Remove what nothing uses, and wire up what only looked wired

[DorwardTech]

Net −1,900 lines. Two kinds of finding: things nothing references, and settings that were documented but inert — which is the worse category, because someone setting them would reasonably expect an effect.

Livewire is not used

There are no Livewire components. Not one: no component classes, no @livewire(...), no <livewire:...>, and the app/Livewire directory Tailwind was told to scan has never existed.

What the app actually uses is plain Alpine — the sidebar's collapsible groups and the arcade dashboard's 5-second poll. Alpine was arriving inside Livewire's bundle, which is both why this went unnoticed and why removing the package isn't just a composer edit. resources/js/app.js now imports alpinejs directly, which it can because alpinejs was already a declared dependency.

	before	after
JS per admin page	~250KB livewire.js + 42KB app.js	one 46KB request

The Dockerfile no longer copies livewire.js out of vendor into public/, and the layout no longer hand-rolls the <script> tag whose own comment explains it was working around ERR_HTTP2_PROTOCOL_ERROR through Cloudflare for that 250KB bundle — a problem that stops existing along with the bundle.

Verified, not assumed (npm works in this environment even though composer's dist downloads don't):

• npm ci and npm run build both run clean from the regenerated lockfile
• the built bundle exposes window.Alpine plus Alpine's directive machinery (_x_dataStack, _x_effects, directive, magic, cloak, transition)
• Tailwind's CSS output is byte-identical apart from losing .static — which no markup uses, and which only existed because the word "static" appeared in the prose of the comment this PR deletes

There's a guard test for the Alpine import, because that dependency is invisible from PHP and fails silently: drop the import and every x-data stops working with no error and no other failing test.

Dead files

Removed	Evidence
stubs/nwidart-stubs/ (70 files)	config/modules.php points its stub path at vendor/nwidart/laravel-modules, and has enabled => false regardless. Nothing has ever read this directory.
resources/js/bootstrap.js + axios	The global it set is used nowhere; the app's one AJAX call uses fetch.
concurrently	No script invokes it.
database/factories/UserFactory.php + HasFactory	Nothing calls User::factory(); tests build users with User::query()->create().

Both lockfiles were regenerated so composer install and npm ci still match — the composer.lock diff is exactly the two packages and the content hash, with no other version moved.

Settings that were documented but inert

Three env keys had nothing reading them. All three are now wired rather than deleted, because each names something a real person might want to change:

• BCRYPT_ROUNDS — phpunit.xml has set it to 4 since the suite was written, but with no hashing config published Laravel fell back to its own default of 12, so every Hash::make() in a test did 256× the asked-for work. config/hashing.php now reads it.
• ZONE3_2FA_WINDOW — .env.example documents it; config/google2fa.php had 'window' => 1 as a literal.
• ZONE3_BACKUP_RETENTION_DAYS — read with env() inside BackupDatabaseCommand, which returns null once the entrypoint has run config:cache. So the configured retention was silently ignored in production and every run pruned at the hardcoded 30. Moved into config/zone3.php — the same rule config/crm.php already documents at length.

Deleted outright, because they can't be wired to anything: BROADCAST_CONNECTION (no broadcasting config, no broadcasting), VITE_APP_NAME (unreferenced in any JS), and ZONE3_IP_ALLOWLIST_ENABLED — that flag lives in app_settings, where the admin UI and zone3:ip-allowlist both read and write it, so an env key would only compete with the source of truth.

Every key left in .env.example is now read by a config file, and there's a check in the PR description's place: I ran that as a loop over the file.

Docs that had gone stale

The README listed Livewire in the stack table and told module authors their Livewire components register at boot. The arcade module's troubleshooting named "Livewire's bundle failed to load" as the likeliest cause of a frozen dashboard; it now names the symptom that actually distinguishes an Alpine failure — sidebar groups dead too.

What I looked at and deliberately kept

• docker-compose.local.yml — the README documents it as the local dev overlay.
• DatabaseSeeder — one line, but it's the standard db:seed target and it calls ModuleSeeder.
• ImportCoworkStateCommand / CoworkStateParser — the Cowork migration may not have been run yet. Say the word once it has and they can go.
• Framework config files with no direct config() reads (auth, cache, filesystems, logging, mail, queue, session, fortify, google2fa) — the framework and its packages read those themselves.
• Controller actions and public methods — I scanned for unrouted actions and uncalled methods and found none. My first scan reported dozens of false positives from a broken grep; the corrected run came back empty.

Tests

6 new, all repo scans, because there's nothing to assert at runtime — the browser is where a missing Alpine would break. They cover the import, the alpinejs dependency, that the two views still justify it, that no Livewire reference survives in the layout / Dockerfile / composer.json, and that the inline [x-cloak] rule (never Livewire's to provide) is still there.

vendor/ can't be installed in this environment (codeload.github.com is blocked by the proxy), so CI is the verification for the PHP side. The front-end changes are verified locally as described above.

---

Generated by Claude Code