[TheAnswerManIsHere]

Workstream: #795

What & why

The last step of Issue #795 — Launch Phase 5 — Account and identity: the contract half of the expand-then-contract pair begun in PR #845 — Launch Phase 5, Increment 7b: remove captcha_verified and nsfw_mode_enabled from the model. That release (main at 1231526) is the first whose Drizzle model declares neither column, and it is now the published one. David published on 2026-11-03. get_publish_status reports success. The Repl's checkout is 1231526 plus Replit's empty "Published your App" deployment commit (0fd06116, git show --stat empty). grep -c of either column in its lib/db/src/schema/auth.ts prints 0. Production still holds both columns.

• lib/db/migrations/0122_drop_captcha_and_nsfw_opt_in.sql first reports, for each column that still exists, how many rows held true. Then it runs DROP COLUMN IF EXISTS on both. It is idempotent: a second run, or a run after Replit's publish has already dropped them, changes nothing. Its comment names 1231526 as the compatible published release.
• Adds the journal entry and the snapshot exemption (hand-written contract, like 0115 and 0121).
• Removes UNDECLARED_PENDING_DROP from the parity test, so model and database must agree again with no exceptions.
• phase5.nsfwReadiness now asserts that the column is gone.
• accounts-and-auth.md and decisions.md move to the past tense.

Approved-plan oracle

Oracle source: docs/plans/PLAN_PHASE5_ACCOUNT_IDENTITY.md, sha256 52a059b6fccc0836d2c5293fdf0680e0376524bcc4d293113bffb73cdfa844af (as amended in PR #833). The 7a/7b split and the 7b/7c resequencing are recorded on Issue #795.

Settled decisions this step enacts (verbatim):

• S23. "The captcha column dies in two releases. Increment 3 stops every read and write of captcha_verified — the middleware, the session blob fallback, the OAuth and local-auth row reads, the bypass logic, which moves to onboarding_completed_at — while the column still exists; Increment 7 drops it (migrations-and-backfills.md, Expand, then contract; Astra, round 1, C10)."
• S13. "The live NSFW opt-in is made unavailable. nsfwModeEnabled is removed from the profile PATCH body and the admin editor, and its consumers … pass false; the column stays until a contract step."
• Increment 7 (plan): "Contract: 0119 once Increment 3's release is the published one." The migrations were renumbered, so it is 0122. Per round 1 of PR Launch Phase 5, Increment 7b: remove captcha_verified and nsfw_mode_enabled from the model (the drop follows the next publish) #845, the compatible release is the one that dropped the declaration (7b).
• migrations-and-backfills.md: "Drop a table or column … only once the release currently published neither reads nor writes what is removed." It also says The ORM declaration is a use.

Must not change: every other users column; the classifier's parameter, which every caller passes as false; no code reads or writes either column.

Decisions taken on my recommendation

• 0122 reports the count of true rows it discards rather than copying them (decided in PR Launch Phase 5, Increment 7b: remove captcha_verified and nsfw_mode_enabled from the model (the drop follows the next publish) #845, carried out here). captcha_verified is superseded by onboarding. nsfw_mode_enabled records a choice the product withdrew, and adult content will build on adult_verified_at and the audience columns. Undo: add a copy into an archive table before the drop.
• Replit's empty publish commit on the Repl's main (0fd06116) is realigned at this PR's close-out sync, not moved to a branch. It has no file changes, so a PR would carry an empty diff. Undo: none needed, because the commit object stays in the Repl's reflog.
• /simplify not run: a migration and its follow-on edits.

Latitude granted to me: none.

Verification (head 42df2bf)

• scripts/setup-test-db.sh rebuilt the test database through 0122. Afterwards information_schema.columns returns neither column for users.
• artifacts/api-server full suite, 4 shards: result=pass, 0 not ok. lib/db 50/50, parity test included with no exemption. check-migration-snapshots ✓ (123 entries). pnpm run typecheck clean.

Post-merge verification (live environment)

1. Dev, after the Repl sync (read-only): the API server's boot log shows 0122 applied with its two [0122] NOTICE counts. information_schema.columns returns neither column for public.users. /api/healthz answers ok.
2. At David's next publish: Replit's generated migration should drop exactly users.captcha_verified and users.nsfw_mode_enabled and nothing else. If it offers any other change, cancel and tell me.

Checklist

• Docs stay true: spec and decisions log in the past tense.
• Build gate reproduced when relevant n/a
• General fix, not one example: the parity test now enforces model = database with no exemptions.
• Ship the surface n/a (no behaviour)
• Async shows status n/a
• Human decisions preserved n/a
• Migration safety: idempotent, guarded by IF EXISTS, counts reported before the drop; runs only after a compatible release is published.
• In scope: the planned contract step.

---

Generated by Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T05:03:21.118628Z	42df2bf	PR opened
🔒 Security Review	✅ Completed 2026-11-03T05:04:43.629675Z	42df2bf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.