docs: audit package reachability before removing shipped assets

[devswha]

What

Read-only audit of the npm package surface (PR-07, the final item of the
2026-09-15 maintenance series). Adds one document:
docs/operations/package-surface-audit-20260915.md. Nothing else changes.

Status: final converged-chain refresh (2026-09-16) — evidence is current

The parking condition recorded on this PR has been met: the active
maintenance chain has fully converged into dev (PR #846, #847, #849,
#850, #851 all merged; PR-06 was retired by the owner without being
defined or started). The promised one final refresh and re-measurement
was performed on the converged tree.

Identity

• Base: origin/dev 3622d3bb8667287cc089ce37b12d7bc8c385e72b (PR ci: execute the existing Redis quota regression in isolation #850 merged)
• Head: 467ca1b (refresh commit on top of merge commit a1116bfc74d8d75aa2d4ebbc7e4a9c1d3a0f4178)
• Audited/tested tree: a1116bf… + the measurement-refresh commit; integration method git merge --no-edit origin/dev (no conflicts — the chain PRs touched src/backends/*, docs/*, .github/workflows/test.yml, none of which this PR modifies)
• Effective diff vs origin/dev: the single audit document (+297 lines net; the refresh itself is +46/−42 over the parked revision)
• Historical identities (superseded): initial audit 67e0cd8… → first refresh 3c078b1…/f6d5a8d (reviewed against base b0a3934)

Re-measurement (all at the converged tree, linux x64 / Node v24.18.0 / npm 11.16.0)

Command	Result	Exit
npm pack --dry-run --json (root)	500 files, 1,521,037 B packed, 5,703,327 B unpacked	0
npm pack --dry-run --json (alias)	3 files, 628 B packed, 972 B unpacked (unchanged)	0
node scripts/release-artifacts.mjs --output-dir /tmp/maint07-release-refresh --source-sha a1116bf…	"Verified 8.7.0 release artifacts" — built, hashed (root 8164d622…, alias 63be3af3…), metadata-verified, clean-install smoked; no publish	0
npm run lint	Architecture boundaries OK — 120 module(s), 420 edge(s), 0 violation(s); CSpell 32 files, 0 issues	0
npm run release:check	metadata + retired-concepts gates pass	0
npm run check:no-private-assets	0 forbidden paths across 503 packed + 1388 tracked file(s)	0
npm run benchmark:perf -- --costmetrics	npm tarball 1,521,037 B; CLI coldstart 75.05 ms mean over 3 fresh processes; analyzer p50 0.202–2.072 ms across 7 fixtures; generated files restored to HEAD	0

One factual correction found during re-measurement and fixed in the doc:
the artifacts/rebaseline-2025/ shipped-file count read "7 files" but the
packed list has always contained 6 files at the recorded 439,339 B total.

Review status (recorded honestly)

The independent read-only review PASS recorded on this PR covered head
f6d5a8d against base b0a3934 — that verdict applies to the audit's
qualitative content (reachability analysis, candidate table, dispositions),
which this refresh does not change. The refresh itself is measurement-only
(SHAs, byte counts, hashes, and the validation record). No fresh
model-backed review was run for the refresh; merge is at the owner's
instruction to complete the maintenance series.

Why (Issue omission)

Documentation-only audit with no behavior, contract, or packaging change —
low-risk exemption per docs/WORKFLOW.md P02a; the work item is PR-07 of the
owner-issued maintenance plan.

Conclusion

Unchanged by the refreshed evidence: KEEP / NO PR-08 FOLLOW-UP.

Rollback

Revert the single document (two commits + merge commit on this branch).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
patina	Ready	Preview	Sep 15, 2026 3:37pm UTC