refactor: repo-wide deslop (net −51.8k lines)

[iamjr15]

Full-repo deslop: net −51,800 lines (−24%), 146 files removed, executed as seven gate-verified waves plus an adversarial regression-review pass.

What changed

• Vendored Office tooling deduplicated (−45,082): skills/{docx,pptx,xlsx}/scripts/office were byte-identical; one copy now lives at skills/_shared/office and the sandbox Dockerfile materializes all three paths at image build. pnpm turbo skills:build output is byte-identical.
• Gateway OpenAPI subsystem removed (−1,575): zero consumers (no codegen, docs site, or fetches). Telemetry now keys on Hono route templates; rate-limit buckets key on route templates (old-format buckets age out).
• packages/db restructured: the hand-maintained supabase-target* schema mirror (2,904 LOC) became a 720-LOC migration smoke+invariant gate under scripts/supabase-target/; the three lease-queue implementations share one generic core (SQL semantics preserved op-by-op); research workflows deduplicated.
• Workers refactored: Durable Object calls converted from hand-rolled HTTP-over-fetch to native RPC (SSE stream stays on fetch); three deletion workflows share one job-runner; four workers share one bootstrap/error runtime; the ProjectSandbox facade is a lease-policy table (276→82 lines).
• Dead code purged: dead routes (/v1/tools, /v1/agents, sandbox file API replaced by the code-server IDE, runs/status), write-only stream parts (schemas retained for historical transcripts), 55% of web CSS, single-use wrappers, barrel bloat, config husks.
• Bug fixes: web proxy matcher now guards /pricing+/usage (and drops nonexistent routes); stale app_worker role reference removed; SkillRuntimeScopeSchema single-sourced in @cheatcode/types.
• Gate hardened: pnpm deadcode now runs knip with includeEntryExports (it previously could not flag any dead export) and reports zero findings.

Deliberately kept

Gateway idempotency DO layer (an adversarial concurrency trace proved it load-bearing: post-commit/pre-DO-start duplicate-POST race), api/health, the daily-maintenance activation phase, Ultra/Max env plumbing, generated-manifest.ts tracking (Vercel affected-detection).

Regression pass

An independent review of the refactor commits found and this branch fixes: gateway error responses losing CORS/security headers (proven fixed live: cross-origin 401 carries ACAO+CSP+HSTS), webhook store outages surfacing 500 instead of retriable 503, a blind row-cast that could permanently drop a webhook, four over-deleted migration invariant validators (restored), preview-proxy leaking X-Request-Id upstream.

Verification

lint / typecheck / turbo build --force (23/23 cold) / deadcode (0 findings) / architecture:check / skills:build manifest-stable — all green post-merge with origin/main (upload-guard + restoreUploadedFiles work ported into the new facade). Live smoke via direct agent-browser: home, signed-out auth redirects for /pricing+/usage, signed-in /usage, historical chat transcript rendering.

Deploy notes: sandbox snapshot rebuilds on merge (Dockerfile materialization step); gateway telemetry route labels change format once (analytics series discontinuity).