diff --git a/src/main/orcad/electron-sidecar-tab-registry.ts b/src/main/orcad/electron-sidecar-tab-registry.ts
index 8b3b9940b2e..e925e9f846d 100644
--- a/src/main/orcad/electron-sidecar-tab-registry.ts
+++ b/src/main/orcad/electron-sidecar-tab-registry.ts
@@ -22,7 +22,7 @@ const ElectronSidecarResult = z
   })
   .passthrough()
 
-export type ElectronSidecarTab = z.infer<typeof ElectronSidecarTabSchema>
+type ElectronSidecarTab = z.infer<typeof ElectronSidecarTabSchema>
 
 export type ElectronSidecarPage = {
   publicPageId: string
diff --git a/src/main/orcad/native-host-abi.ts b/src/main/orcad/native-host-abi.ts
index a65d8f37173..9e16cc3f78a 100644
--- a/src/main/orcad/native-host-abi.ts
+++ b/src/main/orcad/native-host-abi.ts
@@ -13,7 +13,7 @@
  */
 import process from 'node:process'
 
-export type LibcFlavor = 'glibc' | 'musl' | 'none'
+type LibcFlavor = 'glibc' | 'musl' | 'none'
 
 export type NativeHostAbi = {
   platform: NodeJS.Platform
diff --git a/src/main/orcad/node-pty-loader-diagnosis.ts b/src/main/orcad/node-pty-loader-diagnosis.ts
index 9d151d03878..410e2f7853e 100644
--- a/src/main/orcad/node-pty-loader-diagnosis.ts
+++ b/src/main/orcad/node-pty-loader-diagnosis.ts
@@ -16,7 +16,7 @@ import {
   parseUnmetGlibcVersion
 } from './native-host-abi'
 
-export type NodePtyLoadCause = {
+type NodePtyLoadCause = {
   reason: RuntimeTerminalUnavailableReason
   /** Short human phrase naming the actual values found, not a remedy. */
   detail: string
diff --git a/src/main/orcad/node-pty-prebuilt-slot.ts b/src/main/orcad/node-pty-prebuilt-slot.ts
index 1917f8d276f..48d84a14dab 100644
--- a/src/main/orcad/node-pty-prebuilt-slot.ts
+++ b/src/main/orcad/node-pty-prebuilt-slot.ts
@@ -54,9 +54,9 @@ const PrebuiltSlotManifestSchema = z.object({
 })
 
 export type PrebuiltSlotEntry = z.infer<typeof PrebuiltSlotEntrySchema>
-export type PrebuiltSlotManifest = z.infer<typeof PrebuiltSlotManifestSchema>
+type PrebuiltSlotManifest = z.infer<typeof PrebuiltSlotManifestSchema>
 
-export type PrebuiltSlotRefusal =
+type PrebuiltSlotRefusal =
   | 'no-slot'
   | 'no-prebuilds-dir'
   | 'no-manifest'
@@ -97,7 +97,7 @@ export function readPrebuiltSlotManifest(prebuildsDir: string): PrebuiltSlotMani
  * Why each check refuses instead of copying: a binary this host cannot load would replace
  * a "no usable prebuilt" diagnosis with a loader failure that reads as a corrupt install.
  */
-export function checkPrebuiltSlotEntry(
+function checkPrebuiltSlotEntry(
   entry: PrebuiltSlotEntry,
   abi: NativeHostAbi,
   hostNapi: number | null
@@ -135,7 +135,7 @@ function sha256File(path: string): string {
 }
 
 /** Compat slots (design D6 rung B) tried after `slot`'s own, e.g. linux-x64-glibc217 for linux-x64-glibc. */
-export function compatSlotsFor(slot: string): string[] {
+function compatSlotsFor(slot: string): string[] {
   return COMPAT_SERVER_TARGETS.filter((compat) => COMPAT_SERVER_TARGET_BASES[compat] === slot)
 }
 
