deep cleanup tier 2/3 candidates

[schickling-assistant]

Deep cleanup A (reports/deepclean-st2.md) ranked 20 candidates against origin/main@36356ed. Tier 1 landed in #499, #500, #501 and #502. This tracks Tier 2 and Tier 3 — everything whose gate is not provable inside the repo today. Each entry carries its gate verbatim, because the gate is the reason it is not Tier 1.

Nothing here is approved. Do not batch these; each is one PR with its own evidence.

Tier 2 — one read-only fleet check first

T2-DELIVER — retire the pre-driver deliver "mcp" | "pi-channel" | "app-server" declaration form

−415 prod LOC (+tests). Risk: med.
Gate, verbatim: 0/56 live; reconcile with draft #417.
Arms: reconcile.rs:198-316 (claude-session + pi-session wrappers, 119), :377-549 (app-server wrapper, 173); driver.rs:93-140 legacy .mcp.json route + :149 single-source clause; materialize.rs:382-420 legacy MCP render; kdl_format.rs:135-152 parse; spec.rs:55-70,355 enum/field. Zero producers: 0 of 56 live specs declare deliver (all use session-driver), and grep 'deliver "' over dotfiles nixpkgs/ = 0. claude_mcp.rs is not dead — the typed Claude driver still registers st2 claude-mcp; only the declaration form goes. Proof: grep -c 'deliver "' */agent.kdl = 0 fleet-wide, then cargo test --test materialize --test reconcile --test catalog_apply. Sequencing: draft PR #417 edits this exact surface — settle #417 first or the two collide.
Adjacent, same shape: catalog_graph.rs:411-430 folds legacy retired #true into desired-state (0 of 56 live specs use it, ~12 LOC); main.rs prints warning: st2 driver claude is deprecated — a deprecated alias with no producer in dotfiles.

T2-EXECPID — legacy plain-PID exec-generation plane

−1,100 LOC. Risk: med-high.
Gate, verbatim: needs a DELTA + one find.
exec_backend.rs:524-1010 legacy arm (open/read_legacy_pid_record, observe_open_legacy_generation, legacy_pid_predates_record ×2 cfg arms) plus tests/predecessor_ding_migration.rs (780 LOC, #[ignore]d, so it never runs in the gate). The writer is #[cfg(test)]-only — main writes no legacy record. Largest single Tier-2 win and the second arm with no DELTA and no trigger: author one before cutting, and check find $CATALOG -name '*.pid' shapes on dev3 first.

T2-STATUS — status legacy one-line record arm

−101/+2. Risk: low-med.
Gate, verbatim: bound it, then INVARIANTS row 25 reword.
ParsedRecord::Legacy(State) + legacy_mtime_ms plumbing + file_mtime_ms + 3 upgrade branches ≈ 46 prod + 63 test LOC. No shipping writer can emit it: write_record is the sole writer and always formats "{state}" + newline + "v1 {ts}" + newline; every one-line write in the tree is a test. The arm self-drains — a live seat upgrades in place on its next refresh — so only abandoned seats hold one. It is nonetheless unbounded: no DELTA, no doctor check, nothing observes it. After removal a one-line record reads Unknown/LeftCorrupt (conservative, never a false available). Cost: INVARIANTS row 25 says "Legacy DND migrates without renewing its hold" and cites the legacy tests → reword plus sign-off.

T2-HCSTAGE — legacy harness-context staging residue

−90. Risk: med.
Gate, verbatim: one find, INVARIANTS row 29 sentence.
harness_context.rs:369-406 (~38 prod) + 2 test modules (~52) recognize .harness-context.tmp-<pid>-<n> sitting directly in a host directory; current writers stage under the control plane. 3 callsites, all skip-guards in identity walkers; removing them turns a surviving stale file into a loud failed catalog apply, not silent corruption. This is the only unbounded legacy arm on main with no written removal trigger — it violates the rule src/migrations/mod.rs sets for the tree ("no module outside src/migrations/ names a format it does not itself write"; each needs a DELETION TRIGGER). Cheapest correct move if not deleted: give it that record. It is also the only Tier-2 item actionable with no fleet wait.

