Delete the dead TUI, and add a check that could have seen it

AGENTS.md

@@ -86,6 +86,25 @@ make lint # Linter
 make check # All checks (what bin/ci runs)
 ```
 
+**Dead code**: `make deadcode` reports unreachable functions whole-program, rooted
+at the shipped binary and again with `-tags dev`. It is a report, not a gate, and
+is deliberately outside `make check`. The linter's `unused` cannot do this job —
+it runs per-package and counts every exported identifier in a non-main package as
+used, which is how 600 lines of exported, zero-caller `internal/tui` API survived
+it. Root it at the binary, not `./...`: only main packages are roots, so `./...`
+reports everything no main reaches — mostly the `dev`-tagged workspace tree — as
+unreachable.
+
+It also analyzes one GOOS/GOARCH at a time, while we release five. A host run says
+nothing about the others: code behind another platform's build tag is never loaded,
+and a function whose only caller sits behind one looks unreachable. Before deleting
+anything platform-adjacent, check the other targets — install the tool for the host
+and set GOOS for the analysis (`GOOS=windows deadcode ./cmd/basecamp`), since
+`GOOS=windows go run` cross-compiles the tool itself and fails.
+
+Read the output before acting on it: a zero-caller exported symbol is a candidate,
+not a verdict, and the `dev`-tagged tree is legitimately partial.
+
 Requirements: Go 1.26+, [bats-core](https://github.com/bats-core/bats-core) for e2e tests.
 
 ## OAuth Development

Makefile

@@ -190,6 +190,56 @@ bench-compare:
 	@command -v benchstat >/dev/null 2>&1 || go install golang.org/x/perf/cmd/benchstat@latest
 	benchstat benchmarks-baseline.txt benchmarks-current.txt
 
+# Report unreachable code, whole-program, from the production binary's main.
+#
+# NOT a gate, and not wired into `make check`. golangci's `unused` (staticcheck
+# U1000) runs per-package and treats every exported identifier in a non-main
+# package as used by definition, which is why 602 lines of exported, zero-caller
+# internal/tui API survived it — no configuration fixes that, the analysis
+# cannot see across package boundaries. deadcode can, because it starts from a
+# main and follows the call graph.
+#
+# Which main matters. Only main packages are roots, so `deadcode ./...` loads
+# every package and then reports everything no main reaches as unreachable —
+# 1100+ of its 1250 lines here are the dev-tagged workspace tree, which the
+# untagged build genuinely cannot reach. True, and useless. Naming the binary
+# gives two answers worth reading instead:
+#
+# deadcode ./cmd/basecamp what a released basecamp can never run
+# deadcode -tags=dev ./cmd/basecamp the same, with the dev `basecamp tui` tree
+#
+# `go run` the pinned version rather than trusting whatever `deadcode` happens
+# to be on PATH; an unpinned tool makes the output depend on the machine.
+#
+# ONE PLATFORM AT A TIME. deadcode analyzes the current GOOS/GOARCH, and this
+# repo releases darwin, linux, windows, freebsd and openbsd. So a host run is
+# evidence about the host and nothing else, in both directions: code behind
+# another platform's build tag is never loaded, and a function whose only caller
+# sits behind one looks unreachable here. Measured on this tree: 78 findings for
+# linux and darwin, 77 for windows, with harden_unix.go's ownedByUID present
+# only in the unix reports.
+#
+# To check another target, install the tool for the host and set GOOS for the
+# analysis — `GOOS=windows go run ...` cross-compiles the tool itself and dies
+# with an exec format error:
+#
+# go install golang.org/x/tools/cmd/deadcode@v0.40.0
+# GOOS=windows deadcode ./cmd/basecamp
+#
+# Read the output before acting on it. A zero-caller exported symbol is a
+# candidate, not a verdict — some are a deliberate API surface, the -tags dev
+# tree is legitimately partial, and a cross-platform deletion needs a run per
+# target. Wiring a noisy check into CI is how a control nobody sized gets built.
