refactor: nuke dead exports, dead files, dead DB column, dead zero-value wrappers

Full-codebase ts-prune + manual audit sweep. Every change below is a pure
deletion (or a 2-line re-wire where a dead function was supposed to be
alive). No scope additions.

Dead wrappers / phantom features
  - shouldAutoApproveApproval: zero-value wrapper over shouldAutoApprove.
    Four call sites now import shouldAutoApprove from execution-policy
    directly.
  - evaluateRotation(session, connectorId, thresholdsOverride): the
    connectorId arg was never read (underscored), and thresholdsOverride
    was only exercised by the test suite — no production caller. Signature
    collapses to evaluateRotation(session). DEFAULT_THRESHOLDS /
    RotationThresholds exports and their tests go with it.
  - installLogRedactor: defensive console wrapper that was never wired
    from worker-entry. buildRedactor handles the known threat (env-value
    leaks); the pattern-based redactTokens stays for tests and future
    composition.

Dead files
  - resume-interrupted-tasks.ts: helper function never imported.
  - service-graph-orchestration-deps.ts: three factory closures
    superseded by the inline closures in create-orchestration-service.

Dead exports
  - listConnectorsByAuthKind (shared/connector-catalog)
  - getLocalePromptInstruction + whole localization.ts file
  - ImportantDocType
  - main-side ConnectorAuthKind (duplicated the shared one; not referenced)
  - CheckpointEngineService, RunHousekeepingService types
  - WorkspaceResolution type
  - cmdOrCtrlSymbol
  - AgentEventPush, CredentialPayload type aliases
  - parseApprovalPayloadJson, parseEnvValue, ProviderCard
  - getSOP — buildSOPSection reads the SOPS map directly; the individual
    getter had no callers. Deduped to a flat array.
  - renderWakeReason in wake-reasons/en.ts: byte-for-byte duplicate of the
    one in wake-reasons/index.ts.

Forgotten wiring (not cleanup, but adjacent)
  - registerAgentStandupRoute: the GET /api/agents/me/standup endpoint is
    advertised in every system prompt and wake-reason doc, but the route
    handler was never registered in api-server/index.ts. Agents have been
    hitting 404 since Pi Mono. Registered.

Dead DB column
  - v44 migration drops runs.context_snapshot_json. Column was added by
    v16-v25, never written or read, and v43's deliberate preservation
    was an interim measure. Same idempotent table-rebuild pattern as
    v41/v43.

Test tree
  - Phantom-feature threshold override tests removed (3). The rest of
    the rotation suite re-expressed against the real maxRuns=20 floor.

495/495 unit tests pass. typecheck + build clean.

src/main/database/migrations/v43-v43.ts

@@ -82,10 +82,10 @@ export function createMigrationsV43V43(deps: MigrationDeps): Migration[] {
           }
 
           if (runsHasDeadCol) {
-            // v16-v25 added `context_snapshot_json`; it is unreferenced by
-            // production code today but the column exists on real databases
-            // and carries no policy against preservation. Keep it so this
-            // migration's blast radius stays exactly one column.
+            // `context_snapshot_json` rides through this rebuild untouched
+            // so the single-concern invariant holds: v43 drops only
+            // `session_display_id`. v44 is the one that drops the snapshot
+            // column.
             db.exec(`
               CREATE TABLE runs_new (
                 id TEXT PRIMARY KEY,

