chore: P7 KEEP leftover scan after upgrade→Core

[Drswith]

Summary

Post-P6 P7 leftover scan after upgrade→Core (#711) and OpenSpec archive (#712). Import-graph proof that no src/services, src/self, compatibility, or upgrade wrapper became zero-reference or a pure pass-through when plan/check/apply orchestration moved to src/core/self-upgrade-executor.ts. Delete none. Keep every still-imported module and every bridge that still adds differential behavior (CLI context, port injection, domain planning/providers/binary/lock).

Intake: mechanical leftover scan / no observable behavior — no new OpenSpec change.

DELETE vs KEEP

Module	Result	Proof
src/self/application.ts	already DELETED in P6	Relocated to src/core/self-upgrade-executor.ts. Ownership test asserts the path is gone.
src/core/self-upgrade-production.ts	not present	Would import src/self and fail the Core boundary. Ownership test asserts the path is gone.
src/services/self-upgrade.ts	not present	No leftover services shim.
src/services/index.ts re-export of self-upgrade-production	already DELETED in P5	Barrel still publishes only v1 agents + update planning. upgrade.ts imports production directly.
src/services/self-upgrade-production.ts	KEEP	Differential: CLI context, cancellation, runtime ports, src/self plan/upgrade/lock/persistence binding into Core. Importer: src/commands/upgrade.ts.
src/core/self-upgrade-executor.ts	KEEP	In-repo Core engine (plan/check/apply). Not published on quantex-core. Must stay free of src/self.
src/commands/upgrade.ts	KEEP	Thin projector; frozen JSON/human/error mapping. Does not call Core directly.
src/self/index.ts	KEEP	Domain barrel: planSelfUpgrade / upgradeSelf plus lock/planning/facts/release. Published v1 subset via src/compatibility/index.ts.
src/self/planning.ts	KEEP	Domain planning. Importer: src/self/index.ts.
src/self/facts.ts	KEEP	Domain install-source facts.
src/self/lock.ts	KEEP	Domain lock; production injects createSelfUpgradeLockPort into Core ports.
src/self/binary.ts	KEEP	Domain binary replacement. Importer: src/self/providers/binary.ts.
src/self/providers/**	KEEP	Domain providers (bun / npm / binary / source).
src/self/state-persistence.ts	KEEP	Persistence port; production binds it into Core.
src/self/{recovery,registry,release,types,update-metadata,update-notice}.ts	KEEP	Still referenced (CLI, planning, doctor, command-runtime).
src/services/index.ts remaining agents + update re-exports	KEEP	Importer: src/compatibility/index.ts (published CLI surface).
src/services/lifecycle-*-production.ts / doctor-diagnosis-production.ts	KEEP	Differential CLI→Core bridges (P2); not upgrade leftovers.
src/core/{installation,update}-compatibility.ts / *-production.ts / production-observation.ts	KEEP	Differential Core ports / compatibility (P2).
src/compatibility/{index,agent-inspection}.ts	KEEP	Published v1 facade + inspection projector.
src/lifecycle/**	KEEP	Still imported by Core uninstall/update/execution (P1/P5).
src/commands/unmanaged-install-compatibility.ts	KEEP	Frozen v1 no-op for unmanaged externals.

DELETE: none (0 zero-reference modules and 0 pure pass-through wrappers after #711).

Same-file helpers that look unused from outside stay: they are live internals, not leftover bridges. Unused named type re-exports on the lifecycle barrel are unchanged (not P6 leftovers; barrel itself is still imported).

Freeze confirmation

• Structured codes from fix(upgrade): return NETWORK_ERROR when latest version cannot be resolved #700: NETWORK_ERROR, MANUAL_ACTION_REQUIRED
• Aliases: command name upgrade only; binaries qtx / quantex
• --json envelope and data fields unchanged
• --json does not expose engine / route
• --check, --channel, dry-run, exit codes, state v2 untouched
• Published SDK has no upgrade() method
• YAML / release-core.yml / protect-main untouched
• Shelved OpenSpec changes untouched (release-one-line-delivery, release-pr-skip-human-heuristics, windows-ci-advisory-merge-gate)
• Did not fold config / capabilities / commands / schema

Linked Artifacts

• OpenSpec: not required - mechanical leftover scan / no observable behavior (intake classification)
• Discussion: post-P6 cleanup P7 (after refactor(upgrade): route plan/check/apply through in-repo Core (P6) #711 / chore(openspec): archive cli-core-upgrade-p6 #712)

Validation

• bun run memory:check
• bun run lint
• bun run format:check
• bun run typecheck
• bun run test — targeted 5 files / 44 passed; full suite 175 files / 2128 passed / 5 skipped
• bun run openspec:validate
• Manual freeze smoke: upgrade --json --check / --channel / dry-run → MANUAL_ACTION_REQUIRED on source install, data.channel matches, no engine/route
• Local classify: run_test_matrix=true / product-impacting

Release Intent

• Release: not applicable - internal leftover scan with no behavior change (KEEP comments + ownership lock only)

Release Summary

• Not applicable - this source PR does not produce a release entry.

Docs Updated

• Not needed for product README (KEEP comments + ownership lock only)

Scope Check

• I did not add a new ad hoc root-level Markdown file.
• I documented KEEP/DELETE inventory in this PR.
• I did not silently expand into YAML / SDK expansion / folding config/capabilities/commands/schema.

Closure Check

• Working tree was clean after commit.
• Branch was pushed and this PR is the active delivery artifact (draft).
• OpenSpec change not required (mechanical).
• Release is not applicable.

Notes

• Investigate-first: file-level scan found zero unused src/ modules after P6 deleted src/self/application.ts.
• Differential layers from P2/P6 remain; same KEEP rule.
• Product-path KEEP comments under src/ keep classify on the full ubuntu/windows/macos test matrix (protect-main unchanged).
• Draft kept after CI (requested as draft — do not mark ready).