+DEADCODE := golang.org/x/tools/cmd/deadcode@v0.40.0
+
+.PHONY: deadcode
+deadcode: check-toolchain
+	@echo "== shipped binary =="
+	$(GOCMD) run $(DEADCODE) ./cmd/basecamp
+	@echo
+	@echo "== with -tags dev =="
+	$(GOCMD) run $(DEADCODE) -tags=dev ./cmd/basecamp
+
 # Guard against Go toolchain mismatch (mise environment)
 .PHONY: check-toolchain
 check-toolchain:
@@ -558,6 +608,7 @@ help:
 	@echo " fmt-check Check code formatting"
 	@echo " lint Run golangci-lint"
 	@echo " lint-actions Lint GitHub Actions workflows (actionlint + zizmor)"
+	@echo " deadcode Report unreachable code from the binary (report, not a gate)"
 	@echo " tidy-check Verify go.mod/go.sum are tidy"
 	@echo " check Run all checks (local CI gate)"
 	@echo " check-surface Verify committed .surface matches the command tree (TestSurfaceSnapshot)"

internal/tui/forms_test.go

@@ -1,7 +1,6 @@
 package tui
 
 import (
-	"context"
 	"errors"
 	"go/ast"
 	"go/parser"
@@ -202,65 +201,6 @@ func TestPickerFloorRefusesNonInteractiveStdio(t *testing.T) {
 	assert.Zero(t, loaderCalls, "a refused picker must not fetch items it cannot show")
 }
 
-// TestDeadLaunchersStillRefuse covers Spinner and PaginatedPicker. Both are
-// exported, both have zero callers today, and both are slated for deletion —
-// but "nobody calls it" is not a gate. Adding a caller would not add a
-// tea.NewProgram, so the structural backstop would still pass while the hang
-// came straight back. They hold the floor until they are gone.
-func TestDeadLaunchersStillRefuse(t *testing.T) {
-	for _, kind := range stdinKinds {
- t.Run("spinner/"+kind, func(t *testing.T) {
- terminalStdout(t)
- nonInteractiveStdin(t, kind)
-
- var ran bool
- done := make(chan error, 1)
- go func() {
- _, err := NewSpinner("working").Run(func() (string, error) {
- ran = true
- return "", nil
- })
- done <- err
- }()
-
- select {
- case err := <-done:
- assert.True(t, errors.Is(err, ErrNotInteractive),
- "spinner should return ErrNotInteractive on %s stdin, got %v", kind, err)
- assert.False(t, ran, "a refused spinner must not run the work it was wrapping")
- case <-time.After(5 * time.Second):
- t.Fatalf("spinner blocked on %s stdin instead of refusing", kind)
- }
- })
-
- t.Run("paginated_picker/"+kind, func(t *testing.T) {
- terminalStdout(t)
- nonInteractiveStdin(t, kind)
-
- var fetched bool
- fetcher := func(context.Context, string) (*PageResult, error) {
- fetched = true
- return &PageResult{}, nil
- }
-
- done := make(chan error, 1)
- go func() {
- _, err := NewPaginatedPicker(context.Background(), fetcher).Run()
- done <- err
- }()
-
- select {
- case err := <-done:
- assert.True(t, errors.Is(err, ErrNotInteractive),
- "paginated picker should return ErrNotInteractive on %s stdin, got %v", kind, err)
- assert.False(t, fetched, "a refused picker must not fetch a page it cannot show")
- case <-time.After(5 * time.Second):
- t.Fatalf("paginated picker blocked on %s stdin instead of refusing", kind)
- }
- })
-	}
-}
-
 // TestAutoSelectSingleWorksWithoutATerminal pins the one path through
 // Picker.Run that is deliberately outside the floor. With WithAutoSelectSingle
 // and exactly one static item, Run resolves without constructing a bubbletea

internal/tui/launchers_test.go

@@ -36,15 +36,7 @@ var (
 	// bubbleteaLaunchers maps a file that may call tea.NewProgram to the sole
 	// function within it that may do so.
 	bubbleteaLaunchers = map[string]string{
- "internal/tui/picker.go": "runPicker",
-
- // Zero callers today and slated for deletion, but "dead" is not a gate:
- // adding a caller would not add a NewProgram, so the check would still
- // pass while the hang came back. Both launch from their own Run, and
- // both apply the floor there.
- "internal/tui/spinner.go": "Run",
- "internal/tui/paginated_picker.go": "Run",
-
+ "internal/tui/picker.go": "runPicker",
  "internal/commands/tui.go": "", // dev build tag; not in a shipped binary
 	}