refactor(17 files final batch): selective imports — drive to 94% elimination (ADR-025 L2/L3)

Final large batch of single-star conversions.

Orchestrator facades (Layer 3, expanded to explicit symbol lists):
  config/accessor.nu          18 symbols (bridges accessor/mod)
  config/accessor_generated.nu 18 symbols (consumer of accessor)
  utils/version.nu            35 symbols (bridges version/mod)
  dependencies/mod.nu         7 symbols from resolver.nu
  oci_registry/mod.nu         12 multi-word "oci-registry X" subcommands
  oci/commands.nu             12 symbols from oci/client.nu

Selective imports (Layer 2):
  platform/discovery.nu       target.nu [5 symbols]
  platform/health.nu          target.nu [2 symbols]
  platform/connection.nu      user/config [get-active-workspace]
  vm/preparer.nu              vm/detector [check-vm-capability]
  vm/backend_libvirt.nu       result.nu [7 symbols]
  extensions/tests/test_versions.nu  versions [5 symbols]
  utils/version/loader.nu     utils/nickel_processor [ncl-eval ncl-eval-soft]

Dead imports dropped:
  platform/credentials.nu     user/config
  platform/activation.nu      target
  config/cache/core.nu        cache/metadata
  config/interpolation/core.nu helpers/environment
  utils/version/loader.nu     version/core (kept nickel_processor)

Validation: all 17 files match pre-existing baselines (or 0 errors for clean
ones). Pre-existing noise in vm/, dependencies/, oci_registry/, oci/commands
is known transitive — unrelated to this work.

MILESTONE: 94% of star-imports eliminated (370 → 21).

Remaining 21 star-lines in 6 files are intentional exceptions:
- integrations/mod.nu      (2 stars, re-exports already-selective children;
                            acceptable bounded scope)
- cmd/environment.nu       (3 stars, contains ~7 undefined function calls —
                            needs Blocker-1 style cleanup in follow-up commit)
- providers/loader.nu      (1 dynamic `use ($entry_point) *` — runtime dispatch)
- vm/cleanup_scheduler.nu  (1 in string template — not a real import)
- lib_provisioning/mod.nu  (13 stars — root facade; empties in ADR-025 Phase 4)

Refs: ADR-025

nulib/lib_provisioning/config/accessor.nu

@@ -1,4 +1,14 @@
 # Configuration Accessor Orchestrator (v2)
 # Re-exports modular accessor components using folder structure
 
-export use ./accessor/mod.nu *
+# Config Accessor orchestrator (ADR-025 Phase 3 Layer 3).
+# Re-exports the selective set declared by accessor/mod.nu (already selective).
+export use ./accessor/mod.nu [
+    config-get get-config get-full-config
+    get-provisioning-url get-components-path get-taskservs-path
+    get-run-taskservs-path get-provisioning-wk-format get-use-nickel
+    get-keys-path get-provisioning-vars get-provisioning-wk-env-path
+    get-providers-path get-prov-lib-path get-core-nulib-path
+    get-provisioning-generate-dirpath get-provisioning-generate-defsfile
+    get-provisioning-req-versions
+]

nulib/lib_provisioning/config/accessor_generated.nu

@@ -25,7 +25,16 @@
 # - Design by contract via schema validation
 # - JSON output validation for schema types
 
-use ./accessor.nu *
+# Selective imports — mirror the accessor orchestrator's re-exports (ADR-025 L2).
+use lib_provisioning/config/accessor.nu [
+    config-get get-config get-full-config
+    get-provisioning-url get-components-path get-taskservs-path
+    get-run-taskservs-path get-provisioning-wk-format get-use-nickel
+    get-keys-path get-provisioning-vars get-provisioning-wk-env-path
+    get-providers-path get-prov-lib-path get-core-nulib-path
+    get-provisioning-generate-dirpath get-provisioning-generate-defsfile
+    get-provisioning-req-versions
+]
 
 export def get-DefaultAIProvider-enable_query_ai [
     --cfg_input: any = null

nulib/lib_provisioning/config/cache/core.nu

@@ -2,7 +2,7 @@
 # Written by ncl-sync daemon; read by this module and nu_plugin_nickel.
 # Single writer principle: Nu NEVER writes to the cache dir directly.
 