diff --git a/src/main/orcad/node-pty-precondition.ts b/src/main/orcad/node-pty-precondition.ts
index ea7a0745e49..9f2963ceeee 100644
--- a/src/main/orcad/node-pty-precondition.ts
+++ b/src/main/orcad/node-pty-precondition.ts
@@ -49,7 +49,7 @@ const PROBE_TIMEOUT_MS = 20_000
  * a reason that was never established. Same verdict discipline as the SSH execution
  * boundary: loss of contact is not proof of death.
  */
-export type NodePtyPreconditionStatus = 'ok' | 'degraded' | 'blocked' | 'unverifiable'
+type NodePtyPreconditionStatus = 'ok' | 'degraded' | 'blocked' | 'unverifiable'
 
 export type NodePtyPreconditionVerdict = {
   status: NodePtyPreconditionStatus
@@ -61,14 +61,14 @@ export type NodePtyPreconditionVerdict = {
   prebuilt?: PrebuiltSlotOutcome
 }
 
-export type NodePtyProbeFailure = {
+type NodePtyProbeFailure = {
   status: 'blocked' | 'unverifiable'
   reason: RuntimeTerminalUnavailableReason
   detail: string
 }
 
 /** What the child actually reported, before any judgement is made about it. */
-export type NodePtyProbeOutcome =
+type NodePtyProbeOutcome =
   | { kind: 'loaded'; loadedDir: string | null }
   | { kind: 'noBinary' }
   | { kind: 'loaderError'; message: string }
@@ -78,7 +78,7 @@ export type NodePtyProbeOutcome =
   /** It answered, but with nothing that names a cause. */
   | { kind: 'unexplained'; detail: string }
 
-export function readNodePtyProbeOutcome(
+function readNodePtyProbeOutcome(
   result: Pick<ProcessResult, 'code' | 'signal' | 'stdout' | 'stderr' | 'timedOut'>
 ): NodePtyProbeOutcome {
   const stdout = result.stdout
@@ -160,7 +160,7 @@ function readReportedLoadError(stdout: string): string | null {
 }
 
 /** Read a dynamic-loader message. Pure, so shapes this host cannot reproduce are testable. */
-export function classifyLoaderMessage(message: string): NodePtyProbeFailure {
+function classifyLoaderMessage(message: string): NodePtyProbeFailure {
   return { status: 'blocked', ...classifyNodePtyLoaderMessage(message) }
 }
 
diff --git a/src/main/orcad/orcad-account-services.ts b/src/main/orcad/orcad-account-services.ts
index 521d6fd7c73..d30616f2533 100644
--- a/src/main/orcad/orcad-account-services.ts
+++ b/src/main/orcad/orcad-account-services.ts
@@ -26,7 +26,7 @@ import type { OrcadRuntimeCleanup } from './orcad-runtime-lifetime'
 
 type StructuredLaunchInput = { launchEnv: NodeJS.ProcessEnv }
 
-export type OrcadAccountServices = {
+type OrcadAccountServices = {
   prepareCodexHome: ReturnType<typeof createCodexRuntimeHomeLaunchPreparation>
   prepareClaudeAuth: PrepareClaudeAuth
   /** Pins an automatic resume to the account home its session was recorded in. */
diff --git a/src/main/orcad/orcad-artifact-cache-retention.ts b/src/main/orcad/orcad-artifact-cache-retention.ts
index 6c9cfa1b851..450f9acbf03 100644
--- a/src/main/orcad/orcad-artifact-cache-retention.ts
+++ b/src/main/orcad/orcad-artifact-cache-retention.ts
@@ -24,11 +24,11 @@ import {
 } from './orcad-daemon-slot-pins'
 
 /** The in-use slot plus the two most recent others (the newest three when none is in use). */
-export const ORCAD_ARTIFACT_CACHE_KEEP = 3
+const ORCAD_ARTIFACT_CACHE_KEEP = 3
 
