Delete AI memory client surfaces - #733
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
|
@pullfrog review |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
This PR removes the only in-app controls for AI memory while the deployed API continues default-on fact processing, and upgraded Android installs can reject queue flushes for persisted fact deletions.
Reviewed changes Initial review of the complete 68-file diff and its current orbit-api counterpart.
- AI settings deletion — Removes the AI-memory toggle and user-facts list, mutations, actions, and tests from both web and mobile.
- Shared surface cleanup — Removes the manual endpoints, schemas, types, query keys, feature-matrix row, and locale copy for memory and user facts.
- Offline cleanup — Removes the memory/fact mutation discriminants, invalidation scope, and compaction support from the Android queue.
- Compatibility tests — Adds assertions that current schemas tolerate and strip still-live API fields while the backend deletion is pending.
🚨 AI memory remains active after user controls disappear
The PR explicitly leaves the API unchanged, where AiMemoryEnabled defaults to true and chat still loads and extracts user facts. After either client updates, users with memory enabled cannot disable, inspect, or clear that processing, while the public privacy policy still says they can do so at any time in AI Settings.
Technical details
# Sequence the backend retirement before removing user control
## Affected sites
- apps/web/app/(app)/ai-settings/page.tsx:20 — the memory setting and facts management are gone from web.
- apps/mobile/app/ai-settings.tsx:32 — the same controls are gone from the installed client.
- orbit-api/src/Orbit.Domain/Entities/User.cs:19 — `AiMemoryEnabled` still defaults to `true`.
- orbit-api/src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.Context.cs:36 — enabled Pro users still load memory facts into chat context.
- orbit-api/src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.cs:163 — enabled Pro users still submit fact extraction.
- packages/shared/src/i18n/en.json:1398 — the live privacy policy promises the removed AI Settings control.
- packages/shared/src/i18n/pt-BR.json:1398 — the Portuguese policy makes the same promise.
## Required outcome
- Deploy the API behavior change first so fact loading/extraction is stopped and stored memory is retired before the client controls disappear.
- Preserve compatibility response fields and routes as stable/no-op surfaces for installed Android builds that still read or call them; do not hard-delete the contract while those builds remain supported.
- Align both privacy-policy locales with the behavior users can actually exercise.ℹ️ Product and capture registries still describe the deleted surface
FEATURES.md still advertises memory in Pro plus the AI memory and What Orbit Knows settings, and the committed surface manifest still assigns deleted files to AI Settings. These registries should be updated with the deletion rather than leaving future product and visual-evidence runs on a stale inventory.
Technical details
# Refresh deletion-dependent registries
## Affected sites
- FEATURES.md:227 — Pro still lists memory.
- FEATURES.md:243 — the removed AI-memory setting remains registered.
- FEATURES.md:246 — the removed facts-management surface remains registered.
- .claude/manifests/surfaces.json:228 — repeated AI-settings cells still list the deleted components and action.
## Required outcome
- Remove the retired client features from `FEATURES.md` while leaving API-owned tool rows to the paired API change.
- Regenerate `.claude/manifests/surfaces.json` so every `ownedFiles` entry exists at this head.GPT Sol ｜ 𝕏
There was a problem hiding this comment.
Caution
This unchanged head still removes the only AI-memory controls before the still-live API stops default-on fact processing. The prior SQLite replay finding also remains unresolved, and the Fresh Start confirmation now omits data the API still deletes.
Reviewed changes Full re-review of the current 68-file deletion and its live orbit-api counterpart at the unchanged head.
- Client surfaces Removes the AI-memory toggle, facts list, deletion actions, and associated tests from both web and mobile.
- Shared surface Removes manual endpoint constants, schemas, types, query keys, upgrade copy, and locale copy for AI memory and user facts.
- Offline persistence Removes fact mutation discriminants, the
userFactsscope, invalidation support, and queue compaction entries. - Compatibility assertions Adds tests that accept and strip the API fields that remain live until backend retirement.
- Generated architecture Regenerates the architecture artifacts after the route and module cleanup.
🚨 AI memory processing remains active after user control disappears
orbit-api still defaults AiMemoryEnabled to true, loads stored facts into chat, and submits new extraction batches, while this PR removes the disable, inspect, and delete surfaces from both clients. No paired API PR is open, and the public privacy policy still tells users they can disable memory in AI Settings.
