chore: S1 KEEP leftover scan for thick-area zero-ref

[Drswith]

Summary

Post-L5 S1 leftover scan of thick areas L5 did not cover: src/agents, src/providers, src/package-manager, src/utils, src/agent-update, src/runtime, plus related leftover barrels (src/planning, src/inspection, src/state.ts, src/errors.ts, src/cli-context.ts, src/output). Import-graph proof that every scanned module still has a production importer and still adds differential behavior. Delete none. Keep every still-imported module and every bridge that still adds differential behavior.

Intake: mechanical leftover scan / no observable behavior — no new OpenSpec change. Folding published v1 barrels, config / capabilities / commands / schema, or restoring src/lifecycle/ would be architecture-boundary work and would need OpenSpec; this PR documents that those folds are not safe.

DELETE vs KEEP

Module	Result	Proof
src/lifecycle/	already DELETED in L4	Ownership tests assert the directory is gone. Do not restore.
src/core/lifecycle/index.ts	KEEP absent	No Core lifecycle barrel (ADR 0011–0014).
src/self/application.ts / src/services/self-upgrade.ts / src/services/lifecycle-updates.ts / src/services/lifecycle-execution.ts	already DELETED	P2/P6 leftovers stay absent.
src/agents/index.ts	KEEP	Catalog lookup (getAllAgents / getAgentByLookupName). getAgentByNameOrAlias is the published v1 name. Generated catalog + withdrawn named exports stay on this barrel.
src/agents/{types,catalog,schema,superseded}.ts	KEEP	Types, catalog parse, Zod schema, superseded-package migration. Live importers.
src/agents/generated/*	KEEP	Generated catalog data/named exports. Importers: catalog + agents barrel.
src/agents/withdrawn/index.ts	KEEP	Frozen v1 named exports (deepcode / genie / jcode / vtcode). Not catalog members. Folding would change the published root surface.
src/providers/index.ts	KEEP	Domain barrel (registry / invoke / types). 31 production importers.
src/providers/{types,registry,first-party,invoke,internal-operation-context}.ts	KEEP	Shared provider contract, registry, first-party map, dispatch, output policy. Differential.
src/providers/adapters/{brew,bun,cargo,deno,mise,npm,pip,uv,winget}.ts	KEEP	First-party adapters over package-manager mutation. Importers: first-party.ts + installers.ts.
src/providers/adapters/{registry-package,system-package,install-effect,pending-operation}.ts	KEEP	Adapter factories + cancel/timeout race. Not pass-throughs.
src/package-manager/index.ts	KEEP	Install/update/uninstall orchestration, lifecycle lock, state persistence. Not a leftover of providers or Core.
src/package-manager/capabilities.ts	KEEP	Live-registry capability snapshot. Published v1 via compatibility. Do not fold src/commands/capabilities.
src/package-manager/managed-install-types.ts	KEEP	Frozen hardcoded managed-type list for state v2 schema. Differential from the live registry; src/state must not depend on providers.
src/package-manager/{installers,context-mutation,mutation-outcome,binary}.ts	KEEP	Typed installer map, mutation interruption mapping, CLI context wrapper, unmanaged binary install.
src/package-manager/{brew,bun,cargo,deno,mise,npm,pip,uv,winget}.ts	KEEP	Installer implementations used by provider adapters, installers.ts, and Core installation-provider-registry.
src/utils/install.ts	KEEP	Formatting + package-name helpers. Named capability re-exports are convenience for existing callers, not a leftover wrapper to fold.
src/utils/exec.ts	KEEP	Published v1 execCommand. Thin CLI stdio wrapper, frozen root export.
src/utils/{child-process,cli-child-process,detect,version,lock,color,registry,network,duration,compare-versions,executable-resolution,executable-search-paths,lifecycle-errors,user-output}.ts	KEEP	Spawn, probes, locks, PATH, errors. All have production importers.
src/agent-update/index.ts	KEEP	Published v1 agent-update facade. Compatibility re-exports it.
src/agent-update/{providers,messages,self-update,types}.ts	KEEP	Strategy resolution, copy, self-update fallback loop, types. Reached via the barrel and Core update-executor.
src/runtime/index.ts	KEEP	Established convenience barrel (star re-exports) with 15 production importers in Core/self/services. Not a leftover shell.
src/runtime/{ports,cli-operation-context,agent-process,child-process,fetch-network,invocation-context,version-cache}.ts	KEEP	Ports, CLI binding, process/network/cache. Leaf modules reached only via the barrel still add behavior.
src/planning/index.ts / src/planning/updates.ts	KEEP	Published v1 planning convenience barrel + Core planner grouping.
src/inspection/index.ts / src/inspection/agents.ts	KEEP	Published v1 inspection convenience barrel + PATH/state/latest assembly.
src/state.ts	KEEP	Published v1 state convenience barrel over src/state/index. Frozen state v2.
src/errors.ts	KEEP	Frozen CLI error-code → exit-code mapping.
src/cli-context.ts	KEEP	Frozen dual-mode CLI context (--json / color / timeout).
src/output/{index,types,human}.ts	KEEP	Frozen JSON/ndjson/human envelope. Must not expose engine / route.
src/commands/{capabilities,commands,schema}.ts / src/config/	KEEP untouched	Do not fold config/capabilities/commands/schema.
packages/core/src/{index,internal}.ts	KEEP	Published SDK root + internal subpath. Frozen: do not expand.

