From 656ec4d263b73ccc9f6da69e692608b33717994c Mon Sep 17 00:00:00 2001 From: MP2EZ <182439403+MP2EZ@users.noreply.github.com> Date: Sat, 6 Jun 2026 13:49:18 -0700 Subject: [PATCH] =?UTF-8?q?chore:=20MAINT-227=20dead-code=20deletion=20ver?= =?UTF-8?q?ification=20pass=20(go/no-go=20for=20T4=E2=80=93T10)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Independent caller re-verification of the 2026-06-06 audit's bloat-agent "zero caller" claims, gating deletion tranches T4โ€“T10. Read-only; no app code ships. 4 of 7 targets confirm clean GO; 3 are wrong/imprecise as written: - T5 performance optimizer: removable only as an atomic dead-chain cluster (the "live" callers are transitively dead via a zero-import demo file); deleting the optimizer alone breaks tsc. - T6 CrisisSecurityProtocol: initialize() is a live non-metrics caller (SecurityMonitoringService.ts:410) โ€” "metrics-only" scope would break the build. But SecurityMonitoringService is itself dead (T9), so run T9 first and delete the file outright. - T10 FeatureGate: prod-dead but test-consumed (owner disposition); flows.ts/ stoic.ts are live files (sub-block scope only); path correction noted. Corrected scopes mirrored as comments on MAINT-237/238/245/247. ๐Ÿค– Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.8 (1M context) --- ...d-code-deletion-verification-2026-06-06.md | 159 ++++++++++++++++++ 1 file changed, 159 insertions(+) create mode 100644 docs/development/audits/MAINT-227-dead-code-deletion-verification-2026-06-06.md diff --git a/docs/development/audits/MAINT-227-dead-code-deletion-verification-2026-06-06.md b/docs/development/audits/MAINT-227-dead-code-deletion-verification-2026-06-06.md new file mode 100644 index 00000000..8c4047d1 --- /dev/null +++ b/docs/development/audits/MAINT-227-dead-code-deletion-verification-2026-06-06.md @@ -0,0 +1,159 @@ +# MAINT-227 โ€” Dead-code Deletion Verification Pass (confirm zero-caller claims) + +**Date:** 2026-06-06 +**Ticket:** [MAINT-227 โ€” Dead-code deletion verification pass (confirm zero-caller claims)](https://app.notion.com/p/377a1108c20881c08a08f4692c4e0374) +**Author:** `/b-work maint-227` โ€” independent caller re-verification of the deletion claims raised by the 2026-06-06 audit's bloat agents. **Verification record only โ€” no application code changes ship from this work item.** +**Scope:** Tranche **T0a** ยท risk rank **#2 (enabler)**. Gates the Phase-2 deletion tranches **T4, T5, T6, T7, T8, T9, T10**. Each was scoped by bloat-audit agents asserting "zero callers" at 88โ€“98% confidence โ€” a confidence score, not a guarantee. This pass re-confirms (or refutes) those claims before any code is deleted. +**Grounded in:** source on `development` as read on branch `chore/maint-227-dead-code-deletion-verification` (off `development` @ `9d313c2`). Every `file:line` below was re-verified against that branch. Method: searched `app/src` for alias imports (`@/core/*`, `@/features/*`), relative imports, barrel (`index.ts`) re-exports, and string / dynamic `import()` references, then **traced caller liveness transitively** โ€” a level-1 importer that is itself dead does not keep a symbol alive. + +--- + +## TL;DR + +The pass earned its keep: **4 of 7 targets confirm clean GO; 3 are wrong or imprecise as written.