Technical details
# Retire backend behavior before removing user control
## Affected sites
- [`apps/web/app/(app)/ai-settings/page.tsx:20`](https://github.com/thomasluizon/orbit-ui-mobile/blob/aba7fc650ebb10717f6f6af299c9af4eb32c541d/apps/web/app/%28app%29/ai-settings/page.tsx#L20) — the web client no longer exposes memory state or controls.
- [`apps/mobile/app/ai-settings.tsx:32`](https://github.com/thomasluizon/orbit-ui-mobile/blob/aba7fc650ebb10717f6f6af299c9af4eb32c541d/apps/mobile/app/ai-settings.tsx#L32) — the installed client no longer exposes them either.
- [`src/Orbit.Domain/Entities/User.cs:19`](https://github.com/thomasluizon/orbit-api/blob/71c0240b982de47c0da3038fedace47a8727fe37/src/Orbit.Domain/Entities/User.cs#L19) — new accounts still default memory on.
- [`src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.Context.cs:36`](https://github.com/thomasluizon/orbit-api/blob/71c0240b982de47c0da3038fedace47a8727fe37/src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.Context.cs#L36) — enabled Pro users still load stored facts into chat context.
- [`src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.cs:163`](https://github.com/thomasluizon/orbit-api/blob/71c0240b982de47c0da3038fedace47a8727fe37/src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.cs#L163) — enabled Pro users still submit fact extraction.
- [`packages/shared/src/i18n/en.json:1398`](https://github.com/thomasluizon/orbit-ui-mobile/blob/aba7fc650ebb10717f6f6af299c9af4eb32c541d/packages/shared/src/i18n/en.json#L1398) — the live policy promises the removed control.
- [`packages/shared/src/i18n/pt-BR.json:1398`](https://github.com/thomasluizon/orbit-ui-mobile/blob/aba7fc650ebb10717f6f6af299c9af4eb32c541d/packages/shared/src/i18n/pt-BR.json#L1398) — the Portuguese policy makes the same promise.
## Required outcome
- Deploy backend retirement first so fact loading and extraction stop before clients remove user control.
- Keep compatibility response fields and routes as stable no-op surfaces for supported installed Android builds, or use the minimum-version gate before a breaking contract deletion.
- Align both privacy-policy locales with behavior users can actually exercise.GPT Sol ｜ 𝕏
|
Pullfrog disposition for the body-level findings, addressed in b32460c:
|
|
@pullfrog review |
There was a problem hiding this comment.
Important
No new issue was introduced by b32460c, but the existing Fresh Start disclosure thread and API-first rollout concern remain unresolved, so this PR is not ready for approval.
Reviewed changes I reviewed the incremental queue compatibility, registry regeneration, and privacy-copy updates since the prior Pullfrog review.
- Preserved legacy queue replay — Validated persisted SQLite scopes against the current schema so retired
userFactsmetadata cannot reach the deleted invalidation-map entry. - Refreshed deletion registries — Regenerated the surface manifest and removed the retired AI-memory rows from
FEATURES.md. - Aligned privacy copy — Removed the now-false AI-memory-control promise from both locales while retaining the summary-control and objection language.
GPT Sol ｜ 𝕏
There was a problem hiding this comment.
Important
The current head still removes live shared contracts and gives Fresh Start an incomplete deletion disclosure.
Reviewed changes Full review of the current three-commit head, including the compatibility follow-up since the prior Pullfrog review.
- Client surface removal: Removes the AI-memory toggle, facts list, mutations, actions, copy, and tests from both web and mobile.
- Shared cleanup: Removes memory and user-fact schemas, endpoint constants, query keys, offline discriminants, and upgrade-matrix entries.
- Queue compatibility: Validates persisted mutation scopes before replay so legacy
userFactsrows no longer enter the deleted invalidation map. - Registry and policy updates: Regenerates architecture and surface artifacts, removes retired
FEATURES.mdrows, and revises both privacy-policy locales.
