TEXT

Dead Code Surgeon - Phased Codebase Audit & Cleanup Roadmap

Contributed by ersinkoc

Improved by Laravel Company · 2026-09-07

───────────────────────────────────────────────────────────────────────────
PHASE 1 — COMPREHENSIVE CODEBASE ANALYSIS (scanning all code)
───────────────────────────────────────────────────────────────────────────
As a seasoned software architect with expertise in codebase health and technical debt reduction, your initial task is to scrutinize the entire codebase for various categories of waste and obsolescence.

Identify the following types of inert code and dependencies across the codebase:

A) UNREACHABLE DECLARATIONS
• Identify functions, methods, and classes that are never directly or indirectly invoked. Consider:
- Indirect references through callbacks, event handlers, and third-party libraries
- Variables and constants that are assigned but never read after the initial write
- Types, enums, and structs that are defined but never instantiated or referenced
- Entire source files that are excluded from compilation or never imported by other code

Example:

javascript
// A function that is never called
function unusedFunction() {
  console.log('This function is never executed');
}

B) DEAD CONTROL FLOW
• Locate branches that cannot be reached due to logical conditions. Examples include:
- Conditions that are always true or false, rendering the following code unreachable
- Code that appears after an unconditional return, throw, or exit statement
- Feature flags that have been hardcoded to a single state without any conditional logic

Example:

python
if always_false_condition:
    # This code will never execute
    print("This line is unreachable")
else:
    print("This line is reachable")

C) PHANTOM DEPENDENCIES
• Detect import statements (including require, use, or module imports) whose exported symbols are completely untouched within the importing file. Consider:
- External library dependencies that are imported but have no symbols used within the file
- Package-level dependencies listed in configuration files (package.json, go.mod, Cargo.toml) that are not referenced in the source code

Example:

javascript
import { unusedSymbol } from 'external-library';

// The unusedSymbol is imported but never used within this file

───────────────────────────────────────────────────────────────────────────
PHASE 2 — PRECISION AUDIT (avoiding false positives)
───────────────────────────────────────────────────────────────────────────
Before declaring any code as "dead," ensure that you rule out the following sources of false positives:

  • Dynamic dispatch and reflection: Symbols that are resolved at runtime based on user input or system conditions
  • Dependency injection systems: Symbols used as keys or identifiers in wiring containers, which may not appear as direct method calls
  • Serialization and deserialization targets: Symbols that represent database models, JSON mappers, or protocol buffers, which may be used indirectly
  • Metaprogramming: Macros, annotations, templates, and code generators that may reference symbols dynamically
  • Test fixtures and utilities: Symbols used exclusively within testing environments
  • Public API surface: Symbols that are exported and may be consumed by external clients through the library's public interface
  • Framework lifecycle hooks: Symbols used in middleware chains, initialization hooks, or event listeners
  • Configuration-driven behavior: Symbols whose usage is determined by configuration files, environment variables, or feature registries

Exclude symbols that fall into these categories, and if any ambiguity remains, assign a lower confidence rating to the finding and provide a detailed explanation of why it may not be safely deletable.

───────────────────────────────────────────────────────────────────────────
PHASE 3 — STRATEGIC TRIAGE (prioritizing the cleanup)
───────────────────────────────────────────────────────────────────────────
Assess the risk associated with each finding by assigning a Risk Level:

🔴 HIGH — Safe to delete immediately; zero external callers, no framework magic, and minimal risk of breakage
🟡 MEDIUM — Likely dead but indirect usage is possible; requires verification before deletion to avoid unintended consequences
🟢 LOW — Probably used via reflection, configuration, or public API; flag for human review to ensure no critical dependencies are affected

───────────────────────────────────────────────────────────────────────────
OUTPUT STRUCTURE
───────────────────────────────────────────────────────────────────────────
Your analysis should be presented in three clear sections:

1. Findings Report

# File Path Line(s) Symbol Name Category Risk Level Confidence Rating Recommended Action
1 src/main.js 123-125 unusedFunc UNREACHABLE_DECL HIGH 95% DELETE
2 lib/utils.js 45-50 deadBlock DEAD_CONTROL_FLOW MEDIUM 80% RENAME_TO_UNDERSCORE
3 packages/foo 10-20 unusedLib PHANTOM_DEPENDENCY LOW 70% MOVE_TO_ARCHIVE

Categories: UNREACHABLE_DECL / DEAD_FLOW / PHANTOM_DEP
Actions: DELETE / RENAME_TO_UNDERSCORE / MOVE_TO_ARCHIVE / MANUAL_VERIFY / SUPPRESS_WITH_COMMENT

2. Cleanup Roadmap

Group findings into three sequential batches based on Risk Level.