 const REPAIR_SUFFIX = /\.repair-\d+$/u
 
-export type OrcadArtifactCachePruneOptions = {
+type OrcadArtifactCachePruneOptions = {
   keep?: number
   /** Slot versions to keep whatever their age. */
   inUseVersions?: ReadonlySet<string>
diff --git a/src/main/orcad/orcad-artifact-source-verification.ts b/src/main/orcad/orcad-artifact-source-verification.ts
index db11a4ea34b..209de3b0630 100644
--- a/src/main/orcad/orcad-artifact-source-verification.ts
+++ b/src/main/orcad/orcad-artifact-source-verification.ts
@@ -14,8 +14,8 @@ import { fileSha256 } from '../node-runtime/pinned-runtime-materializer'
 export type ArtifactSource = { filename: string; path: string; executable?: boolean }
 export type ExpectedSha256 = { sha256: string; label: string }
 type SignedSource = OrcadArtifactVerificationRecord['sources'][number]
-export type RecordedSlot = NonNullable<OrcadArtifactVerificationRecord['slot']>
-export type ArtifactIdentity = {
+type RecordedSlot = NonNullable<OrcadArtifactVerificationRecord['slot']>
+type ArtifactIdentity = {
   fullVersion: string
   contentDigest: string
   sourceHashes: Map<string, string>
diff --git a/src/main/orcad/orcad-artifact-verification-record.ts b/src/main/orcad/orcad-artifact-verification-record.ts
index 4ad38f51235..8a8e2281fb1 100644
--- a/src/main/orcad/orcad-artifact-verification-record.ts
+++ b/src/main/orcad/orcad-artifact-verification-record.ts
@@ -37,7 +37,7 @@ const RecordSchema = z.object({
 
 export type OrcadArtifactVerificationRecord = z.infer<typeof RecordSchema>
 
-export type FileSignature = {
+type FileSignature = {
   signature: string
   /** False when the file changed too recently for its signature to prove it unchanged later. */
   settled: boolean
diff --git a/src/main/orcad/orcad-browser-install-park.ts b/src/main/orcad/orcad-browser-install-park.ts
index f33ed2fd17f..b60fde1aebc 100644
--- a/src/main/orcad/orcad-browser-install-park.ts
+++ b/src/main/orcad/orcad-browser-install-park.ts
@@ -8,14 +8,14 @@ const PARK_POLL_MS = 1_000
 const RESTART_RETRY_MIN_MS = 5_000
 const RESTART_RETRY_MAX_MS = 5 * 60_000
 
-export type OrcadBrowserHelper = {
+type OrcadBrowserHelper = {
   /** The running helper's pid, or null when none runs. */
   pid: () => number | null
   start: (signal: AbortSignal) => Promise<void>
   stop: () => Promise<void>
 }
 
-export type OrcadBrowserInstallPark = { close: () => Promise<void> }
+type OrcadBrowserInstallPark = { close: () => Promise<void> }
 
 /**
  * The browser helper runs from the installed Orca.app, so macOS cannot replace that bundle while it
diff --git a/src/main/orcad/orcad-completed-stop-receipt.ts b/src/main/orcad/orcad-completed-stop-receipt.ts
index 3b7db75e13b..3c67b1856c2 100644
--- a/src/main/orcad/orcad-completed-stop-receipt.ts
+++ b/src/main/orcad/orcad-completed-stop-receipt.ts
@@ -18,7 +18,7 @@ import {
 
 const RECEIPT_MAX_BYTES = 64 * 1024
 
-export type ReceiptKind = 'completed' | 'retirement' | 'decision'
+type ReceiptKind = 'completed' | 'retirement' | 'decision'
 
 export function orcadStopReceiptPath(request: OrcadManagedStopRequest, kind: ReceiptKind): string {
   const { transactionId, instance } = OrcadManagedStopRequestSchema.parse(request)
diff --git a/src/main/orcad/orcad-daemon-supervision.ts b/src/main/orcad/orcad-daemon-supervision.ts
index 501ad473c5c..1f14032536c 100644
--- a/src/main/orcad/orcad-daemon-supervision.ts
+++ b/src/main/orcad/orcad-daemon-supervision.ts
@@ -22,7 +22,7 @@ import { errorMessage } from '../../shared/error-message'
 
 const WINDOWS_DAEMON_STARTUP_TIMEOUT_MS = 30_000
 
-export type OrcadDaemonStartup =
+type OrcadDaemonStartup =
   | { state: 'live'; pid: number | null }
   | { state: 'degraded'; reason: string }
   | { state: 'unavailable'; reason: string }
diff --git a/src/main/orcad/orcad-data-root-privacy.ts b/src/main/orcad/orcad-data-root-privacy.ts
index ea2385a3b6c..1de644ffac2 100644
--- a/src/main/orcad/orcad-data-root-privacy.ts
+++ b/src/main/orcad/orcad-data-root-privacy.ts
@@ -2,7 +2,7 @@ import { chmodSync, statSync } from 'node:fs'
 import process from 'node:process'
 import { restrictWindowsPathSync } from '../../shared/secure-path-windows-acl'
 
