build(typescript): enable noUnusedLocals/noUnusedParameters repo-wide (#9553, #9570, #9571, #9572) (#9573)

* build(typescript): enable noUnusedLocals/noUnusedParameters repo-wide (#9553)

Dead code is the substrate every drift bug in the 2026-07-27 audit grew on: a stale
import or an orphaned constant reads exactly like a live wire, so the next person
greps, finds it, and reasons about a code path that no longer runs.

Enabling the flags made the compiler enumerate all 515 instances. Every one in
src/** and packages/** was traced to its replacement before deletion -- all 82 were
genuine supersession leftovers, no behaviour bug hiding among them -- but the triage
turned up three real problems that were invisible under the noise:

1. src/queue/processors.ts -- sweepRepoBacklogConvergence accepted `requestedBy`
   ("schedule" | "api" | "test") and dropped it. Every sibling sweep stamps it into
   recordAuditEvent's metadata; both agent.sweep.backlog_convergence events here
   omitted it, so those records could not be attributed to a schedule vs a manual API
   trigger. Now wired into both. (Note the mechanical fix would have been to rename it
   `_requestedBy`, which cements the gap instead of closing it.)

2. test/unit/openapi.test.ts -- the #9302 REST<->MCP parity guard asserted against
   src/mcp/server.ts's gatePrecisionOutputSchema and maintainerMeasurementReportOutputSchema,
   which the tools stopped registering when #9518 moved their outputs to
   @loopover/contract. The shapes are still identical, so nothing had drifted YET --
   but the guard was watching objects no runtime reads and would not have caught a
   future contract change. Re-anchored onto GetGatePrecisionOutput.shape /
   GetOutcomeCalibrationOutput.shape, which is what the tools actually register, and
   what that file's own header comment already claimed it did.

3. src/github/resolve-command.ts was reachable only from its own test, because
   src/review/review-memory-wire.ts carried a SECOND byte-identical copy of
   normalizeResolveFindingRef (regex included) and that copy was the one production
   used. Two independent implementations of the same public-safety validation, free to
   drift. Deduped onto the original via re-export; dead-source-files:check now passes
   on a file it was about to start failing on.

Also corrects packages/loopover-engine/src/scoring/preview.ts's header, which claimed
a ReDoS guarantee via a hasUnsafeWildcardCount import that had been dead since
625e236 deduped its label matching onto label-match.ts. The guarantee is real and
unchanged; it now arrives through labelMatchesPattern, and the comment says so.

Pre-existing import-specifier violations fixed in the same pass, since the tree has to
be green for the flags to mean anything:
- scripts/actionlint.ts imported a `.ts` specifier (TS5097)
- test/unit/contract-registry.test.ts had three `.js` specifiers in a Bundler zone
- check-dead-source-files-script.test.ts tripped check-import-specifiers on its own
  string FIXTURES, the same self-referential false positive that checker's
  ALLOWED_FILENAMES already documents for its own test

Mechanics: unused parameters are renamed with a leading underscore, never deleted --
they are positional, so removing one silently re-binds every later argument. Everything
else was removed by its real TypeScript AST node span (a regex pass was tried first and
mis-bounded declarations badly enough to produce unparseable files).

Full suite green: 23,894 passed, 0 failed. tsc clean with the flags on.

* chore(engine): bump to 3.15.4 for the dead type-import removal in gate-advisory.ts

check-engine-parity holds the two hand-duplicated gate-decision twins
(packages/loopover-engine/src/advisory/gate-advisory.ts and src/rules/advisory.ts)
in lockstep: touching one without the other requires an engine version bump. That is
the mechanism, and it is doing its job here.

the engine twin. They are genuinely dead there and NOT in the host: the engine copy is
a deliberately slimmed re-implementation (#4881) that omits buildIssueAdvisory /
addIssueFindings / collisionClustersForPull, which are what use those types on the host
side. So there is no matching host edit to make -- the asymmetry is correct, and the
version bump is the sanctioned way to record it.

No behaviour change: type-only imports are erased at compile time. The bump exists so
the parity contract stays enforceable, not because the gate decides anything
differently. packages/loopover-miner/expected-engine.version moves in lockstep, as its
own check requires.

* fix(scripts,mcp): restore actionlint's `.ts` specifier and drop a dead shape #9565 added

Two rebase follow-ups after #9565 and #9574 landed.