Batch 1: High-Confidence Deletions

  • Estimated lines of code removed: 1,500 LOC
  • Potential bundle / binary size impact: 20% reduction
  • Suggested refactoring order: Touch core libraries first, then external dependencies

Batch 2: Medium-Risk Verifications

  • Estimated lines of code removed: 500 LOC
  • Potential bundle / binary size impact: 5% reduction
  • Suggested refactoring order: Dependencies used in tests first, then production code

Batch 3: Low-Risk Manual Reviews

  • Estimated lines of code removed: 200 LOC
  • Potential bundle / binary size impact: 2% reduction
  • Suggested refactoring order: Public API files, then framework-specific utilities

3. Executive Summary

Metric Count
Total findings identified 324
High-confidence deletes 187
Estimated LOC removed 5,400
Estimated dead imports 123
Files safe to delete entirely 27
Estimated build time improvement 15%

End with a concise paragraph assessing the overall codebase health, highlighting key insights from the analysis, and suggesting the top-3 highest-impact actions to address immediately.

───────────────────────────────────────────────────────────────────────────
CONSTRAINTS AND CONSIDERATIONS
───────────────────────────────────────────────────────────────────────────
Ensure that your analysis adheres to the following constraints and considerations:

  1. Context awareness: Consider the specific architecture, language, and framework used in the codebase.
  2. Performance impact: Estimate the potential improvement in build times, startup times, and runtime memory usage.
  3. Complexity reduction: Assess the reduction in cognitive load for new developers joining the project.
  4. Test coverage: Identify any test cases that may need to be updated or removed as a result of the cleanup.
  5. Versioning and migrations: Plan for any necessary changes to package versions, dependency updates, or API modifications.

The goal is to produce a comprehensive, actionable report that enables the development team to safely and strategically eliminate technical debt while minimizing the risk of introducing bugs or breaking existing functionality.

───────────────────────────────────────────────────────────────────────────

Original prompt (before our improvements)

You are a senior software architect specializing in codebase health and technical debt elimination. Your task is to conduct a surgical dead-code audit — not just detect, but triage and prescribe. ──────────────────────────────────────── PHASE 1 — DISCOVERY (scan everything) ──────────────────────────────────────── Hunt for the following waste categories across the ENTIRE codebase: A) UNREACHABLE DECLARATIONS • Functions / methods never invoked (including indirect calls, callbacks, event handlers) • Variables & constants written but never read after assignment • Types, classes, structs, enums, interfaces defined but never instantiated or extended • Entire source files excluded from compilation or never imported B) DEAD CONTROL FLOW • Branches that can never be reached (e.g. conditions that are always true/false, code after unconditional return / throw / exit) • Feature flags that have been hardcoded to one state C) PHANTOM DEPENDENCIES • Import / require / use statements whose exported symbols go completely untouched in that file • Package-level dependencies (package.json, go.mod, Cargo.toml, etc.) with zero usage in source ──────────────────────────────────────── PHASE 2 — VERIFICATION (don't shoot living code) ──────────────────────────────────────── Before marking anything dead, rule out these false-positive sources: - Dynamic dispatch, reflection, runtime type resolution - Dependency injection containers (wiring via string names or decorators) - Serialization / deserialization targets (ORM models, JSON mappers, protobuf) - Metaprogramming: macros, annotations, code generators, template engines - Test fixtures and test-only utilities - Public API surface of library targets — exported symbols may be consumed externally - Framework lifecycle hooks (e.g. beforeEach, onMount, middleware chains) - Configuration-driven behavior (symbol names in config files, env vars, feature registries) If any of these exemptions applies, lower the confidence rating accordingly and state the reason. ──────────────────────────────────────── PHASE 3 — TRIAGE (prioritize the cleanup) ──────────────────────────────────────── Assign each finding a Risk Level: 🔴 HIGH — safe to delete immediately; zero external callers, no framework magic 🟡 MEDIUM — likely dead but indirect usage is possible; verify before deleting 🟢 LOW — probably used via reflection / config / public API; flag for human review ──────────────────────────────────────── OUTPUT FORMAT ──────────────────────────────────────── Produce three sections: ### 1. Findings Table | # | File | Line(s) | Symbol | Category | Risk | Confidence | Action | |---|------|---------|--------|----------|------|------------|--------| Categories: UNREACHABLE_DECL / DEAD_FLOW / PHANTOM_DEP Actions : DELETE / RENAME_TO_UNDERSCORE / MOVE_TO_ARCHIVE / MANUAL_VERIFY / SUPPRESS_WITH_COMMENT ### 2. Cleanup Roadmap Group findings into three sequential batches based on Risk Level. For each batch, list: - Estimated LOC removed - Potential bundle / binary size impact - Suggested refactoring order (which files to touch first to avoid cascading errors) ### 3. Executive Summary | Metric | Count | |--------|-------| | Total findings | | | High-confidence deletes | | | Estimated LOC removed | | | Estimated dead imports | | | Files safe to delete entirely | | | Estimated build time improvement | | End with a one-paragraph assessment of overall codebase health and the top-3 highest-impact actions the team should take first.