-export type OrcadInstanceLockCode =
+type OrcadInstanceLockCode =
   | 'orcad_data_root_unusable'
   | 'orcad_data_root_wrong_owner'
   | 'orcad_data_root_shared'
diff --git a/src/main/orcad/orcad-health.ts b/src/main/orcad/orcad-health.ts
index c604ebeb6c4..781975458a4 100644
--- a/src/main/orcad/orcad-health.ts
+++ b/src/main/orcad/orcad-health.ts
@@ -34,9 +34,9 @@ import type { OrcadIdleStopRecord } from '../../shared/orcad-idle-exit'
  *   separately rather than folded into `ok`, because claiming a PTY round trip we did not
  *   perform is the failure mode this surface exists to prevent.
  */
-export type PtySelfTestCoverage = 'pty-spawn' | 'handshake'
+type PtySelfTestCoverage = 'pty-spawn' | 'handshake'
 
-export type PtySelfTest = {
+type PtySelfTest = {
   ok: boolean
   coverage: PtySelfTestCoverage
   /** The daemon's own verdict word, so a failure is diagnosable without re-probing. */
@@ -115,7 +115,7 @@ export function computeOrcadBuildHash(entryPath = process.argv[1]): string {
  * `healthy`; a wedged one times out to `unreachable`, and one whose node-pty or login session
  * is broken answers `pty-spawn-unhealthy`.
  */
-export async function runTerminalDaemonSelfTest(
+async function runTerminalDaemonSelfTest(
   now: () => number = () => Date.now()
 ): Promise<PtySelfTest> {
   const startedAt = now()
diff --git a/src/main/orcad/orcad-idle-exit-monitor.ts b/src/main/orcad/orcad-idle-exit-monitor.ts
index 4ddc0bf7329..55bb5391f3d 100644
--- a/src/main/orcad/orcad-idle-exit-monitor.ts
+++ b/src/main/orcad/orcad-idle-exit-monitor.ts
@@ -14,7 +14,7 @@ export type OrcadIdleProbe = {
 
 export type OrcadIdleExitEvidence = { quietSince: number; stoppedAt: number; timeoutMs: number }
 
-export type OrcadIdleExitMonitorOptions = {
+type OrcadIdleExitMonitorOptions = {
   timeoutMs: number
   probes: readonly OrcadIdleProbe[]
   /** Any client request restarts the quiet period, even one that came and went between checks. */
diff --git a/src/main/orcad/orcad-idle-stop-daemon-recovery.ts b/src/main/orcad/orcad-idle-stop-daemon-recovery.ts
index 33f5678b964..8254c6002e4 100644
--- a/src/main/orcad/orcad-idle-stop-daemon-recovery.ts
+++ b/src/main/orcad/orcad-idle-stop-daemon-recovery.ts
@@ -11,7 +11,7 @@ import { ORCAD_DAEMON_RETIREMENT_TIMEOUT_MS } from './orcad-stop-deadlines'
 
 type RetirementOutcome = Pick<OrcadDaemonRetirement, 'retirement' | 'lateRetirement'>
 
-export type OrcadIdleStopDaemonRecoveryPorts = {
+type OrcadIdleStopDaemonRecoveryPorts = {
   admissionClosed: () => boolean
   /** Asks the daemon to retire again; its own census and fence make the verdict atomic. */
   retireAgain: () => Promise<RetirementOutcome>
diff --git a/src/main/orcad/orcad-managed-stop-completion.ts b/src/main/orcad/orcad-managed-stop-completion.ts
index ec25c920cf8..295e049faf4 100644
--- a/src/main/orcad/orcad-managed-stop-completion.ts
+++ b/src/main/orcad/orcad-managed-stop-completion.ts
@@ -37,7 +37,7 @@ import {
   ORCAD_STOP_COMPLETION_POLL_MS
 } from './orcad-stop-deadlines'
 
