feat(admin): the Growth panel — arrival, activation funnel, plan mix, campaign (PR1)

[unforced]

A new operator page at /admin/growth answering "what is happening with Parachute users — how many people are using it, how are they using it" in counts, cohorts, and buckets. PR1 reads EXISTING tables only — zero migrations, no new collection — so the free-3-months push is measurable from the hour Monday's announcement goes out.

What lands

Card	Reads	Shows
Arrival	users.created_at	signups 7d / 30d / week-over-week tiles + a 12-week sparkline (inline SVG <polyline>, no JavaScript)
Activation funnel	vaults, user_checklist, vault_usage, tokens, grants, sessions	five stages × two cohorts (0–14d, 14–44d), horizontal bars with count + %
Plan mix + trial pipeline	users	accounts per plan; trials ending ≤7d, subscribers vs comps, scheduled churn
Campaign	promo_redemptions (migration 0016)	redemptions per code per UTC day + all-time totals

Two cohorts exist so a week-2 number is only ever read off accounts old enough to have one — the 0–14d cohort's week-2 stage renders grayed "too young" rather than as a misleading zero.

Two rules the code enforces rather than states

Privacy. Every query on this page returns counts only — no email, no user id, no vault name, not even transiently. Per-account rows stay in /admin/users and /admin/vaults, where comp and suspend actually need a person. Pinned by a real negative test: given seeded users whose addresses are renderable (the positive control finds all three on /admin/users), the Growth page's HTML matches no email-shaped string at all. The privacy footer renders verbatim and its text is pinned as a constant.

Honesty. Several numbers are proxies over data collected for other reasons, so each renders beside a "how measured" line naming its blind spot:

• byte-growth misses a day-0 write that vanished before the first rollup, and anything written+deleted between two rollups;
• 90-day sliding session cookies and long MCP refresh cycles mean the week-2 return signal under-counts — read it as "at least this many";
• no acquisition-source data exists anywhere in the schema. The page can say WHEN someone arrived and never WHERE FROM. If that matters for the launch it needs a deliberate collection decision first.

Funnel stages are measured independently, not nested (someone can connect an AI before writing anything), so a later bar may exceed an earlier one. The page says so next to the bars.

Two places the design met the real schema and the schema won

connected AI reuses drip.ts's CONSOLE_CLIENT_ID and is the exact inverse of the day-3 connect-nudge eligibility query — the nudge and the bar can never disagree about what "connected an AI" means.

scheduled churn EXCLUDES trials. The design specified pending_plan='expired'. That flag is the 30-day trial clock — users.ts createUser writes it on every fresh signup — so counting it unqualified would just re-report the trial cohort. Restricted to non-trial accounts it means what it says: a paid or comped account with a downgrade on the books. Called out on the card itself.

The activation-funnel SQL (please check the proxies)

workers/identity/src/admin-growth.ts:150 — one grouped query, both cohorts, SUM(CASE WHEN … END) per stage over one users scan:

SELECT
  CASE WHEN u.created_at >= ?1 THEN 'young' ELSE 'mature' END AS cohort,
  COUNT(*) AS signed_up,
  SUM(CASE WHEN EXISTS (SELECT 1 FROM vaults v WHERE v.owner_user_id = u.id) THEN 1 ELSE 0 END) AS created_vault,
  SUM(CASE WHEN
    EXISTS (SELECT 1 FROM user_checklist c WHERE c.user_id = u.id AND c.item IN ('write-note', 'import-notes'))
    OR EXISTS (
      SELECT 1 FROM vaults v2 WHERE v2.owner_user_id = u.id
        AND COALESCE((SELECT vu.db_bytes + vu.r2_bytes FROM vault_usage vu WHERE vu.vault_name = v2.name ORDER BY vu.day DESC LIMIT 1), 0)
          - COALESCE((SELECT vu2.db_bytes + vu2.r2_bytes FROM vault_usage vu2 WHERE vu2.vault_name = v2.name ORDER BY vu2.day ASC LIMIT 1), 0)
          > ?4
    )
  THEN 1 ELSE 0 END) AS has_content,
  SUM(CASE WHEN
    EXISTS (SELECT 1 FROM tokens t WHERE t.user_id = u.id AND t.client_id <> ?5)
    OR EXISTS (SELECT 1 FROM grants g WHERE g.user_id = u.id AND g.client_id <> ?5)
  THEN 1 ELSE 0 END) AS connected_ai,
  SUM(CASE WHEN
    EXISTS (SELECT 1 FROM sessions s WHERE s.user_id = u.id
              AND s.created_at >= strftime('%Y-%m-%dT%H:%M:%fZ', u.created_at, '+7 days')
              AND s.created_at <  strftime('%Y-%m-%dT%H:%M:%fZ', u.created_at, '+14 days'))
    OR EXISTS (SELECT 1 FROM tokens t2 WHERE t2.user_id = u.id
              AND t2.created_at >= strftime('%Y-%m-%dT%H:%M:%fZ', u.created_at, '+7 days')
              AND t2.created_at <  strftime('%Y-%m-%dT%H:%M:%fZ', u.created_at, '+14 days'))
    OR EXISTS (SELECT 1 FROM vault_usage vu3
                 JOIN vaults v3 ON v3.name = vu3.vault_name
               WHERE v3.owner_user_id = u.id
                 AND vu3.day >= date(u.created_at, '+7 days')
                 AND vu3.day <  date(u.created_at, '+14 days')
               GROUP BY vu3.vault_name
               HAVING MAX(vu3.db_bytes + vu3.r2_bytes) > MIN(vu3.db_bytes + vu3.r2_bytes))
  THEN 1 ELSE 0 END) AS returned_week2
FROM users u
WHERE u.created_at >= ?2 AND u.created_at < ?3
GROUP BY cohort

