I had hardened it eight times. Every pass made it better. None of them made it right, and I couldn't have told the difference from where I was standing.
I write a small tool called unreached. It finds things in a repo that exist
and are never reached — not dead code in the compiler sense, the dumber and more common
thing: a function you wrote, a stylesheet rule you added, sitting there, correct, wired to nothing.
It has been through eight rounds of hardening. It got a help flag that stopped resolving
--help as a directory path. It stopped reporting a live safety function as dead because
the only caller was in its own file. It learned that a leading slash means server root, not
here. Every round found a real bug and fixed it.
Every round was against my own repositories.
This evening I pointed it at four codebases I did not write: got, chalk,
express, lodash. It was the first time it had ever seen code that wasn't
mine.
It produced seven findings. All seven were wrong.
| it said | what was actually true |
|---|---|
| express 2 broken links |
app.use(express.static(path.join(__dirname,'public'))) resolves both at
runtime. One of them, /client.js, also has its own explicit
app.get() handler. Two independent resolvers, neither visible on disk. |
| lodash 4/7 exports dead |
The file was playwright.config.js. A config is read by a runner,
never imported by source. Four pieces of live configuration reported as dead. |
| lodash 5 CSS blocks never worn |
All inside vendor/firebug-lite — bundled third-party code. Technically true.
Completely useless. Nobody wants an audit of code they didn't write. |
| lodash 5 broken links in test/ |
Every one was ../node_modules/… on a fresh clone. The only true statement
available was "I did not run npm install." |
This post said "four false-positive mechanisms" and "one cause under all four." There were five. I found the fifth at 18:38 the same evening, on a stranger's repositories, after this was already live.
Two unrelated GitHub Actions by the same author both reported addSignal, removeSignal
as dead exports. Identical finding, unrelated code — which is the tell. Both files were
dist/index.js: ncc's bundle, not their source. Generated output is
committed to a repo on purpose and nothing in it is written by hand, so every symbol in it is
either used by the runtime or was never theirs to begin with. dist/ and
build/ are now skipped alongside vendor/.
The part worth keeping is where I found it. Those repos belong to the first qualified stranger who has ever found my work on his own. A report on his code was going to be my first contact with him. It would have opened by confidently naming two functions in a file he did not write. I ran it and read the output before sending it — that, and nothing about the tool, is the only reason this is a correction instead of an introduction.
My repos are static sites. No server, no bundler, no framework, no test runner. In that world, "exists on disk" and "is reachable" are the same sentence.
So the tool was built on that equivalence without anyone deciding to build it on that equivalence. Every codebase that breaks it — which is most of them — was invisible. And the eight hardening passes did not protect me. They are the reason it happened. Each one reduced error against the same small world and returned confidence I hadn't earned.
A colleague put the general form better than I did, after finding the same shape in her own benchmark on the same evening — a metric calibrated on one prompt regime, applied to a sample containing four:
Has this instrument ever produced a result on data it was not built from? If not, its pass rate is unmeasured, not high.
The signature is what makes it nasty: clean at home, wrong abroad. There is no amount of local testing that reaches it, because locally it is genuinely correct. More of your own data cannot help. The only exit is somebody else's.
public/, links resolve against it.vendor/,
third_party/, external/.node_modules are ignored.⚠ GUESS rather than as findings — because I can't stand behind them
and would rather say so than sell a report full of them.All four repos now report clean. Which is the correct answer, and it is the
result that actually matters: a tool that cries wolf on express is a tool you mute
inside a week, and a muted check is identical to no check.
I did not find this by being careful. I found it by running the thing somewhere it had never been. I could have hardened it eight more times against my own code and every pass would have looked like progress.
And I nearly didn't run it — the tool had a clean record, a published README and a priced offer attached to it. Everything about its local track record said it was ready. That track record was the least informative data I owned and it was the only data I had.
The nights are photographs. Four sets, fifty-four images — shot in the same flat, at the same desk, in the same hours as everything above. One payment, no subscription, nothing to cancel.