Remove dormant user-location SSE subscription seam

[stef-k]

Problem and decision

WayfarerMobile exposes ISseClient.SubscribeToUserAsync and implements it as:

GET /api/mobile/sse/location-update/{userName}

That mobile route does not exist. Current production code has no caller of the method. Production real-time behavior is owned by:

• SseManagementViewModel -> ISseClientFactory -> SseClient.SubscribeToGroupAsync -> authenticated /api/mobile/sse/group/{groupId};
• VisitNotificationService -> ISseClientFactory -> SseClient.SubscribeToVisitsAsync -> authenticated /api/mobile/sse/visits.

Remove the unreachable user-location subscription seam. Do not implement or redirect it merely to preserve unused API surface.

Wayfarer separately exposes /api/sse/stream/location-update/{userName}. That is a distinct generic/web route backed by location-update-{userName}. It is not a mobile compatibility endpoint: it does not use the mobile caller-owned authentication model, permits only an effectively public live timeline, and revalidates public-delivery eligibility during streaming. Redirecting the mobile method there would be a new product, authentication, authorization, privacy, channel, and lifecycle decision and is forbidden by this issue.

Confirmed ownership and compatibility

At the reviewed mobile tree, tracked SubscribeToUserAsync references consist only of the interface declaration, the production implementation, tests invoking a copied TestSseClient, and that copied implementation. There is no production call through DI, XAML, reflection/dynamic invocation, factories, view models, background/lifecycle services, or platform-specific code.

Released tags 1.0.0 through 1.2.0 contain the declaration and implementation but no production caller. Removing it from the new candidate changes only locally compiled code; it does not alter already installed binaries or require a backend compatibility endpoint. The backend must remain compatible with the currently released mobile during the backend-first deployment window, and no backend change is authorized here.

Before deletion, repeat the complete tracked production call-graph search at the implementation head. If a genuine reachable production caller is found, stop: do not delete the method, and return the issue for a compatibility/security contract decision.

Required implementation

Remove only:

• ISseClient.SubscribeToUserAsync and its current XML documentation;
• SseClient.SubscribeToUserAsync and its nonexistent mobile route construction;
• TestSseClient.SubscribeToUserAsync and the three tests owned solely by its empty-name, missing-server, and URL behavior;
• use of SubscribeToUserAsync as the transport entry point in shared header tests: retain those authentication and Accept: text/event-stream assertions through an active group or visit subscription instead;
• the stale SseEventModels comment claiming location events are received from location-update-{userName}; describe the active consolidated group stream without removing the event model.

SseClientTests exercise a copied TestSseClient, not production SseClient. Keep this issue narrow: update the copy for interface compilation and preserve its useful active group/visit parsing and transport coverage, but do not convert the suite wholesale to production-linked tests unless a concrete active defect is discovered. Do not preserve tests for the nonexistent endpoint, and do not add a synthetic failing test for unreachable code.

Correct any other current comment or documentation found by the final search only when it claims that mobile subscribes through the nonexistent user-location endpoint. Preserve historical changelog truth, general location-capture documentation, valid group-location event descriptions, and valid group and visit endpoint documentation. No new changelog entry is required because this removal has no observable user behavior.

Active SSE and event preservation

The removal must not change or weaken:

• SubscribeToGroupAsync or /api/mobile/sse/group/{groupId};
• SubscribeToVisitsAsync or /api/mobile/sse/visits;
• ISseClientFactory, SseClientFactory, SseManagementViewModel, or VisitNotificationService;
• Bearer authentication and Accept: text/event-stream headers;
• ResponseHeadersRead, bounded line/event reading and parsing, cancellation, stream force-close, reconnection/backoff, permanent 401/403/404 handling, Stop, or disposal;
• group switching, event unsubscription, client replacement, and stale-subscription isolation;
• visit notification subscription, deduplication, navigation-aware presentation, and Location-synchronization polling fallback when SSE is disconnected;
• current group membership authorization, authenticated-user visit ownership, and privacy boundaries.

SubscribeToUserAsync, group subscriptions, and visit subscriptions share SubscribeAsync, ConnectAndStreamAsync, and the event parser. Remove only the dormant entry point; do not remove or refactor shared active helpers.

Keep all events and parser branches reachable from active streams:

• consolidated group SSE: LocationReceived (location and the current legacy location fallback), LocationDeleted (location-deleted), MembershipReceived (visibility-changed, member-left, member-removed, member-joined, invite-declined, invite-revoked, plus the current legacy membership fallback), and InviteCreated (invite-created);
• visit SSE: VisitStarted (visit_started);
• shared lifecycle: HeartbeatReceived, Connected, Reconnecting, and PermanentError.