** Following the T5 and T6 ACs verbatim โ€” "delete the optimizer public API," "reduce CrisisSecurityProtocol to its metrics surface" โ€” would have **broken `tsc`/the build**. T10's `FeatureGate` needs an owner disposition, and its `flows.ts`/`stoic.ts` targets are *live files* (only sub-blocks are dead). + +| Tranche | Ticket | Target | Verdict | +|---|---|---|---| +| **T4** | MAINT-236 | `src/compliance/` (~7.2k LOC) | โœ… **GO** | +| **T7** | MAINT-246 | `core/types/` validation framework + commented tombstone | โœ… **GO** | +| **T8** | MAINT-240 | OnboardingScreen fake-HIPAA subsystem (~600 LOC) | โœ… **GO** | +| **T5** | MAINT-245 | `core/services/deployment/` | โœ… **GO** | +| **T5** | MAINT-245 | `performance/` optimizer "public API" | โš ๏ธ **GO โ€” only as an atomic cluster** | +| **T6** | MAINT-237 | `CrisisSecurityProtocol` non-metrics surface | โš ๏ธ **NO-GO as written โ†’ GO with corrected scope** | +| **T9** | MAINT-238 | SecurityMonitoringService + NetworkSecurityService | โš ๏ธ **GO โ€” and it unblocks full T6 deletion** | +| **T10** | MAINT-247 | `FeatureGate` + practice/type leftovers | โš ๏ธ **MIXED โ€” partial GO + 1 disposition + scope correction** | + +**Cross-tranche headline:** the security + monitoring + performance code forms three transitively-dead clusters whose *only* surviving anchors are themselves dead. The single most important catch: `SecurityMonitoringService` โ€” the lone live consumer of `CrisisSecurityProtocol` โ€” **is itself unreferenced** (its barrel comment claiming a live caller is stale). So once T9 removes it, T6 can delete `CrisisSecurityProtocol` outright rather than reducing it to a metrics shim. + +--- + +## T4 โ€” `src/compliance/` (MAINT-236) ยท โœ… GO + +**Inventory.** `BreachResponseEngine.ts`, `ConsentManager.ts`, `DataMinimization.ts`, `DataProtectionEngine.ts`, `PrivacyAssessmentIntegration.ts`, `index.ts` (exports `DataProtectionService` singleton + `dataProtectionService`). + +**Evidence.** Zero external importers of the directory or any of its exports. The only non-internal references are: +- `app/tsconfig.json:39` โ€” the `@/compliance/*` path-alias definition (declaration, not usage). +- `app/src/core/types/validation/typescript-config.ts:48` โ€” a config test that asserts the alias mapping exists. + +The live consent path is `app/src/core/stores/consentStore.ts` (and `useConsentStore.canPerformOperation(...)`), entirely separate from this directory. + +**Verdict: GO** โ€” delete the whole directory. After deletion, also drop the now-dangling `@/compliance/*` alias and the `typescript-config.ts:48` assertion in the same PR so `tsc` stays green. `compliance` agent confirms no live obligation depends on it (per MAINT-236 AGENTS REQUIRED). + +--- + +## T7 โ€” `core/types/` validation framework (MAINT-246) ยท โœ… GO + +**Inventory.** Seven framework-validation interfaces in `app/src/core/types/index.ts:293โ€“351`, already inside a `/* โ€ฆ */` tombstone block (with an explanatory NOTE at `:269โ€“291` from MAINT-79): `CrisisWorkflowTypeValidation`, `ComplianceTypeValidation`, `SecurityTypeValidation`, `PerformanceTypeValidation`, `ErrorTypeValidation`, `IntegrationTypeValidation`, `MasterTypeValidation`. + +**Evidence.** Zero references to any of the seven names outside `index.ts`. The block is already commented out (dead). The framework sub-modules (`performance/validation/integration/compliance/security/errors`) under `core/types/` have no importers. + +**Verdict: GO** โ€” delete the commented block + the unused framework sub-modules + the framework barrel. **Keep `session.ts` and `subscription/`** โ€” those have real importers (`core/types/index.ts` re-exports them and they are consumed). Finish with `tsc --noEmit` clean. + +--- + +## T8 โ€” OnboardingScreen fake-HIPAA subsystem (MAINT-240) ยท โœ… GO + +**Location.** `app/src/features/onboarding/screens/OnboardingScreen.tsx`. + +**Inventory (all component-local, none exported).