1. scripts/actionlint.ts gets its `.ts` extension back. This PR had removed it to satisfy
   check-import-specifiers, which broke the script outright -- it runs under
   `node --experimental-strip-types`, whose ESM resolver does no extension resolution, so
   the process dies at startup with ERR_MODULE_NOT_FOUND. #9565 independently reached the
   same conclusion and added TYPE_STRIPPED_ENTRYPOINTS to the checker for exactly this
   file, so the extension is now permitted where it is required. Verified by running
   `npm run actionlint`, which fails before this change and passes after.

   #9565's version of the checker is taken wholesale over this PR's: it solves the same
   two problems (that entrypoint set, plus allowlisting check-dead-source-files-script.test.ts
   for its string fixtures), and re-litigating a file main just rewrote buys nothing.

2. src/mcp/server.ts's `loginRepoPullShape` is removed -- dead on arrival in #9565, and
   the first thing the newly-enabled noUnusedLocals caught on main. Which is the point of
   this PR: dead code now surfaces at the commit that introduces it rather than at the next
   audit.

The engine bump lands at 3.16.1 (main released 3.16.0 while this was open). It is required
by check-engine-parity: this PR removes two dead TYPE-only imports from
packages/loopover-engine/src/advisory/gate-advisory.ts, and the parity contract holds that
file in lockstep with its host twin src/rules/advisory.ts. There is no matching host edit to
make -- the engine copy is a deliberately slimmed re-implementation (#4881) omitting the
functions that use those types -- so the version bump is the sanctioned way to record a
one-sided change. No behaviour change: type-only imports are erased at compile time.
packages/loopover-miner/expected-engine.version moves with it, as its own check requires.

* chore(release): sync .release-please-manifest.json to the 3.16.1 engine bump

The manifest is a generated artifact that must move with any package.json version, and
release-manifest:sync:check fails CI when it drifts. Regenerated with the repo's own
`npm run release-manifest:sync` rather than hand-edited.

* chore: prune the dead symbols the new flags caught in newly-merged code

Rebase onto main after #9579 and #9580 landed. The newly-enabled noUnusedLocals
immediately flagged twelve dead symbols in code merged since this PR opened -- including
two I left in #9580 myself:

  - src/queue/processors.ts: PrCommandPrologueOutcome imported but unused (the adapter's
    annotated return type was dropped in favour of inference), plus eight unused bindings
    in the prologue destructures -- handlers that do not need `pr`, `settings`,
    `authorization` or `command` were still pulling them out.
  - src/queue/pr-command-prologue.ts: LoopOverMentionCommandName, superseded by
    LoopOverActionCommandName once the spec narrowed to action verbs.
  - src/mcp/dispatch-telemetry-sink.ts: an unused McpToolCallTelemetry import from #9579.

Which is the point of the PR: the flags catch dead code at the commit that introduces it
rather than at the next audit. Zero behaviour change -- every removal is a binding or an
import TypeScript proved unreferenced, and the suite passes 24,014 tests.

The rebase conflict itself was in processors.ts's import block: main added the
pr-command-prologue import on the same lines this PR removed the unused runRetentionPrune
one. Both intents kept.

Author: JSONbored

.release-please-manifest.json

@@ -1,6 +1,6 @@
 {
   "packages/loopover-mcp": "3.15.2",
-  "packages/loopover-engine": "3.16.0",
+  "packages/loopover-engine": "3.16.1",
   "packages/loopover-miner": "3.15.2",
   "packages/loopover-ui-kit": "1.2.0"
 }

packages/loopover-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loopover/engine",
-  "version": "3.16.0",
+  "version": "3.16.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Shared deterministic engine logic for the LoopOver review stack and loopover-miner.",

packages/loopover-engine/src/advisory/gate-advisory.ts

@@ -13,11 +13,10 @@ import type {
   AdvisoryFinding,
   AdvisorySeverity,
   GateRuleMode,
-  IssueRecord,
   PullRequestRecord,
   RepositoryRecord,
 } from "../types/predicted-gate-types.js";
-import type { CollisionReport } from "../types/predicted-gate-types.js";
+import type { } from "../types/predicted-gate-types.js";
 import { isDuplicateClusterWinnerByClaim } from "../signals/duplicate-winner.js";
 import type { GuardrailPathMatch } from "../signals/change-guardrail.js";
 import { nowIso } from "../utils/json.js";

packages/loopover-engine/src/config-lint.ts

@@ -51,11 +51,6 @@ function recognizedFieldsFor(text: string | null | undefined): string[] {
   );
 }
 
