Dead-code sweep: 464 #[allow(dead_code)] attributes are hiding drift

[Hmbown]

The tree carries 464 #[allow(dead_code)] attributes across 143 files — a wall that makes the compiler structurally unable to report drift.

Measured by stripping them in place and running cargo check --workspace --all-features with and without --tests:

	Count
Dead in the shipping compile	332
Dead in both compiles (delete candidates)	135
Alive only because a test references it	197
Concentration	421 of 424 in codewhale-tui; the other 17 crates are clean

Nearly all of it is the wake of two completed direction changes whose plumbing was never removed: the rebrand off deepseek-tui (shims removed in v0.9.0) and the collapse to one constitution (the layered prompt composer survived). The third such move — retiring agent_open/agent_eval lifecycle theater — is verified clean with zero live references. That is the standard the other two should be held to.

Clusters

• cli/src/update.rs:591-680 legacy-binary handling (~90 lines of tests behind it)
• tracked npm/deepseek-tui/ plus the CI guards policing it
• sandbox/landlock.rs — 361 lines, self-documented dormant (create_landlock_wrapper returns the command unsandboxed)
• protocol/src/workroom.rs — 347 lines, Phase 2 not started since June
• a 1,153-line shadow exec-policy inside tui
• two genuinely unused deps: clap in app-server, thiserror in lane

One rename, not a deletion

crates/cli/src/bin/codew_legacy_shim.rs is the live codew binary and its own docs call it permanent. Every sweep flags it. Rename to codew.rs.

Do NOT delete

crates/lane is load-bearing despite looking like v0.8.68 scaffolding — live call sites in work_graph/runtime.rs:9, work_graph/liveness.rs:12, tui/ui.rs:10214,10237,10248, cli/src/lib.rs:661,728,930.

context_budget.rs and prompt_zones.rs appear in the dead list but only as unused methods — the files are imported. Item-level dead ≠ file-level dead, which is exactly how prior sweeps broke the build. The AGENTS.md guardrail stands.

Detail: codewhale-ops/roadmap/V0.9.2_DEAD_CODE_AUDIT.md, raw inventories in notes/dead-code-0.9.1/.

[Hmbown]

Refreshed baseline on landed main at c4e460e758d841d4cefbf805b49de316fc6f5281:

• #[allow(dead_code)]: 426 occurrences (down from 464).
• Rust files containing one or more: 111 (down from 143).
• TUI crate: 423 / 426 occurrences.

The sweep is making incidental progress, but the structural issue remains concentrated almost entirely in codewhale-tui. Keep the do-not-delete guardrail in AGENTS.md: verify consumers and distinguish item-level dead methods from live modules before removing anything. The numeric title/body baseline is now stale; use these counts for the v0.9.2 handoff.

[Hmbown]

Baseline refresh on landed main (37a2efd02, 2026-07-28). The count went up, not down.

$ grep -rn "allow(dead_code)" crates/ --include="*.rs" | wc -l
481
$ grep -rln "allow(dead_code)" crates/ --include="*.rs" | wc -l
155
$ grep -rln "allow(dead_code)" crates/ --include="*.rs" | cut -d/ -f2 | sort | uniq -c | sort -rn
 152 tui
   2 config
   1 tools

Date	Occurrences	Files
issue filed	464	143
2026-07-26 (c4e460e75)	426	111
2026-07-28 (37a2efd02)	481	155

So the "incidental progress" noted on 07-26 has been more than reversed. The 55 net new attributes arrived with two large landings this week — the cost-truth harvest (cc9cf2d2c) and incremental streaming render (89b73bdd1) — both of which introduced state structs whose accessors are currently only read by their own tests. That is exactly the drift pattern this issue exists to make visible, and it demonstrates the structural point better than any argument: without a gate, the wall regrows faster than a sweep removes it.

Named clusters, re-checked

Cluster	Status on 37a2efd02
tracked npm/deepseek-tui/ + its CI guards	done — git ls-files npm/ shows only npm/codewhale/
crates/cli/src/bin/codew_legacy_shim.rs → codew.rs rename	not done
unused clap in app-server	not done (crates/app-server/Cargo.toml:15)
unused thiserror in lane	not done (crates/lane/Cargo.toml:17)
sandbox/landlock.rs (dormant)	not done — still 361 lines
protocol/src/workroom.rs (Phase 2 unstarted)	not done — still 347 lines
cli/src/update.rs legacy-binary handling	not re-measured this pass
1,153-line shadow exec-policy inside tui	not re-measured this pass

The standing gap this issue should decide on, restated with a number

CI's Lint job runs cargo clippy --workspace --all-features --locked without --all-targets, so it never lints cfg(test) or integration-test code. Adding --all-targets surfaces ~38 pre-existing errors in test code. That matters here directly: the 07-26 stripping experiment measured 197 attributes alive only because a test references them. Those are precisely the ones a test-blind lint can never adjudicate, and they are the largest single bucket.

Recommendation

This is not a v0.9.2 finishing-pass item, and I am not going to pretend a 481-attribute sweep is a closing slice. Two concrete proposals instead:

1. Split off the bounded, zero-risk slice — the file rename plus the two genuinely unused dependencies. Three changes, no behavior, verifiable by compilation. That can land in v0.9.2.
2. Move the sweep itself to v0.9.3 and pair it with a ratchet, because the numbers above show a one-time sweep does not hold. A committed count that CI refuses to let rise is what converts this from a recurring chore into a solved problem.

Leaving the milestone alone pending your call on (2); I did not want to move a documentation-labelled tracking issue out from under the release without you seeing this measurement first.

[Hmbown]

Acting on the recommendation from the measurement above, since it was a scoping call rather than an open question.

PR #4938 lands the two things that do not require judgment:

1. The three zero-risk removals from the cluster list — codew_legacy_shim.rs → codew.rs (the rename this issue explicitly asks for, not a deletion), and the genuinely unused clap in app-server / thiserror in lane.
2. A budget ratchet, scripts/check-dead-code-budget.py, wired into Lint with the baseline recorded at today's real 482.

The ratchet is the part that matters, and the numbers are the argument for it:

When	Attributes	Files
filed	464	143
2026-07-26	426	111
2026-07-28	481	155

A sweep was already underway and the total still rose. Doing the full 480-attribute cleanup today without a gate would put us back over 480 within a fortnight — the issue's own thesis, demonstrated on its own timeline. With the ratchet in place the number is a one-way door, so incremental cleanup finally accumulates instead of evaporating.

It also covers the standing gap this issue kept raising: CI's clippy runs without --all-targets, so it never lints cfg(test) or integration-test code — and the 07-26 strip-and-check found 197 attributes alive only because a test references them. Those are exactly the ones a test-blind lint cannot adjudicate, and they are the largest single bucket.

Moving the sweep itself to v0.9.3

What remains is genuinely judgment work against the do-not-delete guardrail, and it is not a release-blocking slice:

• sandbox/landlock.rs — 361 lines, self-documented dormant (create_landlock_wrapper returns the command unsandboxed)
• protocol/src/workroom.rs — 347 lines, Phase 2 unstarted since June
• cli/src/update.rs legacy-binary handling (~90 lines of tests behind it)
• the 1,153-line shadow exec-policy inside tui
• the 197 test-only-alive attributes, which need the --all-targets decision first

Each is a keep-or-delete call with real consequences — crates/lane looked like removable scaffolding too, and is load-bearing. Rushing those into a release cut is how a guardrail gets violated.

Moving to v0.9.3. The gate ships in v0.9.2, so the cleanup that happens there is permanent.