Task: Bring ores.utility to the clean standard

ores.utility passes the Component Clean Standard for a component of kind All.

• Every checklist item that applies to a component of kind All passes, with its evidence recorded on the task.
• Every item that does not apply is recorded as not applicable, with the reason.
• Every generator defect found is fixed at its source, with a regression test.
• ores.utility is listed in COMPONENTS_UNDER_TEST, and check_component_drift.py --all passes.

Work the Component Clean Standard in its section order, one entity at a time, and record each item's result in the table below.

1. Baseline and inventory (B01 to B05). Record the baseline before any edit.
2. Models (M01 to M10).
3. Protocol (P01 to P06).
4. Generation (G01 to G06).
5. Wiring and data (W01 to W04).
6. Shell (S01, S02).
7. Structure and hygiene (H01 to H03).
8. Verification (V01 to V06), ending with the registry entry.

The six sub-trees were decided as one group rather than file by file, because they share one reason and separate decisions would have produced six inconsistent answers for it. In every case the only consumer was the sub-tree's own test, which is the B06 test-only case.

Sixteen files and 1526 lines left with the sub-trees and their tests: 947 lines across the thirteen sub-tree files in the table, and 579 across the three test files that covered them. Eleven namespace documentation headers were deleted as well in the first cut: `ores.utility.hpp` and the ten facet-level files that hold nothing but a `namespace` declaration and a `@brief` comment, 346 lines in total, none of them included anywhere. That was wrong and they are restored. Every component keeps a header for each of its namespaces; its content is the `@brief` doxygen renders, and the diagram conventions read the outermost one when they label the component, so a consumer census does not apply to it. `ores.utility.hpp` carried four claims the tree does not support, and two facet files advertised functions that do not exist, and those claims are corrected in place rather than removed with the file. See Review row 18 and G08 of the standard, which PR #2162 adds; this branch's base predates it.

One file with the same shape stays. serialization/error_code.hpp is hand-written wire material, but `ores.iam.core` includes it, so it is live and its disposition is recorded below rather than deleted.

Two hand-written artefacts stay, for different reasons.

• M06, `domain/protocol.hpp`. The component's wire envelope is hand-written: 124 lines, reached by 245 C++ files outside the component, and the codegen templates include it, so a per-entity model cannot carry it. The standard's M06 asks for every wire type to be modelled and no hand-written protocol header to remain; this file is the recorded exception, and the template dependency is the reason.
• serialization/error_code.hpp, misplaced. It enumerates the retired binary protocol's failures and carries signup and authentication codes that belong to `ores.iam`. Its only remaining consumer is `ores.iam.core/service/signup_service.hpp`, so it cannot be deleted, and it does not belong in a foundation library. Recorded for separate work.

Three further findings are recorded rather than fixed here, because each belongs to another component.

• `string/short_code_generator` is counterparty-name logic that belongs to `ores.synthetic` or `ores.refdata`.
• `program_options/shared_domain_registry` is process-global mutable state in a foundation library.
• `ores.platform::time::datetime::to_iso8601_utc` emits a space separator, so the name and the platform overview overstate the format. Captured as `doc/agile/product_backlog/inbox/to_iso8601_utc_emits_a_space_separator.org`.

Twelve items were planned. Each one is recorded here with its outcome.

One defect surfaced during the work and is recorded on the Review table: a third `generate_component_puml.py` defect dropped any data member with a brace initialiser, which the utility refresh exposed. It is fixed at source with a regression test.

Survey, 2026-09-25, at trunk `5de59e3fb8`, by an agent that did not write the component.

• Scale. 65 production C++ files in 44 headers and 21 sources, with 15 files under `tests/`. 141 test cases, 476 assertions, and 1814 files outside the component include it. The real foundation is `rfl` at 876 files, `generation` at 464, `uuid` at 453, `domain` at 262, `streaming` at 80 and `version` at 45. Everything from `program_options` down is thin, and everything from `convert` down is single-consumer or dead.
• Suites pass. `ores.utility.tests` runs green, 476 assertions in 141 test cases.
• Keep the component. The dead sub-trees are a minority. The foundation facets carry the repo.

Re-measured on `feature/clean-utility`, 2026-09-26. The survey's scale and per-facet figures were taken before any edit and against the pre-deletion header set. Where they differ from the Plan table, the Plan table is the figure that describes the tree now.

Rebased onto `origin/main` at `2e01f15e5e` on 2026-09-26, because PR #2155 reported a conflict. The only conflicting file was the generated `doc/agile/product_backlog/inbox.org` table, which main had also added captures to; it was resolved by regenerating the index from the capture files rather than by merging rows by hand. Eight of the nine commit patch-ids are unchanged by the rebase. The ninth is `[agile] Record the ores.utility clean-up`, whose patch-id moved from `93857360ae` to `f479f24f16`, because the regenerated table it commits now carries the captures main added. The branch was force-pushed with `–force-with-lease` as the conflict was the only remedy.