** State: `hipaaConsents`, `consentScope`, `auditTrail`, `patientRightsRequests`, `dataMinimizationReport`, `businessAssociateActivities`, `breachIncidents`, `complianceMetrics`. Functions: `logAuditEvent`, `classifyPHI`, `validateDataMinimization`, `grantDataProtectionConsent`, `handlePatientRightsRequest`, `logBusinessAssociateActivity`, `detectPotentialBreach`, `calculateComplianceScore` โ€” reachable only via the never-wired `handleConsentToggle`/`renderStateInspector`. + +**Evidence.** Zero external importers of any symbol. Four functions (`classifyPHI`, `validateDataMinimization`, `handlePatientRightsRequest`, `detectPotentialBreach`) are never called even *internally* โ€” dead code inside dead code. The component is rendered by `CleanRootNavigator.tsx:269`, but none of its HIPAA internals are reachable from outside. + +**Verdict: GO** โ€” delete the compliance interfaces, dead state hooks, the unreferenced functions, and `handleConsentToggle`/`renderStateInspector`. **Leave the live consent wiring intact** (`handleConsentPreferenceToggle`/`ConsentToggleCard` + the 5 render fns). `compliance` agent confirms terminology (per MAINT-240). Finish `typecheck` + suite green. + +--- + +## T5 โ€” `deployment/` + `performance/` (MAINT-245) + +### `core/services/deployment/` ยท โœ… GO + +**Inventory.** `DeploymentService.ts` (`DeploymentService`, `deploymentService`, `DeploymentStrategy`/`Environment`/`DeploymentStatus` enums) + `index.ts` (`DeploymentOrchestrator`, `deploymentOrchestrator`, readiness fns). Simulated server-deployment, irrelevant to an RN client. + +**Evidence.** Zero importers anywhere outside the directory. String literals `'deployment_service'`/`'deployment_orchestrator'` are logging tags only. + +**Verdict: GO** โ€” delete the directory. + +### `performance/` optimizer "public API" ยท โš ๏ธ GO โ€” only as an atomic cluster + +This is the pass's most important catch. A single-level importer grep reports the optimizer as **alive** โ€” but every caller is itself transitively dead. + +**The dead cluster (delete together):** +- `core/services/performance/CrisisPerformanceOptimizer.ts` +- `core/services/performance/index.ts` (`PerformanceSystem` / `performanceService`) +- `core/services/performance/PerformanceMonitor.ts` +- `core/services/performance/PerformanceValidator.ts` +- `core/services/performance/BundleOptimizer.ts` +- `features/assessment/hooks/useAssessmentPerformance.ts` +- `features/assessment/components/AssessmentIntegrationExample.tsx` + +**Why it's all dead:** +- `CrisisPerformanceOptimizer` is called by `useAssessmentPerformance.ts:179,326,332,503`, `performance/index.ts:72,186,210,280`, `PerformanceMonitor.ts:529`, `PerformanceValidator.ts:88` โ€” i.e. only by other members of this cluster + the assessment hook. +- The assessment hook's only consumer is `AssessmentIntegrationExample.tsx:87` (+ the `features/assessment/hooks/index.ts:6` barrel re-export + a dynamic `import()` in `BundleOptimizer.ts:110`, itself in-cluster). +- **`AssessmentIntegrationExample.tsx` has zero live importers** โ€” it is a dead demo component. That collapses the whole chain. +- The performance subsystem's other external door, `performanceService` (default export of `performance/index.ts`), is imported only by `core/services/monitoring/CrisisMonitoringService.ts:21` โ€” which is **itself dead** (only its own barrel `monitoring/index.ts:46,48,53` references it; the monitoring barrel has no importers). +- `triggerOptimizedEmergencyResponse()` (`CrisisPerformanceOptimizer.ts:303`) has **zero callers even within the cluster**. + +**Verdict: GO** โ€” but delete the cluster **atomically**. Deleting the optimizer alone (or any single member) breaks `tsc`. MAINT-245's AC "delete unused optimizer public methods, keep consumed pass-throughs" is moot once the demo entrypoint is removed: **nothing is consumed**, so the whole cluster (incl. `CrisisMonitoringService`) goes. Finish `typecheck` + suite green. `performance` agent confirms (per MAINT-245). + +--- + +## T6 โ€” `CrisisSecurityProtocol` non-metrics surface (MAINT-237) ยท โš ๏ธ NO-GO as written โ†’ GO with corrected scope + +**Location.