Every test passed on a QUIC transport that no code path had ever constructed

A roughly 500-line QUIC transport sat in a green workspace with passing tests and documentation, and had never once opened a socket ^[2][3][5]. The check that proved it was a single grep, which is worth stealing, because the failure mode is common: a component with tests, docs, and no caller ^[4][7].

The transport belongs to SMESH, a coordination protocol its author models on mycorrhizal signalling, where signals diffuse, decay on their own, and are reinforced when independently confirmed ^[1]. The code looked like real networking: a quinn endpoint serving as both server and client, self-signed certs, length-prefixed bincode frames over unidirectional streams, an accept loop spawning per-connection and per-stream tasks, connection pooling ^[2]. According to the writeup on dev.to, `grep -rn "QuicTransport"` returned three lines: the struct definition, its impl block, and a re-export from `lib.rs` ^[4]. Nothing in the workspace instantiated it and no binary opened a socket ^[5]. `SmeshRuntime` imported `TransportConfig`, stored it in a struct field, and never read it again ^[6].

Then an integration test was written that starts two runtimes, has one dial the other, and asserts a signal crosses ^[8]. It panicked on the first call: rustls 0.23 refuses to select a crypto backend when more than one is compiled in, and quinn pulls in both through its own feature set, so every call to `QuicTransport::new` would have panicked for anyone ^[9]. That detail settles what the green suite was actually testing. If the constructor panics unconditionally and the suite passed, no test in that suite ever constructed the transport ^[17]. Whatever the tests asserted, they asserted it about code paths that stopped short of the type.

Two more fell out. `connect()` stored the connection in the pool, but only the accept loop pumped incoming streams, and the accept loop only sees connections you accepted, so a node that dialled out could send and would never receive ^[10]. And the frame reader took an attacker-controlled big-endian `u32`, cast it to `usize`, and allocated a vector of that length; `max_message_size` was in the config struct and never read, so a 4 GiB length prefix buys a 4 GiB allocation ^[11]. The author's own summary is that none of these are clever bugs, they are what you get free the first time code meets a socket ^[19].

The more expensive finding was in the algorithm. `Network::tick` expanded a signal one hop per tick by iterating every node's adjacency, calling every node's relay policy, and mutating a single global reached set on a shared signal: breadth-first search from a god's-eye view of the graph ^[12]. That runs fine in one process and is unavailable in a mesh where no node can see the graph, and porting it produced three corrections that each turned out to be a genuine bug ^[13].

The sharpest one inverts a habit. Signals are content-addressed, so two agents independently reaching the same conclusion produce the same hash, and `emit()` saw a hash it already held, called it a duplicate, and dropped it ^[14][15]. The protocol exists to measure independent confirmation ^[1], so the deduplication was discarding its only evidence; the fix records the second node as an attester and forwards the merged claim ^[16].

Worth watching in your own tree: config fields that are stored and never read, and any subsystem whose tests never reach its constructor. Both are greppable in less time than it takes to read a coverage report.