chore: S2 KEEP leftover scan for CLI shell zero-ref

[Drswith]

Summary

Post-S1 S2 leftover scan of CLI shell areas: src/commands, src/command-contract, src/command-runtime.ts, src/cli.ts, src/index.ts, src/generated, src/release-artifacts. Import-graph proof that every scanned module still has a production importer (or is the process entry) and still adds differential behavior. Delete none. Keep every still-imported module and every bridge that still adds differential behavior.

Intake: mechanical leftover scan / no observable behavior — no new OpenSpec change. Folding config / capabilities / commands / schema, expanding a commands barrel or public SDK, or restoring src/lifecycle/ would be architecture-boundary work and would need OpenSpec; this PR documents that those folds are not safe.

DELETE vs KEEP

Module	Result	Proof
src/lifecycle/	already DELETED in L4	Ownership tests assert the directory is gone. Do not restore.
src/core/lifecycle/index.ts	KEEP absent	No Core lifecycle barrel (ADR 0011–0014).
src/self/application.ts / src/services/self-upgrade.ts / src/services/lifecycle-updates.ts / src/services/lifecycle-execution.ts	already DELETED	P2/P6 leftovers stay absent.
src/commands/index.ts	KEEP absent	Do not expand a commands barrel / public SDK.
src/cli.ts	KEEP	Process entry (tsdown + package.json bin dist/cli.mjs + bun run src/cli.ts). Import-graph zero-ref is expected: the file is executed, not imported. Shortcut dispatch + Commander program.
src/index.ts	KEEP	Published package root. Star re-export of the v1 compatibility facade. Folding or expanding it would change the published SDK/CLI boundary.
src/command-runtime.ts	KEEP	Timeout, signals, idempotency replay, state-read mapping, dual-mode emit. Importers: handlers, update, lifecycle-policy, smoke.
src/command-contract/index.ts	KEEP	Convenience barrel over registry. Live importers in commands/schema/shortcut. Not a leftover shim to inline.
src/command-contract/registry.ts	KEEP	Stable command/option/alias/effect registry. Frozen aliases. Source for Commander + commands/schema.
src/command-contract/handlers.ts	KEEP	Commander action dispatch, lazy command imports, idempotency policy wiring, exit-code mapping.
src/command-contract/commander.ts	KEEP	Commander program builder (global options, aliases, argv hooks). Importer: src/cli.ts.
src/command-contract/presentation.ts	KEEP	Dual-mode presenter (human / json / ndjson). Identity JSON.stringify is the frozen envelope; must not add engine/route.
src/command-contract/schemas.ts	KEEP	Frozen JSON/ndjson schema documents for quantex schema. Envelope must not describe engine/route.
src/commands/capabilities.ts	KEEP untouched	Do not fold into package-manager/capabilities or config/commands/schema.
src/commands/commands.ts	KEEP untouched	Frozen command directory. Do not fold.
src/commands/schema.ts	KEEP untouched	Frozen JSON schema catalog. Do not fold.
src/commands/config.ts	KEEP untouched	CLI config command. Do not fold into src/config.
src/commands/exec.ts	KEEP	Published v1 exec types (ExecCommandOptions / ExecInstallPolicy). Compatibility re-exports them. Type-only home, not a leftover to fold into run.ts.
src/commands/run.ts	KEEP	exec / shortcut launch facade over Core execution. Owns argv, --install policy, exit codes, process I/O.
src/commands/shortcut.ts	KEEP	quantex <agent> argv parser. Frozen: structured output is rejected for shortcut execution.
src/commands/install.ts	KEEP	Single + batch install, unmanaged no-op, human/json projection.
src/commands/ensure.ts	KEEP	Ensure + unmanaged no-op over Core installation CLI session.
src/commands/uninstall.ts	KEEP	Core uninstall projection + human renderer. Former compatibility wrapper already inlined in P2.
src/commands/update.ts	KEEP	update / --all / --managed over Core update executor.
src/commands/upgrade.ts	KEEP	Self-upgrade CLI facade over Core (P6/P7). Not a public SDK upgrade() wrapper.
src/commands/doctor.ts	KEEP	Doctor CLI over production diagnosis. Human renderer is differential.
src/commands/list.ts / info.ts / inspect.ts / resolve.ts	KEEP	CLI read commands. Project richer v1 rows than public SDK inspect() descriptors.
src/commands/core-installation-cli.ts	KEEP	CLI session around Core install/ensure (cancel, dry-run preview, v1 payload, failure diagnostics).
src/commands/cli-read-projection.ts	KEEP	Shared inspect/info/resolve projector. Richer than SDK inspect(). Do not wrap or expand the SDK.
src/commands/installation-routing.ts	KEEP	Internal Core engine identity after promotion. Debug-only stderr + test seam. Must not leak engine/route into --json.
src/commands/installation-failure-diagnostics.ts	KEEP	Failure details projection. Shared by install session and update.
src/commands/unmanaged-install-compatibility.ts	KEEP	Frozen v1 no-op for unmanaged external executables (P2). Importers: install/ensure.
src/generated/build-meta.ts	KEEP	Generated version/repo constants. Live importers in self/doctor/release scripts. Do not hand-edit.
src/release-artifacts/index.ts	KEEP	Archive/manifest/checksum helpers for self-upgrade and release scripts.
packages/core/src/{index,internal}.ts	KEEP	Published SDK root + internal subpath. Frozen: do not expand. Runtime export remains createQuantex.

