chore(sc-46274): retire the legacy fallback, park the experiments framework (phase 3)

[dcschreiber]

(Claude writing on Daniel's behalf)

Phase 3 of the Library Assistant opt-out rollout. The opt-out migration ran on production on Aug 10, so every profile now carries an explicit settings.library_assistant; this PR removes the legacy fallback that covered profiles without it. Replaces #3573 — per Akiva's review, the experiments framework (model, admin tooling, opt-in endpoint) stays in the codebase, parked for future experiments. Only the Library Assistant stops reading it.

⚠️ Prerequisites before this deploys (2026-08-18)

A review found that the invariant this PR rests on was false on master: SSO signups and lazily-created profiles never got settings.library_assistant. Removing the fallback would have turned the assistant off permanently for every new Google/Apple account. This was proven with a real SSO signup against the local databases, and re-proven fixed the same way after the fix. Details and evidence are in #3638.

In order:

1. fix(library-assistant): write the settings key when a profile is created #3638 merges and deploys. It makes every profile-creation path write the key.
2. The keyless profiles created since the Aug 10 migration get backfilled, as an ops step. The rule: whitelist-row value wins, no row means on.
3. This PR deploys. Master is already merged into this branch; once fix(library-assistant): write the settings key when a profile is created #3638 lands, master gets merged in one more time so this branch carries the fix.

What changes

• A profile without the setting key now reads as off. sefaria.helper.library_assistant no longer falls back to the experiments whitelist, and the in_chatbot_experiment prop is gone.

• The one-time migration script is deleted (migrate_experiments_to_library_assistant.py) — it ran on production Aug 10 and is spent. Its catch-up capability moves into the wipe script, so a straggler profile can't strand Phase 4.

• The promo banner shows to logged-out visitors only (product decision, 2026-08-11). Without this, removing the fallback would have aimed the "Try It" banner at exactly the logged-in users who had just turned the assistant off. The gate is now !Sefaria._uid, and the logged-in branch it makes unreachable — the Try It button, its join handler, and the chatbot_experiment_banner_dismissed cookie — is deleted.

• Rename: ChatbotExperimentBanner → LibraryAssistantPromoBanner. The sefaria/helper/library_assistant.py docstring records where the chatbot vs library_assistant naming line runs (vendor/wire contracts keep the chatbot name).

• Phase 4 wipe script (scripts/migrations/wipe_experiments_data.py), designed as a one-run tool — --dry-run, then the real run, with the launch-day checks baked in rather than run by hand around it:

  • names the Mongo and Postgres databases it resolved before printing any count (a run pointed at the wrong database prints numbers that look perfectly consistent);
  • backfills any profile still missing the setting key (same decision logic and write path as the retired migration: row value wins, no row means on), then hard-verifies none remain — aborting before touching anything if one does;
  • archives both stores before destroying anything: every UserExperimentSettings row and every experiments: True profile go to db.experiments_data_archive, tagged source: "row" / "profile" (False values are the serialized-on-save default and record nothing a user chose). It also reports how many True profiles have no row behind them — deleted accounts are the one known source — instead of assuming the stores mirror;
  • deletes exactly the rows it archived, and unsets profiles.experiments;
  • closes with a verification block that re-reads both stores — not its own counters — and prints PASS/WARN per check, including a warning if a row landed mid-run.

  --dry-run performs zero writes; --force is removed (post-backfill, a still-missing key means a failed write, and overriding would destroy the only record of an opt-out). Phase 4 is that one script run — no schema change, the (empty) table stays.

• The migration rollback script is deleted. Its guard made it inert the moment this PR merges. The archive collection remains as the raw record for manual repair, to be dropped after a soak window (~end of August).

• The TEMPORARY markers on the surviving experiments plumbing are reworded as "parked framework" notes, since that code is no longer scheduled for removal.

Verification

• Targeted pytest: 44/44 green at the branch tip; the broader failures reproduce identically on master (pre-existing, environmental).
• The wipe script was rehearsed end to end against a local restored dump (248k profiles): the dry run's arithmetic verified against an independently taken pre-state snapshot; the real run verified by fresh reads, not the script's output — rows deleted, fields unset, archive contents exact per uid/value/source, and the opted-out user emerging with settings.library_assistant: False; then an idempotent re-run (full no-op), a late-row catch-up (archived and deleted under a new run_id), and a straggler backfill. All checks and all in-script PASS/WARN lines came out PASS. --dry-run separately confirmed write-free (before/after snapshots identical).
• The opt-out browser suite (test(sc-46273): Library Assistant opt-out test infrastructure #3585) was merged in locally and run against this branch post-migration: 19/19, identical to its pre-migration result — the fallback removal is unobservable to users. (That suite has since dropped its promo-banner specs; the shared e2e harness suppresses banners by design, so the promo gate is asserted here, not in e2e.)
• Not run on staging or a cauldron.

Merges independently of #3585, in either order.

🤖 Generated with Claude Code

[gitvelocity-reviewer]

📊 Code Quality Score: 33/100

Base Score 55 × ESF 0.6 = 33

Category	Score	Factors
🔭 Scope	10/20	11 files across frontend JSX/JS, backend Python views/helper, tests, templates, and migration scripts; removes a cross-cutting feature flag system; no new public APIs
🏗️ Architecture	12/20	Removes two-rule fallback system simplifying architecture; eliminates cross-cutting dependency from reader.models into library_assistant.py; new migration script adds data lifecycle management; clean removal of circular-ish dependency
⚙️ Implementation	10/20	Core logic simplification (two-rule to one-rule); migration script has pre-flight checks, archiving, dry-run mode; JSX comment syntax bug (// inside JSX return) will cause build failure; banner visibility logic change is straightforward
⚠️ Risk	11/20	Removes fallback protecting unmigrated users (requires migration to have run first); rollback script now refuses to run narrowing recovery window; data deletion in wipe script is irreversible though archived; JSX syntax error risks build failure
✅ Quality	10/15	Tests updated to match new behavior with appropriate removals; good documentation in migration scripts with ordering requirements; JSX comment bug reduces quality; no new E2E tests but change is primarily a removal
🔒 Perf / Security	2/5	Removes user_has_experiments DB query from hot base_props path (minor perf improvement); archive-before-delete pattern in migration script

Was this score accurate? 👍 Yes · 👎 No

How this was scored →

_{Scored by GitVelocity · How are scores calculated?}