Rebased a second time onto `origin/main` at `f1ff373d30` on 2026-09-26, the orgmode clean-up's nine commits, for the same reason. The only conflicting file was `doc/agile/versions/v0/sprint_26/sprint.org`: main had marked the orgmode row DONE while this branch marks the utility row STARTED, and both rows are kept. Fourteen of the fifteen commit patch-ids are unchanged. The ninth, `[agile] Record the ores.utility clean-up`, moved from `f479f24f16` to `536c68a906`, because the resolved table it commits now carries main's orgmode row. Force-pushed with `–force-with-lease` again.

The six sub-trees, with their external callers.

Work items, in the order they land.

1. Decide the six sub-trees as a group. For each, either name the intended consumer in the overview or delete it with its test. Deciding file by file will produce six inconsistent answers.
2. Delete the two `ores::comms::messaging` reflector specialisations, since the subsystem they marshal no longer exists.
3. Delete the eleven umbrella headers with no consumer, or keep `ores.utility.hpp` alone and rewrite it. Two pairs are duplicates, and two advertise functions that do not exist. The survey's premise was wrong: these are the component's namespace documentation headers, which every component keeps, so the answer is to keep all eleven and correct their claims. See Review row 18.
4. Rewrite `component_overview.org`. Fix the dependency claim, drop `datetime/` and geo, list every facet, fill `See also`, and bump `#+updated`.
5. Fix the same false claims in `ores.utility.hpp`.
6. Add tests for the live untested files, starting with `gzip`, which is on the wire and had no direct test in the component. The survey's "no test anywhere" was wrong: `ores.nats` covers it indirectly through its own compression suite.
7. Strengthen the tautological assertions, starting with the TOTP test, which checks only length and alphabet, and `tree_builder_tests.cpp`, which compares two production runs to each other.
8. Regenerate the diagram through both passes, after the generator defect is fixed. Six namespaces are missing, and the hand-authored section below the sentinel is empty.
9. Move the six end-of-line comments above their code, and drop the `Step` narration.
10. Rename the `converter` namespace to `convert`, or the folder to `converter`, and fix the call sites.
11. Record the load-bearing exception for `domain/protocol.hpp`. It is a 245-C++-file wire envelope in a foundation library and the codegen templates depend on it, so it cannot be generated per entity. It needs an M06 exception with that reason, not a move.
12. Record the misplaced concerns for separate work. `serialization/error_code.hpp` speaks the retired binary protocol and belongs to messaging. `string/short_code_generator` is counterparty-name logic that belongs to `ores.synthetic` or `ores.refdata`. `program_options/shared_domain_registry` is process-global mutable state in a foundation library.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

ores.utility meets the standard for the items that apply to a model-free component. Twelve work items landed across seven `[utility]` commits: the six that carry the work, and the seventh carrying the corrections from the first verification round.

The component lost 16 files and 1526 lines: six sub-trees whose only consumer was their own test. (The first cut also deleted eleven namespace documentation headers and counted 27 files and 1872 lines; those are restored, because every component keeps them for doxygen. See Review row 18.) It gained a component overview that describes what is actually there, a rendered diagram whose boxes carry their APIs, and 24 test cases, of which 7 are the first direct tests `gzip` has had in the component. Its test suite went from 476 assertions in 141 test cases to 614 in 128, with the tautological determinism case replaced by two that assert something. One generator defect is fixed at its source.

The component keeps its place as the foundation library. Every facet that survives reaches at least one C++ file outside the component, and the facet with the widest reach, `rfl`, reaches 856 of them.

Three items stay out of scope. The M06 exception for `domain/protocol.hpp` is recorded with its reason. Three misplaced concerns are recorded for separate work, one of them captured in the backlog. Seven other components' diagrams are stale against the fixed generator and belong to their own passes.

An independent verifier worked the branch in four rounds and posted a verdict each time: PASS+NOTES, PASS+NOTES, PASS+NOTES, then PASS on `3d1a31520f`. No code defect was found in any round; every finding was a documentation figure or a stale reference, and all of them are in the Review table above with their disposition. The verifier also proved the load-bearing claims rather than accepting them: each half of the generator fix fails the regression cases when reverted, seven mutated production paths all fail the suite, and re-adding the old tree-builder case under a mutation showed it passing while the pinned case failed.

The branch was rebased twice because main moved under it, and both rebases are recorded in the Notes with their patch-ids. PR #2155 merged as `9b2427bfca` on 2026-09-26, with every CI check green on the final head.