src/main/database/migrations/v44-v44.ts

@@ -0,0 +1,83 @@
+import log from "electron-log/main.js";
+import type { Migration, MigrationDeps } from "./types";
+import { columnExists, tableExists } from "./types";
+
+/**
+ * Drop `runs.context_snapshot_json` — dead since its introduction.
+ *
+ * v16-v25 added the column with the intent to snapshot the turn context
+ * for post-run forensics. Nothing ever wrote to it, nothing ever read it,
+ * and the Pi Mono migration removed the last plausible use case (the
+ * turn snapshot now lives in `task_sessions` / `session_entries`).
+ *
+ * Same table-rebuild pattern as v43 — `runs_new` without the column,
+ * copy the real data, swap, reindex. Idempotent: if the column is
+ * already absent the migration is a no-op.
+ */
+export function createMigrationsV44V44(deps: MigrationDeps): Migration[] {
+  const { db } = deps;
+  return [
+    {
+      version: 44,
+      name: "drop_runs_context_snapshot_json",
+      fn: () => {
+        if (!tableExists(db, "runs") || !columnExists(db, "runs", "context_snapshot_json")) {
+          log.info("[migration v44] runs.context_snapshot_json already absent; skipping");
+          return;
+        }
+
+        db.exec("PRAGMA foreign_keys = OFF");
+        try {
+          db.exec(`
+            CREATE TABLE runs_new (
+              id TEXT PRIMARY KEY,
+              company_id TEXT NOT NULL,
+              task_id TEXT,
+              agent_id TEXT NOT NULL,
+              workspace_id TEXT,
+              connector_id TEXT NOT NULL,
+              status TEXT NOT NULL,
+              summary TEXT NOT NULL,
+              error_message TEXT,
+              exit_code INTEGER,
+              signal TEXT,
+              model TEXT,
+              cost_usd REAL,
+              unattributed_cost INTEGER NOT NULL DEFAULT 0,
+              actor_type TEXT,
+              actor_id TEXT,
+              started_at TEXT,
+              finished_at TEXT,
+              log_path TEXT,
+              created_at TEXT NOT NULL,
+              updated_at TEXT NOT NULL
+            );
+            INSERT INTO runs_new (
+              id, company_id, task_id, agent_id, workspace_id, connector_id,
+              status, summary, error_message, exit_code, signal, model,
+              cost_usd, unattributed_cost, actor_type, actor_id,
+              started_at, finished_at, log_path, created_at, updated_at
+            )
+            SELECT
+              id, company_id, task_id, agent_id, workspace_id, connector_id,
+              status, summary, error_message, exit_code, signal, model,
+              cost_usd, unattributed_cost, actor_type, actor_id,
+              started_at, finished_at, log_path, created_at, updated_at
+            FROM runs;
+            DROP TABLE runs;
+            ALTER TABLE runs_new RENAME TO runs;
+            CREATE INDEX IF NOT EXISTS idx_runs_company ON runs(company_id);
+            CREATE INDEX IF NOT EXISTS idx_runs_task ON runs(task_id);
+            CREATE INDEX IF NOT EXISTS idx_runs_agent ON runs(agent_id);
+            CREATE INDEX IF NOT EXISTS idx_runs_company_status ON runs(company_id, status);
+            CREATE INDEX IF NOT EXISTS idx_runs_company_created_at ON runs(company_id, created_at DESC);
+            CREATE INDEX IF NOT EXISTS idx_runs_agent_created_at ON runs(agent_id, created_at DESC);
+          `);
+          log.info("[migration v44] rebuilt runs without context_snapshot_json");
+        } finally {
+          db.exec("PRAGMA foreign_keys = ON");
+        }
+      },
+    },
+  ];
+}

src/main/database/schema.ts

@@ -8,6 +8,7 @@ import { createMigrationsV40V40 } from "./migrations/v40-v40";
 import { createMigrationsV41V41 } from "./migrations/v41-v41";
 import { createMigrationsV42V42 } from "./migrations/v42-v42";
 import { createMigrationsV43V43 } from "./migrations/v43-v43";
+import { createMigrationsV44V44 } from "./migrations/v44-v44";
 import {
   columnExists,
   nowIso,
@@ -182,6 +183,7 @@ export function runMigrations(
     ...createMigrationsV41V41(deps),
     ...createMigrationsV42V42(deps),
     ...createMigrationsV43V43(deps),
+    ...createMigrationsV44V44(deps),
   ];
 
   for (const migration of migrations) {