Slim down: cut dead features, close the core-loop hole, reconcile schema, harden AI parsing - #5
Merged
Conversation
…d auth gates Core-loop fixes: - The Learn page's Start Session recommendation now actually creates a session and opens it (the core loop was previously reachable only through full 7-day plan creation); objective ids reuse mastery keys so spaced repetition stays continuous - Worked examples get a plan-template block on day 1 (first exposure) - Completing a session finally awards XP (previously only flashcard reviews moved the daily goal, nudging toward card grinding over retrieval) - The calibration dashboard survives page reloads (refetches the completed run's attempts) - Reschedule missed sessions button on the plan page (preview diff + apply), giving ~900 lines of tested reflow logic its missing UI - JSONB metric reads spread defaults so malformed rows can't produce NaNs Cuts (verified dead or placebo): - Web push stack (nothing ever sent one), service worker, VAPID setup burden - Email reminder pipeline (nothing scheduled AND nothing processed; settings advertised reminders that never sent an email) — auth emails kept - Leaderboard of one user plus the onboarding display-name step that existed only to name yourself for it - Practice-sets and evidence CRUD routes (curl-only, data never consumed) - start.bat (killed every Node process on the machine) - OFFICE_HOURS_PREP mode (declared everywhere, implemented nowhere) - Dead asset pipeline (Button/Icon had zero importers) and 46 packages (web-push, sharp, svgo, fast-glob); dotenv declared explicitly Auth gates (the family behind every past lockout): - Email verification sign-in gate now behind REQUIRE_EMAIL_VERIFICATION, default off (single user; the console provider cannot deliver links) - X-User-Id header trust only under ALLOW_TEST_AUTH (dev sessions can no longer silently split data across phantom localStorage identities) - Clients no longer send identity headers anywhere; cookies carry auth; e2e specs authenticate via Playwright context headers instead - Onboarding copy now points at the Plan page where upload actually lives Verified: tsc clean; 598 unit tests passing.
Settings drops the leaderboard toggle, display name field, and the entire notifications section (push/email are gone from the product). Google sync shows a not-configured note instead of a dead button when GOOGLE_CLIENT_ID is unset. Flashcards and guides empty states route to /plan. Verify-email explains dev mode prints links to the server console; the console email provider prints full untruncated URLs. setup.mjs checks Node >= 20.19 and reminds about mock AI mode at the end. .env.example loses VAPID keys and documents REQUIRE_EMAIL_VERIFICATION (default off).
Schema: removes PushSubscription, ScheduledReminder, PracticeSet, and PracticeQuestion models now that their features are gone. Migration 20260716030000_slim_and_reconcile drops the four tables and fixes drift that made migrate deploy diverge from the schema: six foreign keys created RESTRICT but declared Cascade, a stray DEFAULT '' on session_error_logs.user_id, four indexes that were never migrated, and a flashcards (deck_id, ordinal) unique index with a ROW_NUMBER dedupe pass first. CI now runs prisma migrate deploy instead of db push --force-reset so the migration history is what gets tested. AI hardening: feedback, prompt generation, and worked examples now validate provider output field by field. Malformed strings are dropped instead of persisted, prompt sets with fewer than three valid items fall back to deterministic generation, and worked example sets require complete steps and completion problems. The mock provider returns realistic canned prompts, feedback, and worked examples so mock mode exercises real parsing, with malformed variants available for tests. Plans now fire an anchor build after creation so feedback has warm objective anchors before the first session; failures fall back to FTS. Account export and delete no longer reference the dropped tables.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Full slim-down pass from the audit: remove everything that looked like a feature but could not deliver, fix the holes that made the core loop unreachable or fragile, and make setup honest and repeatable.
Cut (about 3,600 lines and 46 npm packages)
Fixed
Auth gates flagged off
Schema reconciliation
prisma migrate deployinstead ofdb push --force-reset, so the migration history itself is what gets tested. Validated from zero and against data-bearing databases.AI output hardening
Setup and docs
Verification
tsc --noEmitcleanGenerated by Claude Code