DELETE: none (0 leftover zero-reference modules and 0 pure pass-through leftover wrappers after #730). src/cli.ts is import-graph zero-ref because it is the process entry, not because it is unused.

Same-file helpers that look unused from outside stay: they are live internals, not leftover bridges. Named re-exports on the published compatibility facade stay: they are the v1 root export surface locked by test/compatibility/v1-baseline.test.ts. Convenience barrels with live importers (src/command-contract/index.ts, src/index.ts) stay: inlining them would churn published and internal import paths without removing leftover behavior.

Freeze confirmation

• --json / aliases / exit codes / state v2 / receipt untouched
• --json does not expose engine / route
• Published SDK has no lifecycle helpers; runtime export remains createQuantex
• YAML / release-core.yml / protect-main untouched
• Shelved OpenSpec changes untouched (release-one-line-delivery, release-pr-skip-human-heuristics, windows-ci-advisory-merge-gate)
• Active restore-managed-update-and-resume-releases untouched
• Did not fold config / capabilities / commands / schema
• Did not restore src/lifecycle/
• Did not expand commands / public SDK

Linked Artifacts

• OpenSpec: not required - mechanical leftover scan / no observable behavior (intake classification)
• ADR: docs/adr/0014-core-internal-lifecycle-barrel-deletion.md (L4 already deleted the barrel; this PR does not restore it)
• Discussion: S2 CLI shell leftover scan after S1 (chore: S1 KEEP leftover scan for thick-area zero-ref #730)

Validation

• bun run memory:check
• bun run lint
• bun run format:check
• bun run typecheck
• bun run test — 178 files / 2168 passed / 5 skipped
• bun run openspec:validate — 25 passed / 0 failed
• Manual freeze smoke: install/ensure opencode --dry-run --json → ok=true, warnings[0].code=DRY_RUN, data.changed=false, exit 0, no engine/route; upgrade --json --check → MANUAL_ACTION_REQUIRED on source install, no engine/route
• SDK import keys remain ["createQuantex"]
• Local classify: run_test_matrix=true / product-impacting
• GitHub CI pending on 2e230b1 (draft kept)

Release Intent

• Release: not applicable - internal leftover scan with no behavior change (KEEP comments + ownership lock only)

Release Summary

• Not applicable - this source PR does not produce a release entry.

Docs Updated

• Not needed for product README (KEEP comments + ownership lock only)

Scope Check

• I did not add a new ad hoc root-level Markdown file.
• I documented KEEP/DELETE inventory in this PR.
• I did not silently expand into YAML / SDK expansion / folding config/capabilities/commands/schema / restoring src/lifecycle/.

Closure Check

• Working tree was clean after commit.
• Branch was pushed and this PR is the active delivery artifact.
• OpenSpec change is not needed (mechanical leftover scan).
• Release is not applicable.

Notes

• Investigate-first: file-level import graph found zero unused modules in the S2 CLI shell areas after S1. The only import-graph zero-ref is src/cli.ts, which is the process entry.
• KEEP-only report PR still counts as done — this is not a hard-cut.
• Product-path KEEP comments hang on existing src/cli.ts, src/index.ts, src/command-runtime.ts, src/command-contract, src/commands, and src/release-artifacts paths so classify stays on the full ubuntu/windows/macos test matrix (protect-main unchanged). Generated src/generated/build-meta.ts is graph-scanned but not comment-hung.
• Draft kept after CI green (requested as draft — do not mark ready).