deslop: structural sweep — derive state from facts, one owner per policy, delete test-shaped seams

[pythonlearner1025]

What part this touches

This is a deslop pass: it removes structural slop, code that exists to look robust rather than to be needed. A sweep on 2026-08-22 filed 130 findings across nine areas. This PR acts on all of them.

The touched parts, for a reader away for months:

• Control plane (Cloudflare Worker): provider plumbing in core/compute, workspace lifecycle, janitors, identity, connections, files, and the scheduled handler.
• D1 schema: three derived-state columns drop via migrations 0028, 0029, and 0030. A derived-state column stores a label that other columns already imply.
• Managed deploy tooling: scripts/lib/worker-source.mjs emits the blitz.dev worker. Its schema mirror and entrypoint now match core.
• Web app: workspace shell, chat transcript, dialogs, pollers, and stores.
• Box: actor, Go gateway, and guest boot scripts inside the workspace image.
• Go infra: broker and microvm-host packages.
• Lint tooling: the repo-owned blitz-house rules and the ratchet baseline. The vendored anti-slop plugin is untouched.

The problem

Slop code costs real bugs and real drift. Concrete examples from this tree:

• leases, invites, and boxes each stored a fact twice. A sweep then reconciled state with expires_at, and is_broker mirrored broker_boxes. Two copies drift; the sweep hid that drift.
• The managed worker entrypoint had already drifted from the open-source one. It ran the costly provider canary on every tick, not hourly.
• 34 findings were test-shaped seams: injectable fetchers, clocks, and runners no production caller uses. They widen every signature they touch.
• The AWS volume implementation had no production binding at all. Dead code still costs review time and false confidence.
• The web app translated live schema views into legacy shapes twice, once per facade.

The fix

One rule per line:

• Store facts, derive labels: revoked_at and expires_at replace stored state; broker_boxes membership replaces is_broker.
• Delete the sweeps and write-on-read paths that synced those labels.
• One owner per policy: runScheduledMaintenance in core owns cron routing for both entrypoints.
• One owner per mechanism: one base64url codec, one share dialog workflow, one invite-creation form, one destroy transaction, one global-member recognizer in lint rules.
• Delete test-only seams; tests now mock global fetch and timers, or use fake executables and real short durations in Go.
• Delete dead code proven dead by fresh greps: the AWS volume subsystem, mintSession, rename and ports subsystems, dead reducer actions.
• Delete rechecks of invariants the database or a caller already enforces; each deletion leaves a SAFETY: comment naming the invariant.
• Delete a mutex only with race-detector proof; one such proof landed, one mutex stayed for lack of proof.
• Keep every wire shape identical; every contract conformance suite stays green.

The risk trade

Costs and mitigations:

• The migrations rewrite prod tables. Mitigation: no table rebuilds, only column drops and index swaps; SQLite 3.53 drop-column behavior was tested first; a backfill keeps revocation timestamps, sourced from the audit log where it exists.
• Worker rollback alone breaks after the migrations run, because old code writes the dropped columns. Roll forward, or re-add the three columns first.
• Expired proxy leases now keep their token hash. The auth query rejects on expiry itself, so a stale hash authorizes nothing.
• Drive dialogs now share ModalOverlay. Escape and focus return behavior changed slightly, on purpose, toward the shared owner.
• The managed tick pins the hourly cron literal, preserving its old behavior under the new shared policy.

Re-verification refuted nine sweep claims; that code stays because it is load-bearing. Examples: the grant base URL stores real per-member data; the recipes cleanup covers a foreign key with no delete action; a boot timeout guards against a wedged child; a rm guard file (managed-settings.json) still has a producer on old boxes.

Skipped and listed, design tier (8): volume-provider routing, the box remove-file tombstone pipeline, both webapp-state ownership findings, auth-layer principal typing, and three worker-source.mjs derivation mirrors.

Skipped and listed, judgment tier (14): seams whose real boundary needs root, firecracker, or fixed guest ports; a frozen microVM wire contract; an unprovable mutex claim; a 75-second lock knob; the terminal sign-in delays, which lack an honest readiness signal; the actor model-catalog copy, which needs a build edge; two zero-value moves.

Tests

All gates green on this branch:

• npm run typecheck: all workspaces, including the wire-drift config.
• npm run lint:gate: passes; the ratchet lowered in this PR, no-runtime-typeof 27 to 25, no-unknown-parameters 52 to 51; anti-slop total 108 to 105.
• npm test: control plane 451 vitest tests plus Python fixture conformance and 15 scripts tests; webapp 224 tests in 30 files; box actor 88 tests including six conformance suites; guest node tests; house-rule tests; broker provision script.
• go test -race ./...: broker, microvm-host, and box gateway all pass.
• Vendor-gated managed suites (BLITZDEV_MANAGED=1): 32 tests pass against the synced mirror.
• Coverage moved to production boundaries instead of seams; no suite was deleted without a retargeted replacement.

Net diff: 180 files, 2,751 insertions, 4,508 deletions.

Deploy

Artifacts, in order:

1. Control-plane worker with its three D1 migrations: 0028 drops boxes.is_broker; 0029 and 0030 add revoked_at and drop state on invites and credential_leases. Apply migrations with the worker deploy: npx wrangler d1 migrations apply then npx wrangler deploy from packages/control-plane. Canary first, then prod, per house practice. The managed blitz.dev path redeploys through npm run blitzdev:build unchanged.
2. Box image: guest scripts changed (blitz-term, blitz-rules-boot, blitz-init-state). Existing boxes never upgrade in place; the change rides the next box image build only.
3. M2 microVM guest rootfs: the enroll script changed; rebuild with build-rootfs-m2.sh when convenient. Phone-home wire is byte-identical.

Rollback: redeploy the previous worker only after re-adding the three dropped columns, or roll forward with a fix. Box and rootfs artifacts need no rollback; old images keep working.

🤖 Generated with Claude Code

Claude session: c478d64f-55f7-4b3a-bac9-3b304be66d4f