DELETE: none (0 zero-reference modules and 0 pure pass-through leftover wrappers after #729).

Same-file helpers that look unused from outside stay: they are live internals, not leftover bridges. Named re-exports on the published compatibility facade stay: they are the v1 root export surface locked by test/compatibility/v1-baseline.test.ts. Convenience barrels with live importers (src/runtime, src/planning, src/inspection, src/state.ts) stay: inlining them would churn published and internal import paths without removing leftover behavior.

Freeze confirmation

• --json / aliases / exit codes / state v2 / receipt untouched
• --json does not expose engine / route
• Published SDK has no lifecycle helpers; runtime export remains createQuantex
• YAML / release-core.yml / protect-main untouched
• Shelved OpenSpec changes untouched (release-one-line-delivery, release-pr-skip-human-heuristics, windows-ci-advisory-merge-gate)
• Active restore-managed-update-and-resume-releases untouched
• Did not fold config / capabilities / commands / schema
• Did not restore src/lifecycle/

Linked Artifacts

• OpenSpec: not required - mechanical leftover scan / no observable behavior (intake classification)
• ADR: docs/adr/0014-core-internal-lifecycle-barrel-deletion.md (L4 already deleted the barrel; this PR does not restore it)
• Discussion: S1 thick-area leftover scan after L5 (chore: L5 KEEP leftover scan after lifecycle barrel deletion #729)

Validation

• bun run memory:check
• bun run lint
• bun run format:check
• bun run typecheck
• bun run test — 177 files / 2159 passed / 5 skipped
• bun run openspec:validate — 25 passed / 0 failed
• Manual freeze smoke: install/ensure opencode --dry-run --json → ok=true, warnings[0].code=DRY_RUN, data.changed=false, exit 0, no engine/route; upgrade --json --check → MANUAL_ACTION_REQUIRED on source install, no engine/route
• SDK import keys remain ["createQuantex"]
• Local classify: run_test_matrix=true / product-impacting
• GitHub CI green on 714c47d (classify + lint + governance + ubuntu/windows/macos + Agent Canaries); draft kept

Release Intent

• Release: not applicable - internal leftover scan with no behavior change (KEEP comments + ownership lock only)

Release Summary

• Not applicable - this source PR does not produce a release entry.

Docs Updated

• Not needed for product README (KEEP comments + ownership lock only)

Scope Check

• I did not add a new ad hoc root-level Markdown file.
• I documented KEEP/DELETE inventory in this PR.
• I did not silently expand into YAML / SDK expansion / folding config/capabilities/commands/schema / restoring src/lifecycle/.

Closure Check

• Working tree was clean after commit.
• Branch was pushed and this PR is the active delivery artifact.
• OpenSpec change is not needed (mechanical leftover scan).
• Release is not applicable.

Notes

• Investigate-first: file-level import graph found zero unused modules in the S1 thick areas after L5.
• KEEP-only report PR still counts as done — this is not a hard-cut.
• Product-path KEEP comments hang on existing src/agents, src/providers, src/package-manager, src/utils, src/agent-update, src/runtime, src/planning, src/inspection, and src/state.ts paths so classify stays on the full ubuntu/windows/macos test matrix (protect-main unchanged).
• Draft kept after CI green (requested as draft — do not mark ready).