** `app/src/features/crisis/services/CrisisSecurityProtocol.ts`. **Crisis safety path โ€” `crisis` + `security` sign-off required at delete-time (already in MAINT-237 AGENTS REQUIRED).** + +**Surprise caller (refutes the claim).** `initialize()` is a *non-metrics* method and **is live**: `SecurityMonitoringService.ts:410` (`await this.crisisSecurityProtocol.initialize()`). The metrics method `getCrisisSecurityMetrics()` is also consumed (`SecurityMonitoringService.ts:1045,1507`). So "the metrics surface SecurityMonitoringService uses" is actually **`getInstance` + `initialize` + `getCrisisSecurityMetrics` (+ `destroy` lifecycle)** โ€” not metrics alone. + +**Genuinely-dead non-metrics methods (zero external callers):** `grantEmergencyAccess`, `protectCrisisData`, `validateProfessionalAccess`, `startCrisisSecurityMonitoring`, `detectSecurityViolation`, `performImmediateLockdown`, `getActiveCrisisAccess`, `getSecurityViolations`, `isMonitoringActive`. + +**But it gets simpler โ€” see T9.** The *only* consumer of the surviving surface is `SecurityMonitoringService`, which is **itself dead** (T9). Once T9 removes it, `CrisisSecurityProtocol` has zero consumers and can be **deleted in full**, not reduced to a shim. + +**Verdict:** +- **If T6 runs before T9:** keep `getInstance`/`initialize`/`getCrisisSecurityMetrics`/`destroy`; delete the 9 dead methods + emergency-override/professional-access/multi-tier-encryption code + empty monitor stubs. (Do **not** interpret the AC as "metrics-only" โ€” that deletes `initialize()` and breaks `SecurityMonitoringService.ts:410`.) +- **If T9 runs first (recommended):** delete `CrisisSecurityProtocol.ts` entirely. +- Either way, the second of {T6, T9} **must re-run the seam grep** (`rg "crisisSecurityProtocol\.|CrisisSecurityProtocol" src`) before deleting, with `crisis` sign-off. + +--- + +## T9 โ€” SecurityMonitoringService + NetworkSecurityService (MAINT-238) ยท โš ๏ธ GO โ€” and it unblocks full T6 deletion + +**Finding.** `SecurityMonitoringService` has **zero runtime importers**. Only its own barrel re-exports it (`core/services/security/index.ts:24,89`); the only other hits are a *type* of the same name (`core/types/security/encryption.ts:688`, `core/types/index.ts:124`) and a leaf-module comment (`wellnessDataPatterns.ts:4`). The barrel's prose at `security/index.ts:7` โ€” *"AnalyticsService imports SecurityMonitoringService directly"* โ€” is **stale/false**: no file imports the `SecurityMonitoringService` class at runtime (grep for `import โ€ฆ SecurityMonitoringService` outside the barrel returns nothing). The security barrel itself is imported only for unrelated symbols (e.g. `EncryptionService`, `src/README.md:93`), which does not instantiate the monitoring service. + +**Verdict: GO** โ€” `SecurityMonitoringService` is fully deletable. **Sequencing recommendation: run T9 before T6** (or merge them) so T6 collapses to a whole-file deletion of `CrisisSecurityProtocol`. (`NetworkSecurityService.secureRequest` mock layer not separately traced here; ticket-scoped โ€” confirm its callers at delete-time.) `security` agent sign-off (per MAINT-238). Finish `typecheck` + suite green. + +--- + +## T10 โ€” FeatureGate + practice/type leftovers (MAINT-247) ยท โš ๏ธ MIXED + +| Item | Verdict | Evidence | +|---|---|---| +| `GratitudeInputSection` | โœ… **GO** | Only