⚠️ Fresh Start no longer discloses all data it deletes
Fresh Start still calls DeleteAllUserDataAsync, which permanently deletes UserFacts, but this head removes that collection from the explicit will-delete list. Both clients therefore present an incomplete destructive confirmation throughout the rollout window.
Technical details
# Keep destructive confirmation aligned with current API behavior
## Affected sites
- `packages/shared/src/utils/fresh-start.ts:1-9` removes the user-facts entry from the shared deletion list rendered by both clients.
- `src/Orbit.Application/Profile/Commands/ResetAccountCommand.cs:31` still invokes full user-data deletion.
- `src/Orbit.Infrastructure/Persistence/AccountResetRepository.cs:75-78` still permanently deletes every `UserFact` for the user.
## Required outcome
- Keep the user-facts disclosure and both locale keys for as long as the deployed reset flow deletes that collection.
- Remove the disclosure only after the backend no longer stores or deletes user facts.GPT Sol ｜ 𝕏
|
@pullfrog review |
There was a problem hiding this comment.
Caution
This PR still removes the only AI-memory controls before backend processing stops, and the live-contract compatibility thread remains unresolved.
Reviewed changes I reviewed the complete three-commit deletion, its persisted-queue compatibility follow-up, the current orbit-api implementation, and the existing review threads.
- Client surfaces: Removes the AI-memory toggle, user-facts list, mutations, actions, copy, and tests from both web and mobile.
- Shared contracts: Removes memory and user-fact response fields, schemas, endpoint constants, query keys, and offline mutation discriminants.
- Upgrade compatibility: Validates persisted queue scopes so legacy
userFactsrows can drain without indexing a deleted invalidation family. - Registries and policy: Regenerates architecture and surface artifacts, removes retired feature rows, and revises both privacy-policy locales.
🚨 Memory processing outlives the user controls
The deployed API still defaults AI memory on, loads stored facts into chat, and submits new fact extraction, while this head removes the disable, inspect, and delete surfaces from both clients. The fleet-safe sequence in the author comment does not require leaving processing active: backend behavior can retire first while legacy fields and routes remain stable no-op compatibility surfaces for installed builds.
Technical details
# Retire backend behavior before removing user control
## Affected sites
- [`apps/web/app/(app)/ai-settings/page.tsx:20`](https://github.com/thomasluizon/orbit-ui-mobile/blob/b32460ca4f9e1cebc5214b5e04e988e2091508a3/apps/web/app/%28app%29/ai-settings/page.tsx#L20) — web no longer exposes memory state or controls.
- [`apps/mobile/app/ai-settings.tsx:32`](https://github.com/thomasluizon/orbit-ui-mobile/blob/b32460ca4f9e1cebc5214b5e04e988e2091508a3/apps/mobile/app/ai-settings.tsx#L32) — the installed client no longer exposes them either.
- [`src/Orbit.Domain/Entities/User.cs:19`](https://github.com/thomasluizon/orbit-api/blob/71c0240b982de47c0da3038fedace47a8727fe37/src/Orbit.Domain/Entities/User.cs#L19) — new accounts still default memory on.
- [`src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.Context.cs:36`](https://github.com/thomasluizon/orbit-api/blob/71c0240b982de47c0da3038fedace47a8727fe37/src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.Context.cs#L36) — enabled Pro users still load stored facts into chat context.
- [`src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.cs:163`](https://github.com/thomasluizon/orbit-api/blob/71c0240b982de47c0da3038fedace47a8727fe37/src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.cs#L163) — enabled Pro users still submit new fact extraction.
- [`packages/shared/src/__tests__/data-export.test.ts:175`](https://github.com/thomasluizon/orbit-ui-mobile/blob/b32460ca4f9e1cebc5214b5e04e988e2091508a3/packages/shared/src/__tests__/data-export.test.ts#L175) — the new compatibility test intentionally strips live API members instead of retaining the append-only contract.
## Required outcome
- Deploy the API behavior retirement first so fact loading and extraction stop before clients remove user control.
- Preserve legacy response members and routes as stable no-op compatibility surfaces, and retain their shared declarations until `AppConfig.MinSupportedVersion` excludes older Android clients.
- Resolve the existing live-contract review thread after the compatibility contract is restored.GPT Sol ｜ 𝕏
There was a problem hiding this comment.
