chore: delete orphaned mechanisms and enforce the rule in CI

[chubes4]

Implements the rule proposed in #601 §6, and applies it.

Why this is the follow-up to #601

#601 was not really a bug about sudoers. lib/systems-capabilities.sh had a correct, validated grant installer; its only consumer was retired; the function stayed with zero call sites. The next component that needed a grant didn't find it and wrote its own — which installed the file before validating it, and could leave a rejected policy in /etc/sudoers.d that locks every user out of sudo.

The duplicate was the symptom. The cause is that an orphaned mechanism is invisible: it reads as supported infrastructure, it has a docblock describing what it does, and nothing tells the next author it's already dead.

Judgement doesn't catch this — two implementations of sudoers installation survived months of review. A grep does, cheaply, on every push.

What the audit found

Ten functions, 120 lines. Most are one story: vestigial entrypoints left behind by the convergence refactor.

runtime_guidance_desired_state_apply()  { reconciler_apply_plan; }
runtime_guidance_desired_state_verify() { reconciler_verify_plan; }
integration_adapters_verify()           { reconciler_verify_plan; }

Once convergence_apply / convergence_verify became the single entrypoint, each module's own apply/verify pass-through stopped being called and stayed — three alternative front doors to one room, all bricked up.

install_chat_bridge is the sharpest example. Its docblock:

install_chat_bridge — setup-time entrypoint, dispatched from setup.sh.

setup.sh has gone through the convergence orchestrator for some time and never calls it. The comment documents an architecture that no longer exists, which is worse than no comment: it's a confident wrong answer to "how does the bridge get installed?"

The rest: reconciler_mark_changed (a dead twin of reconciler_adapter_changed, which has 14 call sites — the same duplicate-mechanism shape as #601, caught before it could be the survivor), runtime_sync_instructions in runtimes/codex.sh (a hook the contract dropped in favour of runtime_generate_instructions, which all three runtimes implement), homeboy_json_array, _datamachine_worker_shell_quote, and _resolve_claude_code_agent_slug.

Dead code hides more dead code. Removing _resolve_claude_code_agent_slug orphaned _dm_agent_slug_exists, its only consumer — caught on the audit's next pass. Run to a fixpoint, the repo is clean.

On _resolve_claude_code_agent_slug specifically: it's unreachable, so AGENT_SLUG already stays empty on upgrade unless --agent-slug is passed. That is a handled state — hooks/dm-agent-sync.sh falls back to discovering all active agents, as the function's own comment said it would. Behaviour is unchanged by deleting it. If pinning a single agent on upgrade is wanted, it should be wired to a caller, not left as a 37-line unreachable statement of intent.

The check

tests/dead-mechanism.sh, wired into CI. Bash dispatches indirectly, so a function can be live without its name ever appearing at a call site. Rather than hardcode the dispatchers, it reads the prefixes out of the source:

indirect-dispatch prefixes discovered: bridge_, bridge_service_adapter_apply_,
                                       bridge_service_adapter_verify_, guidance_

so a new dispatcher is understood the moment it's written. Anything under a discovered prefix is treated as reachable — a deliberate blind spot, documented in the file. Dead code under bridge_ or guidance_ won't be caught. Narrow and honest beats broad and wrong: a checker with false positives gets an allowlist, then gets ignored, then gets deleted. ALLOWED exists and is empty; if it grows, the rule is being worked around rather than followed.

Before:

audited 579 production functions across 51 files
9 function(s) defined with no reachable caller

After, at fixpoint:

audited 569 production functions across 51 files
no orphaned mechanisms

Verification

Full suite on Linux: 71 pass, 4 fail. The same 4 fail on a pristine main clone on the same host — datamachine-worker, opencode-general-dispatch, opencode-subagents, workspace-materialization — all environment-dependent there (/tmp is world-writable, wp resolves to an absolute path), not regressions. Verified by cloning main and running them side by side rather than assuming.

bash -n clean across every .sh. No dangling references to any removed name. tests/ci-coverage.sh — the sibling check that catches tests CI never runs — passes with the new job wired.

---

AI assistance: audited and implemented by Claude Opus 4.5 via Claude Code, driven by Chris. The model wrote the reachability audit, manually verified its output against the dispatchers to confirm zero false positives before trusting it, removed the dead set to a fixpoint, and ran the full suite against both this branch and pristine main on a Linux host to separate regressions from pre-existing environmental failures.