the `features/practices/shared/components/index.ts:32โ€“33` barrel re-export; no JSX/consumer found. Drop the barrel entries too. | +| `shared/constants/principles.ts` | โœ… **GO** | Zero importers anywhere. | +| `FeatureGate` / `withFeatureGate` / `useFeatureAccess` | โš ๏ธ **NO-GO โ€” owner disposition** | Prod-dead (DEBUG-189 unwired it; only a comment remains at `core/navigation/CleanTabNavigator.tsx:167`), **but `core/components/subscription/__tests__/FeatureGate.test.tsx` exercises all three exports**. Not a pure-grep call: delete the component **and its test together** (the test verifies nothing that ships), or keep both. **Name-collision caution:** a *different* `useFeatureAccess` exists at `core/stores/subscriptionStore.ts:622` (a Zustand selector) โ€” do **not** delete it. | +| `FlowProgress` "stub" + `types/flows.ts` + `types/stoic.ts` "dead blocks" | โš ๏ธ **CAUTION โ€” files are LIVE, scope to sub-blocks only** | `features/practices/types/flows.ts` is heavily live (`FlowProgress` interface used at `flows.ts:159`; imported by Evening/Midday/Morning navigators + many screens). `types/stoic.ts` is live (`StoicPrinciple`, `CardinalVirtue` used by live screens + `README.md:99`). `FlowProgressIndicator` (component) is live (Evening/Midday/Morning navigators). Only specific dead *blocks within* these files are removable โ€” **do not delete the files.** Identify the exact dead blocks during implementation and `tsc` after. | + +**Path correction:** MAINT-247's Technical Notes cite `features/learn/types/*`, but the actual `flows.ts`/`stoic.ts` live under **`features/practices/types/`**. Update the AC path before deleting. + +**Verdict: MIXED** โ€” `GratitudeInputSection` + `principles.ts` are clean GO; `FeatureGate` needs an owner decision (delete-with-test vs. keep); `flows.ts`/`stoic.ts` require within-file scoping (the files stay). + +--- + +## Cross-tranche coupling & recommended order + +1. **T9 before T6** โ€” deleting `SecurityMonitoringService` (T9) turns T6 into a whole-file deletion of `CrisisSecurityProtocol`. Running T6 first forces the more error-prone "keep the consumed lifecycle surface" surgery. Whichever runs second re-verifies the seam with `crisis` sign-off. +2. **T5 performance is one atomic PR** โ€” the 7-file cluster (+ `CrisisMonitoringService`) deletes together or `tsc` breaks. +3. **T6/T9 are on the crisis safety path** โ€” `crisis` + `security` planning passes at delete-time are mandatory (already in those tickets' AGENTS REQUIRED), plus a green `npm run test:crisis-detection` before merge. + +## Sign-off + +| Tranche | Target | Verdict | Action for the deletion tranche | +|---|---|---|---| +| T4 | `compliance/` | โœ… GO | Delete dir + drop dangling alias/test | +| T7 | `core/types/` framework | โœ… GO | Delete framework subset; keep `session`/`subscription` | +| T8 | Onboarding fake-HIPAA | โœ… GO | Delete dead subsystem; keep live consent wiring | +| T5 | `deployment/` | โœ… GO | Delete dir | +| T5 | `performance/` cluster | โš ๏ธ GO (atomic) | Delete the 7-file cluster + `CrisisMonitoringService` together | +| T6 | `CrisisSecurityProtocol` | โš ๏ธ GO (corrected) | Keep `initialize`/metrics/lifecycle **unless** T9 ran first โ†’ delete whole file | +| T9 | `SecurityMonitoringService` | โš ๏ธ GO | Delete (barrel caller-claim is stale); run before T6 | +| T10 | FeatureGate + leftovers | โš ๏ธ MIXED | GO on `GratitudeInputSection`/`principles.ts`; disposition on `FeatureGate`; sub-block-only on `flows.ts`/`stoic.ts` (fix path) | + +**No application code changes ship from MAINT-227.** The corrected scopes above are mirrored as comments on the affected downstream tickets (T5/T6/T9/T10).