Caution
The latest commit makes the published privacy policy omit AI-memory records that the current API still creates, retains, exports, and deletes.
Reviewed changes I reviewed the six-file 9de4336 delta since the prior Pullfrog review and rechecked it against the complete PR and current orbit-api behavior.
- Removed remaining references — Deleted the user-facts BFF allowlist, localized pending-operation copy, persisted-queue regression coverage, and memory-fact disclosures from both locales.
- Retained queue compatibility code — Left the persisted-scope parser in place so upgraded Android installs can still read retired SQLite metadata, but removed the test that proves it.
⚠️ Queue compatibility no longer has a regression test
9de4336 deletes the only test that seeds an upgraded SQLite row with the retired scope, while mapRow() compatibility is still required for existing Android installs. This leaves the reconnect-flush failure fixed in b32460c unguarded.
Technical details
# Restore persisted-row compatibility coverage
## Affected sites
- `apps/mobile/__tests__/lib/offline-queue.test.ts` — no remaining test injects a retired persisted scope through `storedRows` or verifies that `getAll()` strips it.
- `apps/mobile/lib/offline-queue.ts:102-123` — `mapRow()` still carries the compatibility behavior by validating persisted scopes.
- `apps/mobile/lib/offline-mutations.ts:475-586` — an invalid scope reaching `SCOPE_QUERY_KEYS` rejects post-flush invalidation.
## Required outcome
- Keep a behavioral test over the actual legacy SQLite row shape for as long as supported installed builds can have that row.
- Assert that the retired scope is removed before the row reaches flush invalidation.GPT Sol ｜ 𝕏
There was a problem hiding this comment.
Important
e830722 restores the requested queue-compatibility coverage without introducing a new issue, but it does not resolve the existing API-first rollout and live-contract concerns, so this PR is not ready for approval.
Reviewed changes I reviewed the three-file e830722 delta since the prior Pullfrog review.
- Restored persisted-scope coverage — Added a SQLite-backed queue test that verifies an invalid retired scope is stripped before replay uses the narrowed scope contract.
- Refreshed generated architecture — Regenerated both architecture artifacts and removed the deleted pending-operation translation key.
GPT Sol ｜ 𝕏
|
Product-owner disposition for the current body-level finding: the client-before-API rollout is deliberate and required for installed Android compatibility. This PR must remove every hand-written feature reference and must not add replacement UI, disclosure, privacy-policy copy, or Fresh Start copy. The live API and generated OpenAPI snapshot remain temporarily and are retired by the separately sequenced API ticket after this build clears the Play fleet. Please re-adjudicate this exact head against that explicit rollout decision. |
|
@pullfrog review |
There was a problem hiding this comment.
Important
The explicit client-first rollout decision explains the sequencing, but it does not make the transition's privacy-policy and live-contract mismatches safe.
Reviewed changes I reviewed the complete client-surface retirement, persisted Android queue compatibility, generated artifacts, policy copy, and the still-live orbit-api counterpart.
- Client surfaces — Removes the AI-memory toggle, user-facts management, actions, endpoints, query keys, copy, and tests from web and mobile.
- Queue compatibility — Validates persisted scopes so legacy Android fact mutations can replay against the temporarily retained API without breaking invalidation.
- Shared contracts — Removes memory and user-fact fields, schemas, endpoint declarations, and offline discriminants while retaining the generated live-API snapshot.
- Product records — Updates feature matrices, architecture artifacts, onboarding content, data-deletion copy, and both privacy-policy locales.
GPT Sol ｜ 𝕏
|
@pullfrog review |
There was a problem hiding this comment.
ℹ️ No critical issues in
f87f5f5; one final cleanup gap is inline.
Reviewed changes I reviewed the follow-up reference cleanup since the prior Pullfrog review.
- Updated settings copy — Replaced the remaining memory references in profile hints in both locales.
- Updated feature-guide copy — Removed memory from Astra's tool-breadth descriptions in both locales.
- Removed a dead error mapping — Deleted
USER_FACTS_LIMIT_REACHEDlocalization after confirming that the API declares but never produces that code.
GPT Sol ｜ 𝕏
|
@pullfrog review |
There was a problem hiding this comment.
