_candidates() FROM PUBLIC;
-REVOKE ALL ON FUNCTION public.get_daily_digest_candidates() FROM anon;
-REVOKE ALL ON FUNCTION public.get_daily_digest_candidates() FROM authenticated;
-GRANT EXECUTE ON FUNCTION public.get_daily_digest_candidates() TO service_role;
+REVOKE ALL ON FUNCTION public.get_daily_digest_candidates(uuid, uuid, integer) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.get_daily_digest_candidates(uuid, uuid, integer) FROM anon;
+REVOKE ALL ON FUNCTION public.get_daily_digest_candidates(uuid, uuid, integer) FROM authenticated;
+GRANT EXECUTE ON FUNCTION public.get_daily_digest_candidates(uuid, uuid, integer) TO service_role;