Over-engineering audit burn-down (ponytail, 2026-09-20)

[devinmlowe]

Summary

A whole-tree over-engineering audit (six parallel read-only passes over src/, scripts/, interfaces/, tests/, packaging and CI) found roughly 9,800 tracked lines and four npm dependencies that can be removed without changing behaviour, plus a 2.8 MB duplicate asset and about 1,840 lines of untracked loop artifacts.

Baseline before any cut: npm run build clean, npm run test:run 137 files / 1798 tests passing (2026-09-20).

Ground rules for every sub-issue

• Run npm run build and npm run test:run before starting and after finishing. Both must stay green; the test count may only drop by tests that covered deleted code, and the PR must say which ones.
• Work in a git worktree on a branch named ponytail/<slug>; merge to main with --no-ff.
• Cuts that would remove a shipped or documented feature are labelled needs-decision and are not implemented until the maintainer confirms.

Sub-issues

Tracked as GitHub sub-issues below. Each one lists the exact findings (tag, file, estimated lines) it covers.

Findings not turned into work

• DoctorContext / SetupDeps dependency injection: the injection exists so the doctor and setup test suites can run without touching the machine. Removing it would delete those tests. Kept.
• Bridge re-opening the daemon session under the host's clientInfo: this is decision Decision: plugin: MCP transport — npx stdio or HTTP daemon? #60 (the forget actor must be the host, not engram-bridge). Kept.