Important
The client-first rollout is explicit, but the published privacy policy cannot omit a personal-data category that the live API continues to derive and store. The still-active memory-deletion confirmation also loses its Portuguese capability label.
Reviewed changes I reviewed the complete six-commit client-surface deletion, persisted Android queue compatibility, generated artifacts, policy copy, and current orbit-api behavior.
- Client surfaces: Removes the AI-memory toggle, facts list, actions, endpoints, query keys, copy, and tests from web and mobile.
- Queue compatibility: Validates persisted scopes so legacy Android fact mutations can replay without indexing the retired query family.
- Shared surface: Removes handwritten memory schemas, request types, endpoint declarations, error copy, and offline discriminants while retaining the generated API snapshot.
- Product records: Updates feature matrices, onboarding content, architecture artifacts, destructive-action copy, and both privacy-policy locales.
ℹ️ Active memory-deletion confirmations lose localization
The API still maps delete_user_facts to a fresh-confirmation operation with capability user-facts.delete, and both clients still render it. Removing that capability from the localized set makes Portuguese confirmations fall back to the API's English Delete User Facts display name.
Technical details
# Preserve localization for the still-active destructive operation
## Affected sites
- `packages/shared/src/utils/agent-pending-operation.ts:1-13` no longer recognizes `user-facts.delete` as localized.
- `packages/shared/src/i18n/en.json:870-881` and `packages/shared/src/i18n/pt-BR.json:870-881` no longer provide the matching label.
- [`AgentCatalogService.Capabilities.cs:722-735`](https://github.com/thomasluizon/orbit-api/blob/71c0240b982de47c0da3038fedace47a8727fe37/src/Orbit.Infrastructure/Services/AgentCatalogService.Capabilities.cs#L722-L735) still registers the destructive capability and its English display name.
- `apps/web/components/chat/pending-operation-card.tsx:77-79` and `apps/mobile/components/chat/pending-operation-card.tsx:99-103` fall back to that display name when no localized key exists.
## Required outcome
- Keep the confirmation name localized in both clients for as long as the API can emit this pending operation, or retire the tool before removing its client label.GPT Sol ｜ 𝕏
There was a problem hiding this comment.
Important
11fa03f introduces no new issue, but it does not address the privacy-policy or active-confirmation localization findings from the immediately preceding review, so the requested changes remain.
Reviewed changes I reviewed the three-file delta pushed during the initial review submission.
- Retired error copy: Removes the remaining
factsLimitandduplicateFactlocale entries from both languages. - Retired error mappings: Removes
USER_FACTS_LIMIT_REACHED,DUPLICATE_FACT, andFACT_NOT_FOUNDfrom the generic client error map; no current direct client callsite depends on those mappings.
GPT Sol ｜ 𝕏
|
All current-head code findings are fixed and every thread is resolved. The repeatedly reopened policy request conflicts with the explicit product-owner scope: this deletion must leave no hand-written policy, disclosure, deletion, UI, or copy reference to the retired feature. Please review the complete exact head as scoped, treat that product decision as authoritative, and do not reopen the same resolved disposition as a code defect. |
|
@pullfrog review |
There was a problem hiding this comment.
Important
11fa03f cleanly addresses the final dead-error cleanup, but an existing open Pullfrog thread remains unresolved, so this review cannot approve the PR.
Reviewed changes I reviewed the error-surface cleanup added since the prior Pullfrog review.
- Removed retired fact errors — Deleted the dead
DUPLICATE_FACTlocalization and map entry plus the obsoleteFACT_NOT_FOUNDcode mapping; surviving direct 404 handling remains localized by status.
GPT Sol ｜ 𝕏
|
@pullfrog review |
There was a problem hiding this comment.
Important
The latest cleanup is correct and focused verification passes, but the existing privacy-policy concern remains unchanged: this client publishes copy that omits AI-memory records while the live API continues deriving, storing, using, and exporting them. The product-owner rollout decision explains the sequencing, but it does not make that published description factually accurate during the compatibility window; the unresolved thread on packages/shared/src/i18n/en.json:1341 remains the actionable brief.