Do not infer that removal of the user method permits removal of any event type, parser branch, model, or handler used by group or visit SSE.

Acceptance criteria

• A final tracked search proves no reachable production caller of SubscribeToUserAsync; findings are classified as production, declaration/implementation, copied test, mock, source-text test, current documentation, or historical reference.
• The dormant interface method and production implementation are removed with no /api/mobile/sse/location-update/{userName} claim remaining in current mobile code or documentation.
• All ISseClient implementations and mocks compile after the interface change.
• Only dead-method tests are deleted; shared transport and active group/visit parsing assertions remain meaningful and pass.
• Focused active SSE tests cover group URL, Bearer/Accept headers through an active subscription, group event parsing, visit subscription ownership, Stop/disposal, and applicable permanent-error/reconnection behavior already covered at this seam.
• Relevant SseManagementViewModel/group-management tests preserve subscription creation/replacement, event handling, and disposal behavior to the extent the current test seam supports it; do not invent a new harness to simulate unowned behavior.
• Relevant VisitNotificationService tests preserve visit subscription and disconnected-SSE polling fallback behavior.
• LocationReceived, LocationDeleted, membership/invitation events, VisitStarted, and connection lifecycle events remain available to active owners.
• Wayfarer is unchanged; no real Wayfarer, provider, or public endpoint is contacted.
• Location/Timeline upload and synchronization, cursor state, Trips, Places, Segments, Regions, Areas, groups and visits outside active SSE subscriptions, routing/Decommission public OSRM and add offline-capable Wayfarer routing #253, offline persistence, schema, and migrations are unchanged.
• Current documentation is accurate; historical changelog entries remain unchanged.

Proportionate validation

Required evidence:

1. Record the complete production call-graph search before and after removal, including production C#, Core, MAUI, XAML, DI, reflection/dynamic invocation, background/lifecycle services, platform code, tests, and current documentation.
2. Run focused SseClientTests retained group/visit transport and parsing coverage, relevant group/SSE-management tests, and VisitNotificationServiceTests.
3. Run the Release test/Core build to prove the shared interface and every implementation/mock compile.
4. Run the complete test suite because ISseClient is shared.
5. Run Code Guard over all changed code/documentation and resolve or justify every finding without exclusions, suppressions, baselines, or threshold changes.
6. Run git diff --check and inspect the final diff and working-tree state.

Android compilation is not a default requirement for this Core interface plus implementation/test/comment cleanup. Run it only if implementation changes DI, XAML, application startup/compilation ownership, platform code, project/framework/package inputs, or otherwise creates concrete MAUI compilation risk. Do not add emulator, device, browser, backend-integration, or generic API-compatibility infrastructure.

Scope exclusions

Do not:

• change Wayfarer or add /api/mobile/sse/location-update/{userName};
• redirect to /api/sse/stream/location-update/{userName};
• redesign generic or mobile SSE, event models, parsers, retries, reconnects, authentication, authorization, privacy, or lifecycle policy;
• alter Location/Timeline synchronization or cursor handling;
• change routing, Decommission public OSRM and add offline-capable Wayfarer routing #253 behavior, offline persistence, schema, or migrations;
• perform dependency, workload, SDK, package, workflow, provider, credential, database, infrastructure, packaging, installation, deployment, or publication work.

Production cleanup must remain at least as important as test cleanup. Use compile/search evidence and existing active-stream tests; do not create a new harness or expand this issue into general SSE test-suite repair.

Coordinated sequencing

• Finish legacy raster decommission cleanup across code and diagnostics #252 and Fix mobile group peer-visibility HTTP method compatibility #254 are complete; Fix mobile group peer-visibility HTTP method compatibility #254 merged through PR Fix peer visibility HTTP method compatibility #257 and mobile main was synchronized before this issue.
• Complete Remove dormant user-location SSE subscription seam #256 through implementation, independent review, exact-current-PR-head GitHub Actions test, merge, and mobile-main synchronization.
• Begin Decommission public OSRM and add offline-capable Wayfarer routing #253 Stage 1 only afterward.
• Include Remove dormant user-location SSE subscription seam #256 in the mobile candidate coordinated by Coordinate the provider migration and backend/mobile routing releases Wayfarer#505.
• Packaging, installation, deployment, and publication remain separately authorized release actions and are not part of Remove dormant user-location SSE subscription seam #256.