Tier 3 — needs the maintainer or a multi-day fleet signal

T3-VISTA — built-and-installed vista provider lane with zero bindings

−1,140 st2 / −45 dotfiles. Risk: med.
Gate, verbatim: Johannes + ordered 2-repo removal.
Order is critical and cross-repo: remove the profile from dev3.nix, delete nixpkgs/st2/vista-profile.nix, activate on dev3, verify catalog.kdl has no profile "vista" and _profiles/vista/ is gone, then land the st2 deletion. Inverting it fails activation at modules/st2.nix:1440-1449 ("desired component is missing").

T3-ARCH — 6 uncited .experiments files

−1,829/+18. Risk: med.
Gate, verbatim: delete-vs-archive call.
.experiments is 347 KB, 31% of the 1.13 MB doc mass. Six files (1,829 LOC) are cited by nothing in docs/, src/ or crates/ and their questions are settled on main: the three 2026-08-20 pipes-* prototypes (1,600 LOC; two point at cross-worktree paths that no longer exist), the desired-state prototype, the root-count fold, and resync-composition. Every other experiment is cited by a decision and must stay.

T3-LEDGER — src/migrations/delivery_state pre-ledger import

−671/+1. Risk: med.
Gate, verbatim: DELTA-006 7-day fleet signal.
Trigger now has a producer (#500): st2 doctor prints <seat> pre-ledger delivery state (DELTA-006) — preLedgerRecords=N assertedEntries=M and is silent when both are zero. The signal is that line absent on every admitted host for seven consecutive days, plus clause 1's named artifact — a ratified decision recording that the pre-ledger release line is no longer a supported rollback target. 5 live delivery-state.json records on dev3 as of 2026-09-06, so the clock has not started.

T3-INV — fold 4 INVARIANTS duplications + 5 weak cites

−10 LOC, −4 rows. Risk: med.
Gate, verbatim: sacred table → approval.
Real defects in the 40-row table: Bounded DING PTY probe churn ⊂ Fail-closed observed native DING; 3 park proofs shared with R23; version-pinning shared with Harness context discipline; the near-identical "Agent-declared presence"/"…discipline" pair. Plus 3 bare-file cites shadowing qualified ones, 2 platform-gated file-only cites (on any one platform one cited proof compiles to zero tests), and 1 overclaim — "the appended immutable id" while no writer emits id.

T3-D005 — close DELTA-005 (protected requirement)

−74/+4. Risk: low.
Gate, verbatim: maintainer approval.
One ratified sentence (08-harness-context/requirements.md:228 + :10) still says "session cost" while spec.md:169-171 already carries the widened wording. Protected doc, so it needs approval rather than a PR.

DELTA-002 — fleet-gated, do not batch

Blocked on DQ-S1; no observable trigger.

Explicitly NOT candidates (verdicts against removal)

Recorded so they are not re-proposed:

• .harness-state.seq floor: essential. The claim token is pid+clock+counter — an identity with no order. Ownership direction is the seq axis alone, and when read_stored returns Unreadable the floor is the only thing stopping a new claim restarting at 1 below a lingering predecessor, which would fence the new session out permanently.
• stack.md F5 (driver-diagnostic vs harness-state): nothing to delete on main. disposition = 0 matches; the roster emits the two records side by side; F5's three named deletions describe unmerged feat(harness-state): add v3 reader foundation #469 code.
• Resource/wasm stack: essential, not dead generality. The deployed dev3 binary is st2-provider-runtime (both features on); 40 of 56 live specs bind resolver schemes, 23 bind wasip2 schemes. ~8,869 always-compiled resource LOC is the cost of decisions 0009/0014/0017, not legacy.
• Decision-number collisions (0005/0007/0014/0015): ratcheted recorded history. Renumbering breaks the ratchet and every citation. Bare citations are now stem-qualified and ratcheted instead.
• Record versions: EVENT_VERSION/REQUEST_VERSION/SENT_VERSION/hooks SCHEMA are all 1 and every read site is a fail-closed strict equality — zero version-dispatch tables, zero legacy arms.
• Fixtures and version pins: 0 orphans of 14; pi 0.84.2 ≡ flake.nix, omp [18.0.9, 18.0.3] fenced by SUPPORTED_OMP_MINORS, codex 0.151.0 re-asserted in-file.

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.43sz6ujq
session	dev3.43sz6ujq
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.7
agent_runtime	OMP 18.1.7
tooling_profile	dotfiles@39a19af