chore: scan packages/** with fallow instead of ignoring it (#1591)

`ignorePatterns: ["packages/**"]` landed in #1494 W0 with the recorded
reason "its resolver cannot follow workspace specifiers". That was either
wrong at the time or never re-checked: the fallow version has not moved
(^2.95.0 then and now) and it resolves @agent-device/* through each
package's exports map today. packages/kernel alone exposes 8 subpaths and
~110 exports reachable only via workspace specifiers, and scanning it
reports zero findings — a resolver that could not follow the specifier
would report all of them.

The cost of the ignore is that every package extraction silently removes
its code from dead-code analysis. #1589 moved the selector engine into
packages/selectors/ and shipped a façade with 15 zero-consumer exports,
including `selectorUsesKey`, written in that PR and never called. A
follow-up commit removed them by hand; nothing would have caught them.

Removing the pattern surfaced 43 findings, driven to zero by deleting the
dead code rather than by baselining or excluding it (fallow-baselines/*.json
are empty on purpose — the posture is fix-or-document-the-exemption, so a
first baseline entry would be a policy change):

- 38 are deleted. 24 façade type re-exports whose only claim was that a
  consumer might one day want to name them — typecheck is green without
  every one, so the claim was theoretical; 5 façade value re-exports; 9
  `export` keywords on symbols used only inside their own file. Every
  deleted façade symbol comes off scripts/layering/facade-symbols.ts (and
  ad-replay's inline pin in package-boundaries.test.ts) in the same change,
  so R11 is narrowed with the façade, never weakened around it.
- 4 stale suppressions in src/provider-limrun-runtime.ts existed only
  because packages/ was invisible.
- 5 have consumers analysis genuinely cannot see, and get an
  `ignoreExports` entry naming the consumer per the existing `comment`
  convention: four test-tree importers that --production does not walk, and
  `LimrunIosCommandExecution`, which src/sdk/limrun.ts republishes as
  agent-device/limrun — its only importer compiles in a temp checkout, so
  no static edge reaches it. test/integration/limrun-public-types.test.ts
  is the standing proof that one is real API.

Three doc comments named types their façade no longer exports and are
corrected rather than left asserting something false — including #1555's
claim in session-replay-target-verification.ts that the daemon imports
`AdReplayVerifiedTargetGuard` directly. It does not; it reaches that shape
through `AdReplayTargetClassification`/`AdReplayDispatchGuard`, which is
why the name read as dead.

`scripts/maestro-conformance/**` was ignored wholesale to cover its corpus
data. Narrowed to `corpus/**`, which un-hides the tooling beside it and
turned up one more file-local export (`buildManifest`); regenerate.mjs's
importer of `fixtureContentHash` becomes visible, so that needs no
exemption at all.

scripts/check-affected/model.ts deliberately did not select the `fallow`
check for packages/*/src/**, carrying the same stale rationale as a
comment. Without that selection the new scope would never run in the
affected-driven lane, so the ignore removal would have bought nothing.
model.test.ts now pins the selection.

Verified: check:fallow and check:production-exports green with packages in
scope; full-repo `fallow dead-code` back to its one pre-existing finding;
typecheck, layering (R11), lint, format, build, check:package, and the
limrun published-types integration test all pass. Probed by adding a fresh
zero-consumer export to the xml façade — check:production-exports reports
it, so the #1589 case now fails the gate.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: thymikee