Reviewed changes I reviewed the complete seven-commit deletion at 11fa03f, including persisted Android compatibility, the current orbit-api behavior, and all existing review threads.
- Client surfaces — Removes the AI-memory toggle, facts UI, actions, endpoints, query keys, and product copy from both web and mobile.
- Persisted compatibility — Narrows queue contracts while validating stale SQLite scopes so supported Android upgrades can drain retired rows.
- Shared cleanup — Removes handwritten DTOs, schemas, error mappings, localization, and feature-matrix entries while retaining the generated OpenAPI snapshot.
- Verification — The affected mobile, web, and shared suites passed with 263 tests, and all three TypeScript workspace type checks passed.
GPT Sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes I reviewed the complete exact head, including the authoritative client-first rollout decision, the live API compatibility window, persisted Android queue replay, and all resolved prior review state.
- Client retirement — Removes AI-memory controls, facts management, actions, endpoints, copy, and tests from both web and mobile.
- Upgrade safety — Preserves replay of legacy SQLite queue rows by normalizing retired scopes before post-flush invalidation.
- Shared cleanup — Removes retired handwritten schemas, query keys, mutation discriminants, feature entries, and localization while retaining the generated live-API snapshot.
- Generated records — Regenerates the architecture and surface artifacts for the deleted modules and routes.
- Behavioral coverage — Updates parity tests and adds persisted-row compatibility coverage; focused mobile, web, and shared suites plus all three workspace type checks pass.
GPT Sol ｜ 𝕏
|
@pullfrog review |
There was a problem hiding this comment.
ℹ️ No critical issues; one legacy queue rough edge is inline.
Reviewed changes I reviewed the complete eight-commit client-surface retirement at the exact current head, including the rollout contract, persisted Android queue behavior, generated artifacts, and resolved prior review state.
- Client retirement — Removes AI-memory controls, user-fact management, actions, endpoints, copy, and tests from web and mobile.
- Upgrade compatibility — Validates persisted SQLite scopes so legacy queue rows remain readable while the live API drains them during the compatibility window.
- Shared cleanup — Removes retired handwritten schemas, query keys, mutation discriminants, feature entries, and localization while retaining the generated live-API snapshot.
- Generated records — Refreshes architecture and surface artifacts after deleting the feature modules and routes.
- Verification — Focused mobile offline queue and replay suites pass with 43 tests.
GPT Sol ｜ 𝕏
There was a problem hiding this comment.
Important
Persisted user-fact queue rows are still reclassified as habit mutations during replay and drop handling. The existing open compatibility thread remains actionable, so this head is not ready for approval.
Reviewed changes I reviewed the complete client retirement at 610d3d3, including the authoritative rollout decision, the still-live API counterpart, persisted Android queue replay, and all prior review context.
- Client surfaces — Removes the AI-memory toggle, facts management, actions, endpoints, query keys, copy, and tests from both web and mobile.
- Upgrade compatibility — Normalizes retired persisted queue scopes, but released retired mutation types still fall through to the
habitsscope during replay and drop notification. - Shared cleanup — Removes retired handwritten schemas, mutation discriminants, feature entries, and localization while retaining the generated live-API snapshot for the compatibility window.
- Generated records — Regenerates the architecture and surface artifacts after deleting the modules and routes.
- Behavioral coverage — Updates parity tests and adds a persisted-scope test, but the fixture does not exercise an actual retired mutation through replay or drop handling.
GPT Sol ｜ 𝕏
|
@pullfrog review |
There was a problem hiding this comment.
ℹ️ No critical issues; one producer type-boundary suggestion is inline.
Reviewed changes I reviewed the queue-compatibility follow-up added since the prior Pullfrog review.
- Preserved persisted operation identity — Kept retired SQLite mutation types as runtime strings while stripping retired scope and entity metadata during hydration.
- Corrected replay classification — Prevented retired operations from invalidating current query families, selecting current response schemas, or surfacing misleading habit-drop messages.
- Added behavioral compatibility coverage — Exercised an actual retired row shape through SQLite hydration, successful replay, and permanent rejection paths.
GPT Sol ｜ 𝕏
There was a problem hiding this comment.
ℹ️ No critical issues; one producer type boundary remains in the existing thread.
