enh(#2876): retire the dead and pass-through exports from bin/install.js (#3615)

* enh(#2876): retire the dead and pass-through exports from bin/install.js

The installer exported 197 names and had zero production consumers - every
non-test require of it repo-wide sits inside a comment. Its interface was
shaped by test access, not by callers.

Removes 9 dead exports and 61 pass-throughs, repointing their tests onto the
extracted modules' own interfaces. 197 down to 127.

Every count in the issue was wrong: 197 exports not 188, 9 dead not 12, 61
pass-throughs not 49, 44 test files not 42 - and the audit itself then missed
7 more consumer files. restoreUserArtifacts was on the dead list but ceased to
exist in phase 6, and two _GSD_EFFORT_MANIFEST_* names listed as dead are now
genuinely asserted, so acting on that list would have deleted live exports.

7 of the 9 dead names collide with an independent declaration that install.js
delegates TO. Each removal was justified by which declaration a reference
resolves to, never by whether the name appears somewhere.

Coverage parity was the gate rather than test greenness: per-file counts were
captured before any edit and diffed after. 44 of 45 files are byte-identical;
the single delta is one added assertion, not a loss.

The sweep for scattered require sites found two forms static grep misses -
require(VARIABLE) and multi-line require() - plus tests asserting that
install.js re-exports the SAME object, which now assert retirement instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#2876): close review findings — restore the duplicate-body guard, sweep orphaned code

Both review engines found real defects in the first cut.

The DEFECT.GENERATIVE-FIX single-owner guard from #1511 had been repointed
from a reference-identity check to install.X === undefined. Those are not
equivalent: the guard exists to catch a duplicate function body reintroduced
into install.js, and the replacement passes cleanly if that duplicate is used
internally and never exported. It now walks bin/install.js's real top-level
bindings, so it catches a duplicate under either shape, exported or not -
strictly stronger than the check it replaced. Proved by injecting a duplicate
and watching it go red.

That weakening survived the coverage-parity gate because the assertion count
never moved. The gate compares counts, so an assertion that changes meaning
rather than number is invisible to it.

Removing the exports had orphaned their wrapper bodies: 14 dead wrappers, 9
consts and 9 destructure entries, several pre-existing and found by the same
sweep. Dead code left in the file this phase exists to shrink.

Three more comments claimed re-exports this phase removed, and tests were
reading Cursor and Windsurf hook constants from install.js's local copy while
calling functions from the hooks surface - equal today, with nothing holding
them equal. The local consts now reference the owning module.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(#2876): backfill changeset pr number

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

docs/adr/1508-runtime-artifact-conversion-module.md

@@ -91,3 +91,37 @@ Two deferred follow-ups were spun out as **sub-issues of #1507** and have since
 - **#1676** (PR #1686) — added the `fast-check` property test (`$HOME`-collapse invariant + path-rewrite idempotency) promised in #1511's test scope.
 
 Delivery verified by a Codex (`gpt-5.4`, high-effort, read-only) review against the epic's stated deliverables, cross-checked against the indexed code graph and live source.
+
+## Amendment — 2026-08-17 (#2876): the re-export mandate's stated beneficiary was the test suite
+
+This ADR's relocation slices, and ADR-857's before them, kept a re-export spine in `bin/install.js`
+so that *"existing consumers that do `require('../bin/install.js').writeCursorHooksJson` (etc.)
+continue to work unchanged"* — the wording carried in `src/runtime-hooks-surface.cts`'s own header.
+
+**Epic #2866 Phase 7 measured the consumers. There are none.**
+
+`bin/install.js` exported **197** names. Every reference to it outside `tests/` — in `src/`,
+`hooks/`, `scripts/` and `bin/` — sits **inside a comment**, including the one in
+`runtime-hooks-surface.cts` that named the case. Not one line of production code has ever required
+the file. The 44 consumers are test files.
+
+So the pattern was real and the reasoning behind it was sound; the beneficiary was simply
+misidentified. The compatibility spine was preserving access for a caller that did not exist, while
+the actual dependency — the test suite reaching implementation through the installer rather than
+through the modules that own it — went unnamed and therefore unmanaged.
+
+**What Phase 7 changed.** 9 dead exports and 61 pass-throughs are gone; their tests now import the
+extracted modules directly. `bin/install.js` exports **127** — 197 − 9 − 61 — and every one of those
+127 is substantive local implementation. They are not a compatibility wall; they are code with no
+other home yet, and extracting them is a different piece of work.
+
+**What this does not change.** The dependency direction this ADR established — installer and layout
+import the conversion module, the conversion module imports nothing upward — is untouched, and so is
+ADR-857's capability-registry contract. Relocation still requires the moved symbol to keep working
+for its real callers; the correction is only about who those callers are.
+
+**The generalizable point.** A back-compat re-export is a claim about consumers, and a claim about
+consumers is checkable. This one went four ADRs and several epics without being checked, which let
+an interface be shaped by test access while everyone believed it was shaped by callers. Before
+adding a compatibility layer, enumerate what it is compatible *for*; if the answer is "the tests",
+the honest fix is to point the tests at the owning module.