# Dead Code Candidates and Proof Register

> Phase: `ARCH.FullProjectSeniorCleanArchitecture`
>
> Date: 2026-08-04
>
> Deletions authorized by this document: **none**

## 1. Purpose

This register separates discovery signals from deletion proof. A missing static import is
not sufficient in this project because EJS paths, locale catalogues, models, Socket
handlers, cron functions, operational scripts, and browser assets can be resolved by
convention or dynamically.

## 2. Classification

| Class | Meaning |
|---|---|
| `SAFE_DELETE_NOW` | Complete proof and all required gates passed in the current wave |
| `DELETE_CANDIDATE_AFTER_PROOF` | Evidence exists, but temporary-removal/runtime proof is still required |
| `MANUAL_REVIEW` | Static analysis is insufficient or owner/business intent is unknown |
| `KEEP` | Active runtime, shared infrastructure, delivery artifact, or protected config |

Current `SAFE_DELETE_NOW` count: **0**.

Wave A already removed tracked `.DS_Store` files. Wave B already proved the 27 replaced
dashboard horizontal files. Neither set is a pending candidate now.

## 3. High-confidence candidate families

### 3.1 Exact duplicate, currently unreferenced template assets

Classification: `DELETE_CANDIDATE_AFTER_PROOF`

```text
public/admin/assets/css/page-profile.css
public/admin/assets/css/pages/page-profile.css

public/admin/assets/js/_template-customizer/_template-customizer.html
public/admin/assets/js/_template-customizer/_template-customizer.scss
```

Required proof:

- confirm no CSS `@import`, dynamic asset manifest, or browser network request;
- temporary removal of one family only;
- authenticated dashboard crawl across light/dark/mobile;
- zero network 404s and visual regressions;
- full tests and Git checks.

### 3.2 Unregistered manual scripts

Classification: `MANUAL_REVIEW`

```text
scripts/_ordersSync.js
scripts/auction-qa-persistence.js
```

They have no package-script or current source/test reference. They may still be operator
one-shots. Owner confirmation is mandatory before removal.

### 3.3 Unmounted dashboard info-site router

Classification: `MANUAL_REVIEW`

```text
src/routes/dashboard/infoSiteRoute/infoSiteRoute.js
```

The router is imported by the app initializer but is not mounted. The import and file
must be adjudicated together after route inventory and browser/info-site QA. Do not
remove either from a generic cleanup wave.

## 4. Legacy dashboard source candidates

The following controllers have no proven incoming static runtime edge:

```text
src/controllers/dashboard/districtController/districtController.js
src/controllers/dashboard/financialController/financialController.js
src/controllers/dashboard/partnerController/partnerController.js
src/controllers/dashboard/settlementController/settlementController.js
src/controllers/dashboard/sharedController/sharedController.js
src/controllers/dashboard/villageController/villageController.js
```

Classification: `MANUAL_REVIEW`.

Reasons they are not safe deletes:

- dynamic CRUD view naming;
- possible operational or historical entry points;
- names overlap active API/business concepts;
- some imports inside the files are themselves missing, which may mean either dead code
  or a broken dormant feature.

Each controller family requires route registration proof, dynamic render allowlists,
view ownership review, and a temporary-removal experiment.

## 5. Legacy dashboard view families

The following families had no provable active static owner in the latest full hygiene
scan:

```text
views/admin/areas/
views/admin/features/
views/admin/roles/
views/admin/services/
views/admin/support/
views/admin/districts/
views/admin/villages/
views/admin/partners/
views/admin/settlements/
```

Classification: `MANUAL_REVIEW`.

Dynamic `res.render`, includes, and old convention-based CRUD controllers prevent an
automatic decision. No EJS family may be removed before an authenticated route crawl and
temporary-removal proof.

## 6. Custom asset candidates

The existing hygiene report identifies 51 custom CSS/JS/source files with no textual
production, test, docs, or UI-lab reference. Classification remains
`DELETE_CANDIDATE_AFTER_PROOF`, not `SAFE_DELETE_NOW`.

The required evidence is a browser network manifest covering:

- every active layout;
- dashboard list/create/edit/show pages;
- light, dark, and system themes;
- desktop, tablet, and mobile;
- dynamic dropdown/modal/upload states.

Vendor, minified, font, library, and template bundles are retained as units until their
load manifests are understood.

## 7. Package script candidates

These scripts currently reference missing targets or incomplete historical trees:

```text
run-all-files
export
import
seed
destroy
```

Classification: `MANUAL_REVIEW` with high operational risk.

Do not repair, remove, or execute them in an architecture cleanup. The destructive
scripts additionally require explicit per-run human authorization under `AGENTS.md`.

## 8. Source files with no incoming static edge

The previous complete scan reported 69 source files with no incoming static edge and 77
unreachable from its selected runtime/script roots. These are discovery signals only.

Before any individual source file is considered dead, prove:

1. no CommonJS/alias/dynamic require;
2. no model registration or populate-by-name dependency;
3. no route or Socket registrar use;
4. no persisted cron handler name;
5. no package/manual operational use;
6. no EJS or browser asset reference;
7. no test/doc-only false positive;
8. clean temporary removal and full gates.

## 9. Duplicate EJS candidates

Exact-content groups include:

- archive/notification/payment/SMS include fragments;
- FAQ/intro/slider include fragments;
- package/premium-package data tables;
- permission/legacy-role CSS includes;
- subscription create/edit pages.

Classification: `DELETE_CANDIDATE_AFTER_PROOF`.

Identical text does not prove identical local-variable contracts or future ownership.
Consolidation requires EJS render tests and browser QA for every consumer.

## 10. Protected keep list

Classification: `KEEP` unless a dedicated phase proves otherwise:

- all 79 Mongoose model paths;
- app/bootstrap, route aggregators, and auth routes;
- active API/dashboard/Socket controllers and validators;
- `returnObject.js`, response/error primitives, Passport/token/session/CSRF;
- logger, uploads, notifications, scheduler, i18n, permissions catalogue;
- active EJS layouts/includes and public shell/design-system assets;
- OpenAPI, Postman, and API-check delivery artifacts;
- locales and convention-loaded files;
- deployment/configuration files, `.env`, certificates, and upload data.

## 11. Proof template for a future deletion

Every deletion entry must record:

```text
Candidate:
Owner/domain:
Why suspected dead:
Static incoming edges:
Dynamic/convention checks:
Route/view/asset/model/socket/cron checks:
Temporary removal method:
Focused tests:
Full npm test:
Browser/API/Socket QA:
Rollback command/patch:
Final decision: KEEP | DELETE | MANUAL_REVIEW
```

No undocumented deletion is accepted.