Build1 distinct publisher3 min readUpdated
A dev.to write-up describes a statement-level dead-code tracer whose useful feature is an unresolved state. Two runs of the same skill still disagreed by 66 statements.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
A dev.to post describes a dead-code analyser called SPIDER, built as an agent skill, whose design choice is a third answer alongside used and unused: unresolved [4][9]. That third answer is the whole engineering argument, because a two-answer tool has to file a verdict whenever reflection or framework indirection hides a link, and according to the author it files the wrong one [1][2].
The failure mode is familiar to anyone who has run one of these over a real repository. When a name is built at runtime, a class is addressed through a variable, or a framework reads a value instead of calling a function, the analyser cannot see the edge but still has to answer [2]. The author says tools then split into two camps: some emit a confidence percentage and leave the operator to it, others commit, delete live code, and hand back an exception list to be maintained by hand for ever [3].
The method is tracing rather than name search [4]. The codebase is split into individual top-level statements, each numbered with an exact address of file, first line and last line; entry points are identified; the walk proceeds from each entry point along links one statement at a time; whatever the walk reaches is alive, and whatever it never reaches is not needed [5]. It runs one statement at a time across Python, TypeScript, JavaScript and CSS in a single list under one rule [6], so a stylesheet can be reported as three live rules and one dead one instead of judged as a file [7], and when a TypeScript file addresses a CSS class both ends of the link sit in the same model [8]. Statements whose links cannot be established are set aside as unresolved, then opened in the real source and settled one by one before they are given a final verdict [9]. One rule outranks the rest: a name assembled at runtime is never declared unused, which covers styles[status], getattr(obj, name), and classes built by string concatenation [10].
On a production Next.js application, the reported run covered 858 statements across 66 files [11] and returned 121 statements nothing in the running program reaches, described as two entire stylesheets, one abandoned screen with its stylesheet, and nine separate dead rules, or one statement in seven [12] - about 14 percent [1]. Five style rules that a name-based search had wrongly condemned were addressed through an assembled name and survived because of the unresolved state [13]. The 121-item list, each entry carrying its address, is presented as the deliverable: bounded work of known size handed back to an agent, rather than "audit my repository" [14].
The honest part of the post is the part that undercuts it. Execution is by a model, not a compiler [15], and the same skill run by two different models over the same project produced 121 unneeded statements and 55 [16] - a gap of 66 statements, or 55 percent of the larger count [2]. The author traces the whole difference to one decision at step two, where one run concluded from its own general knowledge of browsers that every CSS rule is an entry point, which the skill never says [17]. Both reports read as equally sound [18]. Adding more prose to the instructions did not fix it [19]; what the repository ships instead is an evals folder with a small project carrying six deliberate traps, including a stylesheet nobody imports, a name assembled at runtime, a bundler directive, and data the framework reads rather than code somebody calls [20].
Worth watching whether that answer key actually catches an invented entry-point rule, and whether the unresolved queue gets worked or quietly becomes permanent limbo. All of the above is one self-reported project.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
SPIDER is an agent skill; it does not search for names, it traces.
Method: split the codebase into individual top-level statements, each with a number and an exact address (file, first line, last line); find the entry points that something outside the program starts; walk from each entry point along the links one statement at a time; whatever the walk reaches is alive, whatever it never reaches is not needed.
It works one statement at a time across four languages at once - Python, TypeScript, JavaScript and CSS end up in one list, measured by one rule.
It can report that three rules inside a stylesheet are alive and the fourth is dead, instead of shrugging at the file as a whole.
When a TypeScript file addresses a CSS class, both ends of that link are in the same model; running three single-language tools means nobody sees both ends.
During the work there is a third state, unresolved: a statement whose links cannot be established is not declared dead but set aside, later opened in the real source code and settled one by one, twenty times over if needed, before falling into one of the two final kinds.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Single first-party account with concrete numbers but nothing reproducible
All evidence comes from one self-published post by the tool's author. The design description is specific and internally consistent, and the shipped eval suite with twenty-nine CI checks is a real verification mechanism. But the empirical claims - 858 statements, 121 unreached, five rules rescued, 121 versus 55 across models - rest on unnamed codebases and unnamed models with no published output, diff, or log, and no independent replication or comparison against named incumbent tools. That supports 'documented design, unverified results'.
Public MIT release plus author's own run; no external usage
There is a real, installable artefact - a GitHub repository under MIT with a spider.skill release download, stated runtime prerequisites, and CI-run evals - and one disclosed first-party run on a production Next.js app. Beyond that the supplied material shows no external adopters, stars, downloads, forks, issues, integrations, or third-party replications, so adoption is at the 'shipped and self-used' floor.
Mildly overstated: novelty and yield asserted, variance disclosed
Positive but small. Overstatement comes from the framing: 'two things fell out of that design that I have not found elsewhere' and a 'one statement in seven' yield are asserted without any named comparison tool or published output, and the premise about how all other tools behave is unevidenced. What holds the gap down is unusual self-correction - the author volunteers that two models diverged by 66 statements on the same project, that the wrong report is unreadable as wrong, that more prompt prose did not help, and that the output is a candidate list rather than a delete command, with an answer key shipped so others can catch him out.
Author promoting own free MIT project; no commercial stake disclosed
The post is written by the tool's creator, ends with a repository link, install instructions and a call for bug reports, so there is a clear distribution and reputation incentive to make the approach look novel and effective. It is tempered by the licence and posture visible in the source: MIT, free, no pricing, no company, no funding claim, and a README-level instruction never to accept an unchecked result plus a shipped answer key that invites falsification. No sponsorship, employer, or vendor relationship is disclosed in the material, and none is assumed here.
Clear text, one publisher, no way to verify the numbers
Confidence in this assessment is moderate. The source is unambiguous and detailed, so what is claimed is easy to characterise, and the design and packaging claims are safe. Confidence is capped by structure: a single publisher, a single first-party author, no independent corroboration, unnamed models and codebases, and no adoption data beyond a release - so any judgement about whether the tracer's results are accurate, or whether the variance figure generalises, remains weakly grounded.
build
Allow-list the closed set, block-list the open one: 193 thin geo pages, one gate1 distinct publisher
build
Next.js 15 warns instead of failing, so the async params fix keeps getting deferred1 distinct publisher
build
A retry cap is not a retry budget, and each language breaks it in a different place1 distinct publisher
build
Return the admission record, not the log line: one memory service's case for receipts1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 17, 2026