-// Fields retired from TOP_LEVEL_FIELDS that still warrant a migration-specific warning (rather than the
-// generic "unknown field" message) pointing operators at their replacement mechanism.
-const RETIRED_FIELD_MIGRATION_WARNINGS: Record<string, string> = {
-  blockedPaths: "blockedPaths is retired; use settings.hardGuardrailGlobs for path holds.",
-};
 
 // #9167: gate.mergeReadiness is a composite that only FILLS IN a sub-gate mode the operator left UNSET
 // (src/rules/advisory.ts's applyMergeReadinessGate, and its engine twin) -- it never overrides an

packages/loopover-engine/src/focus-manifest.ts

@@ -28,25 +28,21 @@ import { normalizeAutonomyPolicy, normalizeAutoMaintainPolicy } from "./settings
 import { normalizeCommandAuthorizationPolicy } from "./settings/command-authorization.js";
 import { normalizeContributorBlacklist } from "./settings/contributor-blacklist.js";
 import { normalizeAutoCloseExemptLogins } from "./settings/auto-close-exempt.js";
-import { DEFAULT_TYPE_LABELS, MAX_TYPE_LABEL_NAME_LENGTH, normalizeTypeLabelSet } from "./settings/pr-type-label.js";
+import { MAX_TYPE_LABEL_NAME_LENGTH, normalizeTypeLabelSet } from "./settings/pr-type-label.js";
 import {
-  DEFAULT_LINKED_ISSUE_LABEL_PROPAGATION,
   normalizeLinkedIssueLabelPropagationConfig,
   VALID_LINKED_ISSUE_LABEL_PROPAGATION_MODES,
 } from "./review/linked-issue-label-propagation.js";
 import {
-  DEFAULT_LINKED_ISSUE_HARD_RULES,
   isLinkedIssueHardRuleMode,
   normalizeLinkedIssueHardRulesConfig,
 } from "./review/linked-issue-hard-rules-config.js";
 import {
-  DEFAULT_UNLINKED_ISSUE_GUARDRAIL,
   isUnlinkedIssueGuardrailMode,
   normalizeUnlinkedIssueGuardrailConfig,
 } from "./review/unlinked-issue-guardrail-config.js";
 import { normalizeAdvisoryAiRoutingConfig } from "./review/advisory-ai-routing-config.js";
 import {
-  DEFAULT_SCREENSHOT_TABLE_GATE,
   isScreenshotTableGateAction,
   normalizeScreenshotTableGateConfig,
 } from "./review/screenshot-table-gate.js";

packages/loopover-engine/src/scoring/preview.ts

@@ -1,6 +1,5 @@
 import type { ContributorEvidenceRecord, JsonValue, RepositoryRecord, RepoTimeDecayOverrides, ScoringModelSnapshotRecord, ScorePreviewRecord } from "./types.js";
 import { DEFAULT_SCORING_CONSTANTS } from "./model.js";
-import { hasUnsafeWildcardCount } from "../signals/change-guardrail.js";
 import {
   clearLabelPatternRegExpCacheForTest,
   LABEL_PATTERN_REGEXP_CACHE_MAX_ENTRIES,
@@ -11,10 +10,12 @@ import {
 // Deterministic score-preview builder extracted verbatim from the backend's `src/scoring/preview.ts`
 // (#2282) — this file has no D1/network/env dependency in the original, so it ports unchanged aside from
 // its imports and one tiny pure helper (`nowIso`) inlined below, which the backend sources from
-// `src/utils/json.ts`. `hasUnsafeWildcardCount` is imported from this package's own
-// `signals/change-guardrail.ts` (#4611) rather than re-derived here — that file is a verbatim port of the
-// backend's `src/signals/change-guardrail.ts`, kept in sync by the engine-parity contract test, so importing
-// it carries the same ReDoS-safety guarantee without a third hand-maintained copy.
+// `src/utils/json.ts`.
+//
+// The ReDoS-safety guarantee this file used to claim via a direct `hasUnsafeWildcardCount` import (#4611) now
+// arrives through `labelMatchesPattern` (./label-match.ts), which applies the same cap internally — the import
+// here had been dead since 625e236b4 deduped this file's label matching onto that module. The guarantee is
+// unchanged; only the route to it is, and stating the live route is the point of saying so at all.
 
