chore(audit): Wave 3 stale docs/code scout (find-only)

docs/audits/stale-2026-09-22.md

@@ -0,0 +1,143 @@
+# Stale docs/code scout — 2026-09-22
+
+Wave 3 find-only inventory after Waves 1→2c (2026-09-21).
+**No deletes. No renames. No product refactors.** This file is the only delivery.
+
+Parent: WalksWithASwagger/wedges#36 · epic kk-kb#3684
+Prior audit: [`docs/audits/stale-2026-09-21.md`](./stale-2026-09-21.md)
+
+## Method
+
+Read `docs/audits/stale-2026-09-21.md` first. Re-read every repo markdown file and
+`public/llms.txt` on `main` at `8702d3b` (Wave 2c). Compared issue/PR language
+to live GitHub state on 2026-09-21 (tracker clock) / 2026-09-22 (this scout):
+
+| State | Numbers |
+| --- | --- |
+| Open issues | #17, #19–#23, #36 |
+| Closed since Wave 1 | #30 (Wave 1), #32 (Wave 2b), #34 (Wave 2c) |
+| Still closed | #1, #9, #11, #13–#16, #18 |
+| Merged PRs cited here | #10, #12, #24–#28, #31, #33, #35 |
+
+Re-checked Wave 2b (`4293545` / PR #33) and Wave 2c (`8702d3b` / PR #35) against
+the D1–D12 and C1–C2 rows. Those repairs still match the tree. Did **not**
+re-list them as current findings.
+
+Checked internal relative links by file existence (decoded `%5B`/`%5D` path
+segments; line-anchor targets for the release-readiness report). Grepped
+`TODO`/`FIXME`, leftover “this PR / this branch / unmerged / invite-only”
+current-state voice, `export` symbols vs importers, `package.json` scripts vs
+`scripts/`, and `public/` leftovers.
+
+**Not run (hard gates):** outbound HTTP, live `wedges.dev` probes, Vercel/Redis
+admin, `npm audit`, secret inspection, paid evals.
+
+## Counts
+
+| Bucket | Wave 1 | This scout |
+| --- | ---: | ---: |
+| New stale docs | 12 | **0** |
+| New likely-dead code | 3 | **0** |
+| p0 / p1 / p2 (new) | 0 / 8 / 7 | **0 / 0 / 0** |
+
+**Zero new findings.** Trunk is clean of *new* stale-doc / dead-code rows after
+Waves 2b/2c. Remaining items below are either still-open from Wave 1 (left on
+purpose) or product scope.
+
+---
+
+## Stale docs
+
+No new rows. Closed/merged issue refs in current-state docs now use closed
+language (`closed #14` / `#15` / `#18`; open `#17` / `#19` / `#20` / `#22`).
+No internal markdown path 404s. Line anchors that Wave 2b repaired still land:
+
+| Link | Target on `8702d3b` |
+| --- | --- |
+| `lib/club/store.ts#L364` | `isStoreConfigured()` |
+| `lib/rate-limit.ts#L27` | `class MemoryStore` |
+| `app/api/[transport]/route.ts#L137` | `checkRateLimit("critique", …)` |
+| `lib/exercises/critique.ts#L20` | `generateObject({` |
+
+Dated evidence sections that *record* old test counts, worktree ports, or the
+#16 report’s own `git.deploymentEnabled` delivery exception remain historical
+snapshots. Wave 2c already banners that leftover swarm-branch guards were
+removed. Not re-listed.
+
+Homepage footer now says rooms are share-link readable, matching
+`docs/film-club.md` and open #19.
+
+---
+
+## Likely-dead code
+
+No new rows. Re-verified Wave 1 “checked, not dead” and the leftover C3 types.
+
+Do not treat appearance as proof of death. Each leftover export was checked
+against imports, tests, scripts, MCP registration, and runtime entry points.
+
+Same-file type/helper exports (`ENV_KEY_LIMIT`, `BYO_KEY_LIMIT`,
+`findSelectorChoice`, `validatePng`, Club input types, visual-experiment
+`SYSTEM` / `Runner`, and similar) are consumed inside their defining modules
+or by live callers. They are not newly orphaned.
+
+`scripts/eval-visual-critique.ts` is still unregistered in `package.json` on
+purpose. Docs and `node --import tsx scripts/eval-visual-critique.ts --offline`
+still consume it. Open #22 remains the product gate — left alone.
+
+No `TODO`/`FIXME` pointing at merged issues. No commented-out blocks that
+reference removed features. Create-next-app `public/*.svg` files are gone.
+`vercel.json` no longer lists merged `codex/*` branch guards.
+
+---
+
+## Delta vs 2026-09-21
+
+### Fixed (Wave 2b PR #33 · `4293545`)
+
+D1–D8. Current-state review/club docs and the homepage footer no longer treat
+closed #14/#15/#18 as open, no longer present-tense an unmerged #12 deploy
+ban, and the store-config line anchor now hits `isStoreConfigured()`.
+
+### Fixed (Wave 2c PR #35 · `8702d3b`)
+
+D9–D12, C1, C2. Film Club Redis note is main-branch voice; README map includes
+the shipped review/visual files; `llms.txt` lists Dark Crystal and
+unofficial.city; ROADMAP records #18 / PR #28; `vercel.json` swarm-branch
+guards and unused create-next-app SVGs are gone.
+
+### Still open (not new)
+
+| # | Path | Status after re-check | Wave 4 |
+| --- | --- | --- | --- |
+| C3 | `lib/rate-limit.ts` | `Bucket`, `RateLimitConfig`, and `RateLimitResult` are still exported with no importers outside this file. `checkRateLimit` / `ENV_KEY_LIMIT` / `BYO_KEY_LIMIT` remain live. Wave 2c left these types on purpose. Same evidence as Wave 1 — not reclassified. | verify-with-human |
+
+### Newly found
+
+None.
+
+---
+
+## Out of scope
+
+Noticed, not turned into Wave 4 work:
+
+- Live public-URL, firewall, Redis, or provider-spend verification (no outbound).
+- Refreshing the 13-advisory `npm audit` snapshot.
+- GitHub tracker #23 still recommending “assign #18” after #18 closed (tracker
+  copy, not a repo doc; Film Club atomic work is product scope).
+- Duplicate `AGENTS.md` / `CLAUDE.md` and the host-local Varlock doc path.
+- `WEDGES_SITE_URL` used by CI/search-smoke but absent from `.env.schema`.
+- Historical dated test counts and leftover PR-worktree voice inside
+  implementation-evidence sections.
+- Remaining real product gates: #17, #19–#22.
+- Open #22 visual-review packet and Film Club atomic / Redis integration
+  evidence (`docs/film-club.md` correctly says unverified on main after #28).
+- Dark-crystal ceremony / booth ritual drafts (none in this trunk).
+- Any delete, rename, or refactor of product code.
+
+## Recommended next step
+
+No new Wave 4 docs/code cleanup ticket is justified from this scout. Leave C3
+and the open product issues for a human. Close this Wave 3 inventory once
+reviewed.