Binds: ?1 = now−14d, ?2 = now−44d, ?3 = now (future-dated rows stay out), ?4 = CONTENT_GROWTH_BYTES (8 KiB), ?5 = CONSOLE_CLIENT_ID.

strftime('%Y-%m-%dT%H:%M:%fZ', …) reproduces Date.toISOString() byte-for-byte (the migration-0018 pattern), so the per-account week-2 window bounds compare correctly as plain text against stored ISO strings; date(…) is used against vault_usage.day, which is a bare YYYY-MM-DD. Verified against real D1 under workerd before the query was built on it.

Wiring

• workers/identity/src/index.ts:305 — app.get("/admin/growth", …), registered with the other /admin routes.
• workers/identity/src/admin.ts:56,68 — notFound + operatorFor are now exported; the new page reuses them rather than re-implementing the boundary, so the 404-not-403 posture cannot drift between admin pages.
• workers/identity/src/admin-ui.ts:16,42 — ADMIN_STYLE + adminHeader exported, nav union gains "growth".
• route-manifest.ts unchanged — /admin in CEREMONY_PREFIXES already covers the sub-path (the 83-test drift catcher passes).
• No file touched by the in-flight email redesign (feat(email): the Parachute email redesign — brand-true transactional templates #215) — drip.ts is imported, never modified.

Gates

Gate	Verdict
identity vitest (38 files, per-file)	1039 passed, 0 failed — incl. admin-growth.test.ts 14/14, admin.test.ts 19/19, route-manifest.test.ts 83/83
workers/identity typecheck	clean
root bun run typecheck	clean
root bun test src test-bun	167 pass, 0 fail (533 expect calls, 18 files)

The suite was run per-file: a whole-suite run exhausted local ephemeral ports (~4900 TIME_WAIT → EADDRNOTAVAIL), which is a sandbox limit, not a code failure — every file passes on its own. CI runs it whole.

Version: main is rc.122 and rc.123 is claimed by the in-flight email redesign (#215), so this bumps to rc.124.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XLZtmuSs1RirWGMGyCB1QB

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

[unforced]

Review fixes folded in — 5e977a8, plus main merged in 91cf287

All four must-fixes were verified against the source before changing anything; every one reproduced as described.

#	Fix	Where
1	Paying subscribers now ANDs the paid tiers (bound, not inlined) — was counting EVER-subscribed	admin-growth.ts:299 (query), :271-290 (why), admin-growth-ui.ts:216 (copy)
2	Has content copy now names the checklist over-count (a row records a click, not a write)	admin-growth-ui.ts:194, admin-growth.ts:41,160
3	…and that the byte branch is blind to a vault's entire first rollup, permanently	admin-growth-ui.ts:194, admin-growth.ts:33
4	Trial duration interpolated from TRIAL_DURATION_DAYS	admin-growth-ui.ts:20,216

On #1 — confirmed the write-once claim exactly: the only writer is billing-lifecycle.ts:240, and promo.ts:36 documents "a CHURNED subscriber falls back to the expired floor keeping a stale stripe_subscription_id (the sweep never clears it)". Now pinned by a test that seeds a churned account and asserts it doesn't count — I mutation-checked it by reverting the query, and it fails as intended (expected … to contain 'paid plan + live subscription' with the count at 2). Mid-cancellation accounts still count, correctly: they're paid through the period.

On #2 — I looked for a real signal to AND against and there isn't one; the byte branch is the other half of the union, so ANDing would collapse the metric. Copy fix, deliberately, and the funnel test now pins both directions of the caveat.

On #4 — I extended the same treatment to the two other rendered duration literals on that card, since it's the identical failure mode one line away: session TTL now derives from SESSION_TTL_MS and the refresh cycle from REFRESH_TOKEN_TTL_MS. A test derives its expectations from all three constants, so ag-trial-90-days landing will move this page automatically rather than silently falsifying it.

Both cheap ones done. The privacy test now pins vault names absent (user-chosen free text identifies a person as well as an address does) with /admin/vaults as the positive control proving they're renderable. promo.ts:146 was a genuine one-liner — it now binds promo.code from the validated row, so the one stored string the Growth page reads back out has structural rather than incidental provenance.

Not done, per your instruction: the tokens(user_id) index migration (PR1 stays zero-migration) and the scheduled-churn comp-expiry label nuance.

Rebase note

#215 merged as rc.123 while I was working, exactly as this PR predicted, so rc.124 stands — no renumber needed. I merged origin/main in rather than rebasing, so the SHAs you already verified (316d9d5, 5e977a8) remain intact and citable. The only conflict was the package.json version line. Re-verified CONSOLE_CLIENT_ID is still exported from the redesigned drip.ts — the funnel's "connected AI" inverse still binds to it.

Gates (post-merge, on 91cf287)

• identity vitest: 1041 passed, 0 failed across 38 files — admin-growth 16/16, admin 19/19, drip 24/24, promo 25/25, console 87/87, route-manifest 83/83
• identity + root typecheck: clean · root bun test src test-bun: 167 pass, 0 fail
• GitHub CI on the merged head: all three jobs pass · PR is MERGEABLE / CLEAN

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com