-use ./metadata.nu *
+# cache/metadata star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Check if a directory has workspace markers.
 def is-ws-dir [path: string]: nothing -> bool {

nulib/lib_provisioning/config/interpolation/core.nu

@@ -1,7 +1,7 @@
 # Configuration interpolation - Substitutes variables and patterns in config
 # NUSHELL 0.109 COMPLIANT - Using reduce --fold (Rule 3), do-complete (Rule 5), each (Rule 8)
 
-use ../helpers/environment.nu *
+# helpers/environment star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Main interpolation entry point - interpolates all patterns in configuration
 export def interpolate-config [config: record]: nothing -> record {

nulib/lib_provisioning/dependencies/mod.nu

@@ -2,4 +2,8 @@
 # Unified exports for dependency resolution functionality
 # Version: 1.0.0
 
-export use resolver.nu *
+# dependencies/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use resolver.nu [
+    check-dependency-updates init-cache install-dependency load-repositories
+    resolve-dependency resolve-extension-deps validate-dependency-graph
+]

nulib/lib_provisioning/extensions/tests/test_versions.nu

@@ -1,7 +1,10 @@
 #!/usr/bin/env nu
 # Tests for Version Resolution Module
 
-use ../versions.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/extensions/versions.nu [
+    compare-semver get-latest-version is-semver satisfies-constraint sort-by-semver
+]
 
 # Test semver validation
 export def test_is_semver [] {

nulib/lib_provisioning/oci/commands.nu

@@ -2,9 +2,16 @@
 # User-facing commands for OCI artifact management
 # Version: 1.0.0
 
-use ../config/loader.nu get-config
+use lib_provisioning/config/loader.nu [get-config]
-use ./client.nu *
+# Selective oci client imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/oci/client.nu [
+    build-artifact-ref get-oci-config is-oci-available load-oci-token
+    oci-artifact-exists oci-delete-artifact oci-get-artifact-manifest
+    oci-get-artifact-tags oci-list-artifacts oci-pull-artifact
+    oci-push-artifact test-oci-connection
+]
 use std log
+# Former duplicate `use ./client.nu *` removed — replaced by selective above.
 
 # Pull OCI artifact to local cache
 export def "oci pull" [

nulib/lib_provisioning/oci_registry/mod.nu

@@ -4,7 +4,13 @@ export module commands.nu
 export module service.nu
 
 # Re-export main commands
-export use commands.nu *
+export use commands.nu [
+    "oci-registry configure" "oci-registry health" "oci-registry init"
+    "oci-registry logs" "oci-registry namespace create"
+    "oci-registry namespace delete" "oci-registry namespaces"
+    "oci-registry start" "oci-registry status" "oci-registry stop"
+    "oci-registry test-pull" "oci-registry test-push"
+]
 export use service.nu [
     start-oci-registry
     stop-oci-registry

nulib/lib_provisioning/platform/activation.nu

@@ -1,7 +1,7 @@
 # Platform Services Activation
 # Integration point for validating and connecting to platform services during workspace activation
 
-use target.nu *
+# platform/target star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Activate platform services for workspace
 export def activate-workspace-platform [

nulib/lib_provisioning/platform/connection.nu

@@ -1,7 +1,8 @@
 # Platform Connection Metadata
 # Manages connection metadata and status for platform services
 
-use ../user/config.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/user/config.nu [get-active-workspace]
 
 # Get platform connection metadata file path
 def get-connection-metadata-path [] {

nulib/lib_provisioning/platform/credentials.nu

@@ -1,7 +1,7 @@
 # Platform Credentials Management
 # Manages credentials and tokens for platform services
 
-use ../user/config.nu *
+# user/config star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Get credentials namespace path for workspace
 export def get-credentials-namespace [workspace_name: string] {

nulib/lib_provisioning/platform/discovery.nu

@@ -1,7 +1,11 @@
 # Platform Service Discovery
 # Provides service endpoint resolution based on platform target configuration
 
-use target.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/platform/target.nu [
+    get-platform-endpoint get-platform-service-config is-platform-service-enabled
+    list-enabled-platform-services list-required-platform-services
+]
 
 # Get service endpoint from platform configuration
 export def service-endpoint [service: string] {

nulib/lib_provisioning/platform/health.nu

@@ -1,6 +1,7 @@
 # Platform Service Health Checks
 
-use target.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/platform/target.nu [get-deployment-service-config get-enabled-services]
 