.fallowrc.json

@@ -34,11 +34,10 @@
     "website/rspress.config.ts"
   ],
   "ignorePatterns": [
-    "packages/**",
     "examples/test-app/**",
     "scripts/perf/**",
     "scripts/layering/**",
-    "scripts/maestro-conformance/**",
+    "scripts/maestro-conformance/corpus/**",
     "apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests.xctestplan",
     "scripts/write-xcuitest-cache-metadata.mjs",
     "scripts/help-conformance-sample-outputs.d.mts"
@@ -119,6 +118,26 @@
       "comment": "#1458: getSessionCommandKind's former production consumer (the session.ts if-chain) was replaced by SESSION_COMMAND_HANDLER_IMPLS, which encodes command-kind groupings directly via shared handler references instead of a kind lookup. The accessor and its SessionCommandKind classification remain covered by daemon-command-registry.test.ts, a test-tree file outside --production analysis.",
       "file": "src/daemon/daemon-command-registry.ts",
       "exports": ["getSessionCommandKind"]
+    },
+    {
+      "comment": "Workspace-package symbols whose only consumers are test-tree files, which --production analysis does not see. Each import is the package specifier, so the façade entry is load-bearing: parseTargetAnnotationV1Payload/TARGET_ANNOTATION_MAX_FIELD_BYTES from src/daemon/__tests__/session-target-evidence.test.ts, MAESTRO_COMPAT_* from src/cli/parser/__tests__/maestro-support-matrix.test.ts.",
+      "file": "packages/{ad-script,maestro}/src/index.ts",
+      "exports": [
+        "parseTargetAnnotationV1Payload",
+        "TARGET_ANNOTATION_MAX_FIELD_BYTES",
+        "MAESTRO_COMPAT_LIMITATIONS",
+        "MAESTRO_COMPAT_SUPPORTED_CAPABILITIES"
+      ]
+    },
+    {
+      "comment": "Deliberately kept off the @agent-device/maestro façade (index.test.ts asserts its absence) and consumed only by the conformance harness under packages/maestro/test/.",
+      "file": "packages/maestro/src/internal/program-ir-command-parser.ts",
+      "exports": ["SUPPORTED_MAESTRO_COMMAND_NAMES"]
+    },
+    {
+      "comment": "Published type surface: re-exported by src/sdk/limrun.ts to agent-device/limrun, where test/integration/limrun-public-types.test.ts pins that consumers can import it. Its only importer compiles in a temp checkout, so no static in-repo edge reaches it — the same reason src/sdk/*.ts is exempt above.",
+      "file": "packages/provider-limrun/src/index.ts",
+      "exports": ["LimrunIosCommandExecution"]
     }
   ],
   "usedClassMembers": ["name", "listActiveLeases", "delete", "values", "elapsedMs", "isExpired"],

packages/ad-replay/src/index.ts

@@ -64,8 +64,8 @@
  * and the classification/guard/binding-evidence/verification-routing shapes
  * `verifyAndDispatchStep` exchanges with the daemon's `AdReplayStepRuntime`
  * implementation (`AdReplayVerificationEntry`, `AdReplayTargetClassification`,
- * `AdReplayTargetBindingEvidence`, `AdReplayVerifiedTargetGuard`,
- * `AdReplayDispatchGuard`, `AdReplayDispatchOutcome`) ARE named here: the
+ * `AdReplayTargetBindingEvidence`, `AdReplayDispatchGuard`,
+ * `AdReplayDispatchOutcome`) ARE named here: the
  * daemon builds/reads real values of these shapes directly now (routing in
  * `session-replay-target-verification.ts`, wire-narrowing in
  * `session-replay-runtime-engine-adapter.ts`) rather than re-declaring a
@@ -99,7 +99,6 @@ export type {
   AdReplayTargetClassification,
   AdReplayVarSources,
   AdReplayVerificationEntry,
-  AdReplayVerifiedTargetGuard,
 } from './internal/runtime-port-types.ts';
 
 export type {

packages/ad-replay/src/internal/step-loop.ts

@@ -224,9 +224,7 @@ function resolveActionLoc(
  * lifecycle-skipped, never dispatched or expanded (native `.ad` has no
  * include grammar).
  */
-export function isExecutableReplayAction(
-  action: SessionAction | undefined,
-): action is SessionAction {
+function isExecutableReplayAction(action: SessionAction | undefined): action is SessionAction {
   return Boolean(action && action.command !== 'replay');
 }
 
@@ -249,7 +247,7 @@ export function isExecutableReplayAction(
  * nor included in the successful `replayed` count, exactly like the `replay`
  * pseudo-command just above it in the loop.
  */
-export function resolveSuppressedTerminalCloseIndex(
+function resolveSuppressedTerminalCloseIndex(
   actions: readonly SessionAction[],
 ): number | undefined {
   for (let index = actions.length - 1; index >= 0; index -= 1) {

packages/ad-replay/src/internal/target-verification.ts

@@ -177,7 +177,7 @@ export type ReplayPostDispatchMismatchEvidence = {
 };
 