 // The package's tsconfig sets `types: []` (no ambient DOM/Node globals, keeping the engine's type surface
 // independent of any consumer's lib config), so the Web Crypto global needs a minimal local declaration.

packages/loopover-engine/src/signals/engine.ts

@@ -25,22 +25,21 @@ import type {
   ScoringModelSnapshotRecord,
 } from "../../../../src/types.js";
 import type { PublicContributorProfile } from "../../../../src/github/public.js";
-import { commandReferenceUrl, loopoverFooter, gittensorRepoEarnUrl, type LoopOverFooterEnv } from "../../../../src/github/footer.js";
+import { commandReferenceUrl, type LoopOverFooterEnv } from "../../../../src/github/footer.js";
 import type { FocusManifestReviewConfig, ReviewFieldKey } from "../../../../src/signals/focus-manifest.js";
 import type { GittensorContributorSnapshot } from "../../../../src/gittensor/api.js";
 import { nowIso } from "../utils/json.js";
 import { extractLinkedIssueNumbers } from "../../../../src/db/repositories.js";
 import { sanitizePublicComment } from "../../../../src/queue-intelligence.js";
 import { labelMatchesPattern, projectLinkedIssueMultiplierForPlannedSolve, type LinkedIssueMultiplierStatus } from "../scoring/preview.js";
 import { isSuspiciousConfiguredLabel } from "../scoring/label-match.js";
-import { hasLocalTestEvidence, hasValidationNote, isTestPath } from "./test-evidence.js";
+import { hasLocalTestEvidence, hasValidationNote, } from "./test-evidence.js";
 import { isCodeFile, isTestFile } from "./path-matchers.js";
 import { isFailingCheckSummary } from "./check-summary.js";
 import { isDuplicateClusterWinnerByClaim } from "./duplicate-winner.js";
 import { PREFLIGHT_LIMITS } from "./preflight-limits.js";
 import type { UnifiedCollapsible } from "../../../../src/review/unified-comment.js";
-import { splitAiReviewNits } from "../../../../src/review/ai-notes.js";
-import { LOOPOVER_GATE_CHECK_NAME, shouldPublishReviewCheck } from "../../../../src/review/check-names.js";
+import { shouldPublishReviewCheck } from "../../../../src/review/check-names.js";
 import { isAgentConfigured } from "../settings/autonomy.js";
 import { diffFilePriority } from "../review/diff-file-priority.js";
 import type { ImprovementBand, StructuralImprovementAssessment } from "../../../../src/signals/improvement.js";

packages/loopover-engine/src/signals/predicted-gate-engine.ts

@@ -1,5 +1,4 @@
 import type {
-  AdvisoryFinding,
   BountyLifecycle,
   BountyRecord,
   CollisionCluster,
@@ -46,13 +45,6 @@ const STOPWORDS = new Set([
 const MAX_COLLISION_PAIRWISE_ISSUES = 80;
 const MAX_COLLISION_PAIRWISE_PULL_REQUESTS = 120;
 const MAX_COLLISION_PAIRWISE_RECENT_MERGES = 40;
-const ISSUE_DISCOVERY_LIFECYCLE_REPORT_CAP = 300;
-const ISSUE_QUALITY_REPORT_CAP = 100;
-const REPO_OUTCOME_STALE_OPEN_DAYS = 30;
-const REPO_OUTCOME_MIN_DECIDED_SAMPLE = 3;
-const REPO_OUTCOME_MERGE_WELL_RATE = 0.7;
-const REPO_OUTCOME_CLOSURE_RISK_RATE = 0.34;
-const REPO_OUTCOME_MAX_PATTERNS = 12;
 
 export function buildLaneAdvice(repo: RepositoryRecord | null, fullName: string): LaneAdvice {
   const config = repo?.registryConfig;

packages/loopover-miner/expected-engine.version

@@ -1 +1 @@
-3.16.0
+3.16.1

packages/loopover-miner/lib/cross-repo-evaluation.ts

@@ -282,7 +282,7 @@ function resolveEvaluationRepoPath(
   return resolveRepoCloneDir(entry.repoFullName, options.env ?? process.env);
 }
 
-function defaultClaimLedger(repoFullName: string): { listClaims: () => never[] } {
+function defaultClaimLedger(_repoFullName: string): { listClaims: () => never[] } {
   return { listClaims: () => [] };
 }