maintainability: split processors.ts (16.2k lines, 437 touches) — the structural cause of this audit's drift and determinism gaps

[JSONbored]

Parent: #9492

Summary

src/queue/processors.ts is 16,200 lines with 437 touches since 2026-07-01, 86 of them in a single week. It is where most of the 2026-07-27 audit's confirmed bugs physically live:

• the decision-clock violations (replay: the recorded decision clock reaches one consumer while three other reads still decide outcomes #9539)
• both sibling-drift families (drift: the #9399 sibling-guard pattern is live in four more places — fix the four, then remove the structure that generates them #9491) — five near-identical command handlers, two panel twins, three advisory runners, all drifting inside one file
• the cap-close vs accept-path parity gap (approval-queue: accept path builds a thinner executor context — #9159 mutex, moderation ladder and #9055 base guard all silently inert #9482)
• the visual capture-blip wiring (gate(visual): capture-retry marker never cleared + pending marker skips instead of holds → screenshot gate silently disabled (false merge) #9462, gate(visual): browserless render failure is swallowed, not deferred → screenshot gate false-closes legitimate PRs (#9030/#9207 unpatched sibling) #9464)

The drift is mechanical, not careless: a guard is added to the instances someone greps for, and the next one is 8,000 lines away in the same file, so it does not read as a separate site needing the same change.

Deliverables, in value order

• The ~9 slash-command and panel handlers behind one shared dispatch owning state, redelivery and rate-limit guards once. Also delivers most of drift: the #9399 sibling-guard pattern is live in four more places — fix the four, then remove the structure that generates them #9491.
• The three run*ForAdvisory spend gates behind one shared precondition struct.
• The plan-and-execute pass into its own module, with a REQUIRED, typed decision-pass context (clock, authorLogin, baseRef) that both the live path and the approval-accept path must construct. This one change structurally fixes approval-queue: accept path builds a thinner executor context — #9159 mutex, moderation ladder and #9055 base guard all silently inert #9482 and roughly half the determinism gap, because both are caused by ad-hoc optional context fields.

Prior art already in place

• replay: the recorded decision clock reaches one consumer while three other reads still decide outcomes #9539 landed a required decisionNowMs plan-input field — a first, deliberately non-optional instance of exactly the typed decision-pass context the third deliverable calls for. Follow that pattern: required, not optional.
• maintainability: a dead wire ships green, and no check exists for the class (26 wires, no registration protocol) #9540's scripts/check-dead-source-files.ts makes a module accidentally orphaned during a split fail CI rather than silently die — a safety net this refactor specifically benefits from.

Requirements

1. Behaviour-preserving. No verdict, no reason code, and no public surface may change. This is a structural change and must be reviewable as one.
2. Land it separately from any behavioural fix — bundling the two makes both unreviewable, and their risk profiles are entirely different.
3. Each extracted seam gets its own direct tests; the existing suites must pass unmodified except where a symbol genuinely moved.

Note on src/api/routes.ts (6,906 lines, 173 touches)

The requiresApiToken exemption list plus the canSessionAccessPath allowlist is a proven drift generator — #9120 was literally "route doc said unauthenticated, list said 401", and three later routes carry comments promising to update both "in the SAME PR so the two can never drift", by convention only. A route-registration structure co-locating auth posture with the route would retire the class. Lower priority than the above; recorded so it is not rediscovered. (Partly overlapping with #9519's route-registration seam.)

[linear-code]

JSO-6592