 /** A `position:` mismatch line from the guard's structural denotations, when both are present and differ. */
-export function describeStructuralMismatch(
+function describeStructuralMismatch(
   expected: AdReplayTargetStructuralDenotation | undefined,
   observed: AdReplayTargetStructuralDenotation | undefined,
 ): string | undefined {

packages/ad-script/src/index.ts

@@ -66,12 +66,8 @@ export {
 } from './internal/script-formatting.ts';
 
 export {
-  normalizeIdentifierField,
-  normalizeLabelField,
-  normalizeRoleField,
   parseTargetAnnotationV1Payload,
   serializeTargetAnnotationV1,
-  truncateToUtf8Bytes,
   utf8ByteLength,
   TARGET_ANNOTATION_MAX_ANCESTRY,
   TARGET_ANNOTATION_MAX_FIELD_BYTES,
@@ -92,16 +88,9 @@ export {
   siblingOrdinal,
   structuralDenotationsEqual,
 } from './internal/target-annotation-identity.ts';
-export type {
-  LocalIdentity,
-  NodeStructuralDenotation,
-} from './internal/target-annotation-identity.ts';
+export type { LocalIdentity } from './internal/target-annotation-identity.ts';
 
 export { classifyTargetBindingMatch } from './internal/target-annotation-classification.ts';
-export type {
-  TargetBindingClassification,
-  TargetBindingClassificationInput,
-} from './internal/target-annotation-classification.ts';
 
 export {
   buildReplayVarScope,
@@ -112,4 +101,3 @@ export {
   readReplayShellEnvSource,
   resolveReplayAction,
 } from './internal/vars.ts';
-export type { ReplayVarScope } from './internal/vars.ts';

packages/maestro/src/internal/conformance-normalize.ts

@@ -325,7 +325,7 @@ function numLike(value: unknown): number | string | undefined {
   return undefined;
 }
 
-export function dropUndefined<T extends Record<string, unknown>>(value: T): T {
+function dropUndefined<T extends Record<string, unknown>>(value: T): T {
   for (const key of Object.keys(value)) {
     if (value[key] === undefined) delete value[key];
   }

packages/maestro/test/conformance/verify.ts

@@ -64,7 +64,7 @@ function readJson<T>(file: string): T {
   return JSON.parse(fs.readFileSync(file, 'utf8')) as T;
 }
 
-export const FIXTURE_FILES = ['layer1-parser.json', 'layer2-semantics.json'] as const;
+const FIXTURE_FILES = ['layer1-parser.json', 'layer2-semantics.json'] as const;
 
 export function loadLayer1(): Layer1Fixture {
   return readJson(path.join(FIXTURES_DIR, 'layer1-parser.json'));
@@ -198,7 +198,7 @@ export function checkLayer2(): Layer2Result[] {
 export type CoverageResult = { command: string; covered: boolean; unverified: boolean };
 
 /** Which native agent-device command kinds each corpus flow parses to. */
-export function agentKindsByCorpus(): Set<string> {
+function agentKindsByCorpus(): Set<string> {
   const kinds = new Set<string>();
   for (const flow of loadLayer1().flows) {
     // Rejected flows contribute nothing to coverage; a crash still throws.

packages/provider-limrun/src/index.ts

@@ -1,10 +1,6 @@
 export { LIMRUN_PROVIDER } from './device.ts';
 export { createLimrunRuntime, type LimrunRuntime, type LimrunRuntimeOptions } from './runtime.ts';
-export {
-  verifyLimrunConnection,
-  type LimrunConnectionVerification,
-  type LimrunConnectionVerificationOptions,
-} from './connection-verification.ts';
+export { verifyLimrunConnection } from './connection-verification.ts';
 
 export type { LimrunRuntimeDependencies } from './runtime-dependencies.ts';
 

packages/provider-webdriver/src/aws-device-farm.ts

@@ -247,7 +247,7 @@ export function createAwsDeviceFarmPrepareSession(
   };
 }
 
-export function selectAwsDeviceFarmWebDriverEndpoint(
+function selectAwsDeviceFarmWebDriverEndpoint(
   session: AwsDeviceFarmRemoteAccessSession,
 ): string | undefined {
   const endpointValues =

packages/provider-webdriver/src/browserstack-device-features.ts

@@ -128,9 +128,7 @@ export function buildBrowserStackDeviceFeatureCapabilities(
  * and then silently dropped — the session runs with provider defaults and nothing says why.
  * Callers use this to reject them at the point the provider is known.
  */
-export function browserStackOnlyDeviceFeatureFlags(
-  flags: Record<string, unknown> | undefined,
-): string[] {
+function browserStackOnlyDeviceFeatureFlags(flags: Record<string, unknown> | undefined): string[] {
   return BROWSERSTACK_DEVICE_FEATURE_SPECS.filter((spec) => {
     const value = flags?.[spec.field];
     return value !== undefined && value !== false && value !== '';