good shout on throttling it to once an hour or per session, otherwise every page view turns into an update. last_core_action_at is a nice split too, logging in to look around vs still doing the actual job. would you build the quiet-user list off both columns, or only the core action one?

I'd build the list off the core action column and keep last_seen_at as the second signal. People who still log in but stopped doing the core job are the easiest group to win back, since they haven't left yet. Quiet on both usually needs a different message.