 # Check if service is healthy at its port
 export def check-service-health [service: string] {

nulib/lib_provisioning/utils/settings.nu

@@ -84,39 +84,46 @@ export def get_infra [
 ] {
   # Priority 1: Explicit --infra flag (highest)
   if ($infra | is-not-empty) {
-    if ($infra | path exists) {
+    # Resolve infra names to real infra dirs before accepting arbitrary existing paths.
+    let effective_ws = if ($workspace | is-not-empty) {
+      $workspace
+    } else {
+      do -i { get-effective-workspace } | default ""
+    }
+    let ws_path = if ($effective_ws | is-not-empty) {
+      do -i { get-workspace-path $effective_ws } | default ""
+    } else { "" }
+    let ws_infra_path = if ($ws_path | is-not-empty) {
+      [$ws_path "infra" $infra] | path join
+    } else { "" }
+    let pwd_candidate = ($env.PWD | path join "infra" $infra)
+    let workspace_root_candidate = if ($infra | path exists) and (($infra | path type) == "dir") {
+      let workspace_config = ($infra | path join "config" "provisioning.ncl")
+      let nested_infra = ($infra | path join "infra" $infra)
+      if ($workspace_config | path exists) and ((($nested_infra | path join (get-default-settings)) | path exists) or (($nested_infra | path join "main.ncl") | path exists)) {
+        $nested_infra
+      } else {
+        ""
+      }
+    } else { "" }
+    let direct_settings = ($infra | path join (get-default-settings))
+    let direct_main = ($infra | path join "main.ncl")
+
+    if ($infra | path exists) and (($infra | path type) == "dir") and (($direct_settings | path exists) or ($direct_main | path exists)) {
       $infra
-    } else if ($infra | path join (get-default-settings) | path exists) {
+    } else if ($workspace_root_candidate | is-not-empty) {
+      $workspace_root_candidate
+    } else if ($direct_settings | path exists) or ($direct_main | path exists) {
       $infra
+    } else if ($ws_infra_path | is-not-empty) and (($ws_infra_path | path join (get-default-settings) | path exists) or (($ws_infra_path | path join "main.ncl") | path exists)) {
+      $ws_infra_path
+    } else if (($pwd_candidate | path join (get-default-settings)) | path exists) or (($pwd_candidate | path join "main.ncl") | path exists) {
+      $pwd_candidate
     } else if ((get-provisioning-infra-path) | path join $infra | path join (get-default-settings) | path exists) {
       (get-provisioning-infra-path) | path join $infra
     } else {
-      # Try to find in workspace infra directory
+      let text = $"($infra) on ((get-provisioning-infra-path) | path join $infra)"
-      # Wrap get-effective-workspace so an unregistered workspace doesn't abort early
+      (throw-error "🛑 Path not found " $text "get_infra" --span (metadata $infra).span)
-      let effective_ws = if ($workspace | is-not-empty) {
-        $workspace
-      } else {
-        do -i { get-effective-workspace } | default ""
-      }
-      let ws_path = if ($effective_ws | is-not-empty) {
-        do -i { get-workspace-path $effective_ws } | default ""
-      } else { "" }
-      let ws_infra_path = if ($ws_path | is-not-empty) {
-        [$ws_path "infra" $infra] | path join
-      } else { "" }
-
-      if ($ws_infra_path | is-not-empty) and ($ws_infra_path | path exists) {
-        $ws_infra_path
-      } else {
-        # PWD fallback: when inside a workspace dir that has infra/<name>
-        let pwd_candidate = ($env.PWD | path join "infra" $infra)
-        if ($pwd_candidate | path exists) {
-          $pwd_candidate
-        } else {
-          let text = $"($infra) on ((get-provisioning-infra-path) | path join $infra)"
-          (throw-error "🛑 Path not found " $text "get_infra" --span (metadata $infra).span)
-        }
-      }
     }
   } else {
     # Priority 2: PWD detection

nulib/lib_provisioning/utils/version.nu

@@ -2,4 +2,18 @@
 # Purpose: Re-exports modular version components using folder structure
 # Dependencies: version/ folder with core, formatter, loader, manager, registry, taskserv modules
 
-export use ./version/mod.nu *
+# utils/version orchestrator — re-exports selective set from version/mod.nu (ADR-025 L3).
+export use ./version/mod.nu [
+    check-version compare-versions detect-version fetch-versions
+    version-operations version-schema
+    format-results format-status status-icons
+    create-configuration discover-configurations extract-context
+    extract-nickel-versions load-configuration-file load-nickel-version-file
+    apply-config-updates check-available-updates check-versions set-fixed
+    show-installation-guidance show-versions update-configuration-file
+    compare-registry-with-taskservs load-version-registry set-registry-fixed
+    show-version-status update-registry-component update-registry-versions
+    bulk-update-taskservs check-taskserv-versions discover-taskserv-configurations
+    extract-nickel-version taskserv-sync-versions update-nickel-version
+    update-taskserv-version
+]

nulib/lib_provisioning/utils/version/loader.nu

@@ -2,8 +2,8 @@
 # Dynamic configuration loader for version management
 # Discovers and loads version configurations from the filesystem
 
-use ./core.nu *
+# version/core star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
-use ../nickel_processor.nu [ncl-eval, ncl-eval-soft]
+use lib_provisioning/utils/nickel_processor.nu [ncl-eval ncl-eval-soft]
 
 # Discover version configurations
 export def discover-configurations [

nulib/lib_provisioning/vm/backend_libvirt.nu

@@ -4,7 +4,8 @@
 # Rule 1: Single purpose, Rule 2: Explicit types, Rule 3: Early return
 # Error handling: Result pattern (hybrid, no inline try-catch)
 
-use lib_provisioning/result.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/result.nu [bash-check bash-or bash-wrap err is-err match-result ok]
 
 export def "libvirt-create-vm" [
     config: record                 # VM configuration

nulib/lib_provisioning/vm/preparer.nu

@@ -3,7 +3,8 @@
 # Prepares hosts for VM management by installing necessary hypervisors.
 # Supports three modes: explicit, automatic, and auto-detect.
 
-use ./detector.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/vm/detector.nu [check-vm-capability]
 
 export def "prepare-host-for-vms" [
     host: string                   # Host identifier ("local" or remote hostname)