-export type OrcadProcessProbe = (pid: number) => 'alive' | 'missing' | 'unverifiable'
+type OrcadProcessProbe = (pid: number) => 'alive' | 'missing' | 'unverifiable'
 
 export type OrcadManagedStopCompletionOptions = OrcadProcessIdentityReaders & {
   probeProcess?: OrcadProcessProbe
diff --git a/src/main/orcad/orcad-managed-stop-decision.ts b/src/main/orcad/orcad-managed-stop-decision.ts
index a5b61e3d2eb..b9b69686a22 100644
--- a/src/main/orcad/orcad-managed-stop-decision.ts
+++ b/src/main/orcad/orcad-managed-stop-decision.ts
@@ -17,7 +17,7 @@ import {
 import { orcadStopReceiptPath, readOrcadStopReceipt } from './orcad-completed-stop-receipt'
 import { hasErrorCode } from '../daemon/daemon-process-inspection'
 
-export type OrcadManagedStopDecisionValue = OrcadManagedStopDecision['decision']
+type OrcadManagedStopDecisionValue = OrcadManagedStopDecision['decision']
 
 export function readOrcadManagedStopDecision(
   request: OrcadManagedStopRequest
diff --git a/src/main/orcad/orcad-managed-stop-request.ts b/src/main/orcad/orcad-managed-stop-request.ts
index 78b8a84188f..a570499a94e 100644
--- a/src/main/orcad/orcad-managed-stop-request.ts
+++ b/src/main/orcad/orcad-managed-stop-request.ts
@@ -27,7 +27,7 @@ export function readOrcadManagedStopRequest(path: string): OrcadManagedStopReque
   return OrcadManagedStopRequestSchema.parse(JSON.parse(buffer.toString('utf8')))
 }
 
-export function sameOrcadManagedStopInstance(
+function sameOrcadManagedStopInstance(
   left: OrcadManagedStopInstance,
   right: Pick<OrcadManagedStopInstance, 'pid' | 'startedAtMs' | 'nonce'>
 ): boolean {
diff --git a/src/main/orcad/orcad-native-preflight.ts b/src/main/orcad/orcad-native-preflight.ts
index 546353dd9e3..a6a5c5b9c49 100644
--- a/src/main/orcad/orcad-native-preflight.ts
+++ b/src/main/orcad/orcad-native-preflight.ts
@@ -15,7 +15,7 @@ import {
 } from './node-pty-precondition'
 import { ORCAD_EXIT_CONFIGURATION } from './orcad-configuration-exit'
 
-export type NativePreflightHooks = {
+type NativePreflightHooks = {
   check?: () => NodePtyPreconditionVerdict
   toolchainHints?: (platform: NodeJS.Platform) => string[]
   warn?: (message: string) => void
diff --git a/src/main/orcad/orcad-plaintext-credential-migration.ts b/src/main/orcad/orcad-plaintext-credential-migration.ts
index 0be71d4c0f2..21833585013 100644
--- a/src/main/orcad/orcad-plaintext-credential-migration.ts
+++ b/src/main/orcad/orcad-plaintext-credential-migration.ts
@@ -24,7 +24,7 @@ import { COOKIE_ENVELOPE_PREFIX, getMiniMaxCookiePath } from '../minimax/minimax
 import { miniMaxApiKeyEnvelopeFile } from '../minimax/minimax-api-key-store'
 import { openCodeGoApiKeyEnvelopeFile } from '../opencode/opencode-go-api-key-store'
 
-export type PlaintextCredentialTarget = {
+type PlaintextCredentialTarget = {
   path: string
   /** `<prefix>plaintext:<base64>` becomes `<prefix>encrypted:<base64>`. */
   envelopePrefix?: string
@@ -32,7 +32,7 @@ export type PlaintextCredentialTarget = {
   raw?: boolean
 }
 
-export type PlaintextCredentialMigrationResult = { sealed: number; failed: number }
+type PlaintextCredentialMigrationResult = { sealed: number; failed: number }
 
 function encFilesIn(dir: string): string[] {
   try {
@@ -49,7 +49,7 @@ export function orcadCredentialRoot(): string {
   return join(homedir(), '.orca')
 }
 
