docs: add BB session lifecycle implementation plan

.gitignore

@@ -34,3 +34,6 @@ AI_RULES.md
 
 # Worktrees
 .worktrees/
+
+# Local database backup dumps
+db-backups/

AGENTS.md

@@ -17,22 +17,36 @@ Keep it aligned with the actual codebase, deployment model, and live Supabase sh
 
 Verified against Supabase on 2026-03-21:
 
+Active app tables:
+
 - `profiles`
 - `settings`
 - `members`
 - `marks`
+
+Legacy retained database objects from the pre-PR-13 system:
+
 - `invite_codes`
 - `audit_logs`
 
 RLS is enabled on all of those tables.
 
-Important database functions present in the live project:
+Active database functions used by the current app:
+
+- `current_app_role`
+
+Legacy retained database functions from the pre-PR-13 system:
 
 - `claim_invite_code`
 - `cleanup_old_invite_codes`
-- `current_app_role`
 - `validate_invite_code`
 
+Rules for legacy retained objects:
+
+- Do not build new features on `invite_codes`, `audit_logs`, or legacy invite-code functions.
+- Do not treat legacy retained objects as part of the active app surface, even if they still exist in the live Supabase project.
+- Keep new schema, RLS, documentation, and app code focused on the active app tables (`profiles`, `settings`, `members`, `marks`) unless the operator explicitly requests legacy cleanup work.
+
 ## Key Repository Areas
 
 - `components/`: UI and page components
@@ -93,8 +107,13 @@ Rules:
 
 - Treat the live Supabase project as the source of truth for schema and RLS.
 - Prefer MCP Supabase migrations and inspection tools for schema work.
+- Use Supabase MCP only for BB Manager database inspection, backup, restore testing, migrations, and policy changes unless the operator explicitly approves another path.
+- Do not rely on the local Supabase CLI as authoritative for this repo unless it has been explicitly validated against the same live project in the current task.
+- Before any database schema, RLS, function, trigger, or data migration change, create a full database dump in a local gitignored `db-backups/` folder using a timestamped filename.
+- Do not apply database changes until that dump has been tested by restoring it safely into a scratch database or disposable Supabase development branch.
 - Document any schema or permission change in the relevant docs.
 - Keep app code and docs aligned with the live schema names (`profiles`, `members`, `marks`), not legacy names.
+- Do not reintroduce or depend on legacy database objects removed from the active app surface in merged PR 13.
 
 ## Documentation Rules
 

docs/00-documentation-audit.md

@@ -19,3 +19,4 @@ This file tracks the active documentation set for the current codebase.
 - `docs/06-data-and-services.md`: service layer reference
 - `docs/07-hooks-and-state.md`: hook/state coordination
 - `docs/08-types.md`: shared type reference
+- `docs/11-session-lifecycle-plan.md`: planned session close, archive, sleeping-mode, and restart design