Reviewed changes I reviewed the complete exact head, including the client-first rollout decision, still-live API compatibility window, persisted Android queue replay, parity, and all prior review state.
- Client retirement — Removes AI-memory controls, user-fact management, actions, handwritten contracts, product copy, and tests from both web and mobile while retaining the generated live-API snapshot.
- Upgrade compatibility — Preserves actual released SQLite mutation types as runtime strings, strips retired metadata, and replays their still-live endpoints without assigning current invalidation scopes or misleading drop notifications.
- Producer boundary — New mutations built through
QueuedMutationBuildOptionsremain constrained, but the exportedQueuedMutationtype now leaves direct enqueue APIs open to arbitrary strings as described in the existing inline thread. - Behavioral coverage — Adds real legacy-row success and rejection coverage; 274 focused mobile, web, and shared tests passed, along with type checks for all three TypeScript workspaces.
GPT Sol ｜ 𝕏
|
@pullfrog review |
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes I reviewed the producer type-boundary follow-up since the prior Pullfrog review.
-
Restored live producer constraints — Rebound
queuedMutationSchemaandQueuedMutationtoMutationType, keeping direct queue insertion, hooks, and builders enum-constrained. -
Separated persisted replay state — Added
PersistedQueuedMutationso legacy SQLite rows retain retired string operation identities only while being hydrated, compacted, and replayed. -
Updated compatibility typing — Propagated the persisted queue type through replay internals and test mocks without changing legacy replay behavior.
-
Verified affected paths — Focused mobile and shared suites passed with 215 tests, and all three TypeScript workspaces type-check.
GPT Sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes I reviewed the complete exact head, including the explicit client-first rollout decision, the still-live API compatibility window, persisted Android queue replay, and the latest producer type-safety fix.
- Client retirement — Removes AI-memory controls, user-fact management, handwritten contracts, product copy, and tests from web and mobile while retaining the generated live-API snapshot.
- Upgrade compatibility — Preserves released SQLite operation identities for replay, strips retired metadata, and avoids assigning current invalidation scopes or misleading drop notifications.
- Producer type safety — Keeps live
QueuedMutationproducers constrained toMutationTypewhile broadening onlyPersistedQueuedMutationfor legacy hydration and replay. - Verification — The focused queue suites passed with 50 tests, both affected workspace type checks passed, and all Pullfrog review threads are resolved.
GPT Sol ｜ 𝕏
…e-ai-memory # Conflicts: # .claude/manifests/surfaces.json # architecture.html # architecture.json # packages/shared/src/__tests__/social.test.ts # packages/shared/src/__tests__/types.test.ts
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes I reviewed the 3a0bce1 merge from main since the prior Pullfrog review, including its conflict resolutions and the current full PR state.
- Reconciled concurrent deletions — Preserved the AI-memory client retirement while incorporating
main's independent social-surface deletion. - Resolved shared test conflicts — Kept profile compatibility coverage for still-live removed response fields without restoring either retired client contract.
- Refreshed generated records — Reconciled the surface manifest and architecture artifacts with the combined tree.
- Verified focused contracts — The 175 shared profile and data-export tests passed, and
@orbit/sharedtype-checks.
GPT Sol ｜ 𝕏
…e-ai-memory # Conflicts: # .claude/manifests/surfaces.json
|
1 participant
Summary
Ticket: ORB-218 (#224)
https://github.com/thomasluizon/orbit-tickets/issues/224
Product-owner rollout decision
Thomas explicitly decided that this client deletion ships first and is the fleet gate for the separate API deletion. This order is intentional: deleting or changing the server contract first would break installed Android builds that still call or parse it.
During that compatibility window, the current API can still create, store, export, and delete the retired records. This PR intentionally adds no replacement UI, disclosure, privacy-policy wording, Fresh Start wording, or other hand-written reference to the deleted feature. The server-side behavior and records are removed by the paired API ticket only after this build is live in the Play fleet and the minimum-supported-version gate has advanced past older builds.
The generated OpenAPI snapshot is the sole temporary exception because it describes the live server contract. It will disappear when the API ticket changes the source specification and regenerates the client contract.
Testing
npm run lintnpm run type-checknpm run testManual steps
Assumptions