audit-dead-code: detect dead code in JS/TS outside a package.json root

[kyle-sexton]

Summary

code-tidying:audit-dead-code 0.23.2 detects dead JS/TS only through knip, and knip runs only
under a package.json root. Standalone scripts get no dead-code check at all. Examples are
.github/scripts/*.mjs, CI helpers, and dotfiles tooling. This is common in org .github, CI, and
config repos.

In melodic-software/.github, a manual whole-word grep found contentsUrl and runLiveCheck in
.github/scripts/pr-section-drift.mjs. Both are exported but used only inside that file. The skill
never saw the file.

Fix

Options, cheapest first. Measure precision on the trap fixtures before choosing a tier.

1. Grep-lane fallback. Only shell|pwsh files enter the grep lane (scripts/dead-code-scan.sh:225),
   and dc_symbol_defs extracts definitions only for those two
   (scripts/lib/dead-code-shapes.sh:442-469). The repo-wide reference search already covers every
   tracked file (scan:638-640). Route TS/JS files that no package.json root owns to the grep
   lane, and add a definition regex for function, class, const and export declarations.
2. knip without a manifest. Check whether knip can run over loose files with a generated
   temporary config outside the repo. Not verified.
3. Exports used only in their own file. Report them at the lowest tier from whichever lane
   covers the file. Whether knip itself flags them by default is not verified.

Verification

• Done when a fixture with a standalone .mjs that holds one unreferenced function produces a
  candidate for it, and a referenced function does not.
• Precision is measured on the existing trap-fixture corpus and recorded in the SKILL.md lane table.

Related

• Found in a playbooks:repo-sweep sweep of melodic-software/.github (PR chore(skill-quality): harden static checker + record terminal retrofit scope #153).
• Coverage accounting for files no lane covered is a sibling issue from the same audit.

[kyle-sexton]

Reopened. This comes from the 2026-09-29 audit of the Cursor agent run.

What the audit found. PR #4898 closed this issue as COMPLETED with a Closes keyword, but it only parked the gap in docs. None of the issue's "Done when" items was delivered: no fixture with a standalone .mjs, no candidate for an unreferenced function in one, and no precision recorded in the SKILL.md lane table. The park was an agent decision. The owner never made it.

What is fixed. PR #5327 (draft, not yet merged) takes option 1, the grep-lane fallback: function, class, const, let and var declarations in JS/TS that no package.json root owns are extracted as ts-unreferenced-symbol (tier 2), and knip keeps files inside a root.

• Fixture: standalone.mjs yields a candidate for the unreferenced renderLegacyRow and none for summarizeRows, which the module calls.
• Measured precision 66.7% (2 of 3) and recall 66.7% (2 of 3) on the trap corpus plus standalone.mjs, recorded in the SKILL.md lane table.

Both "Done when" bullets are met on that branch, so the PR uses Closes #4522. The issue closes when it merges. Options 2 (knip without a manifest) and 3 (exports used only in their own file) were not implemented. If the owner wants symbol-level coverage beyond this fallback, say so and a follow-up will be filed.