Area: mobieusAI (audit p11) · Surface: POST /api/ai/thread-summary/{id} · Dimension: dead-code · Severity: minor
AiController@summarizeThread / /api/ai/thread-summary/{id} is the original ungated thread summarizer, superseded by the per-tenant-flag + spend-cap gated MemberAIController@summarizeThread at /api/ai/forum/summarize. The forum thread template fetches the MemberAI path, not this one. Same supersession pattern as suggestTags: parallel old endpoint left registered with no surface.
Evidence
`grep -rn "api/ai/thread-summary" --include="*.php" --include="*.js" --include="*.html" .` returns only the route registration (src/routes.php:1094) and the controller's own docblock (src/Controllers/AiController.php:33). No client (template/JS) caller exists.
The live thread-summary feature instead routes through the flag-aware MemberAI path: templates/forums/thread.php:809 comment ("... through the flag-aware MemberAI summarizer (/api/ai/forum/summarize) ...") and the actual fetch at templates/forums/thread.php:842: `fetch('/api/ai/forum/summarize', {...})` → MemberAIController@summarizeThread (src/routes.php:1125).
Suggested fix. Delete the route registration at src/routes.php:1094 and remove the summarizeThread() method from src/Controllers/AiController.php (lines 37-58).
Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.
Patrick Bass
@mobieus