-export function listPlaintextCredentialTargets(): PlaintextCredentialTarget[] {
+function listPlaintextCredentialTargets(): PlaintextCredentialTarget[] {
   return [
     { path: getWorkspaceTokenPath(LEGACY_WORKSPACE_ID), raw: true },
     ...encFilesIn(getWorkspaceTokenDir()).map((path) => ({ path, raw: true })),
diff --git a/src/main/orcad/orcad-profile-state-startup.ts b/src/main/orcad/orcad-profile-state-startup.ts
index 0f997c8e390..1d49628796c 100644
--- a/src/main/orcad/orcad-profile-state-startup.ts
+++ b/src/main/orcad/orcad-profile-state-startup.ts
@@ -5,7 +5,7 @@ import { initSshHostKeyStoreFile } from '../ssh/ssh-host-key-store'
 import { initOrcadHeldFenceTokenFile } from '../ssh/orcad-held-fence-tokens'
 import { emitOrcadProfileStateAuthoritySelected } from './orcad-profile-state-telemetry'
 
-export type OrcadProfileStateStartup = {
+type OrcadProfileStateStartup = {
   store: ProfileStateStoreFactoryResult['store']
   authority: {
     backend: ProfileStateStoreFactoryResult['backend']
diff --git a/src/main/orcad/orcad-profile-state-telemetry.ts b/src/main/orcad/orcad-profile-state-telemetry.ts
index 0e53dc31a67..ff1b1b88d17 100644
--- a/src/main/orcad/orcad-profile-state-telemetry.ts
+++ b/src/main/orcad/orcad-profile-state-telemetry.ts
@@ -12,7 +12,7 @@ export type OrcadProfileStateAuthoritySelection = {
   migrated: boolean
 }
 
-export type OrcadProfileStateTelemetrySink = (line: string) => void
+type OrcadProfileStateTelemetrySink = (line: string) => void
 
 /** Render one machine-readable stderr line for fleet log collection. */
 export function formatOrcadProfileStateAuthoritySelected(
diff --git a/src/main/orcad/orcad-secret-key-record.ts b/src/main/orcad/orcad-secret-key-record.ts
index a957d72d801..78dc6a8c6e7 100644
--- a/src/main/orcad/orcad-secret-key-record.ts
+++ b/src/main/orcad/orcad-secret-key-record.ts
@@ -34,12 +34,12 @@ export type StoredKeyState =
       check: string
     }
 
-export type RecordRead =
+type RecordRead =
   | { kind: 'absent' }
   | { kind: 'record'; stored: StoredKeyState }
   | { kind: 'unreadable'; reason: string }
 
-export function parseStoredState(raw: string): StoredKeyState | null {
+function parseStoredState(raw: string): StoredKeyState | null {
   let parsed: unknown
   try {
     parsed = JSON.parse(raw)
diff --git a/src/main/orcad/orcad-ws-port-policy.ts b/src/main/orcad/orcad-ws-port-policy.ts
index a8b21d69276..6e11fb52d8d 100644
--- a/src/main/orcad/orcad-ws-port-policy.ts
+++ b/src/main/orcad/orcad-ws-port-policy.ts
@@ -1,6 +1,6 @@
 import { ORCAD_MANAGED_ACTIVATION_ROOT_ENV } from '../../shared/orcad-managed-launch-env'
 
-export type OrcadWsPortOptions = {
+type OrcadWsPortOptions = {
   wsPort?: number
   preferPinnedWsPort?: boolean
   requirePinnedWsPort?: boolean
diff --git a/src/main/orcad/orcad-wsl-host-login-environment.ts b/src/main/orcad/orcad-wsl-host-login-environment.ts
index 441779fa086..375a088b564 100644
--- a/src/main/orcad/orcad-wsl-host-login-environment.ts
+++ b/src/main/orcad/orcad-wsl-host-login-environment.ts
@@ -10,7 +10,7 @@ import { resolveLoginShellEnvironment } from '../startup/login-shell-environment
 
 // Why an allowlist: the snapshot is the whole rc environment, and PATH has its own hydration with
 // the Windows-drive rules; askpass helpers are left out because a GUI one would block a headless git.
-export const WSL_HOST_LOGIN_ENV_NAMES: readonly string[] = [
+const WSL_HOST_LOGIN_ENV_NAMES: readonly string[] = [
   'SSH_AUTH_SOCK',
   'SSH_AGENT_PID',
   'GIT_SSH',