Zombie Code

Zombie code is alive on paper and dead in practice. The functions call each other, the imports resolve, the compiler is happy — and no entry point in your application ever reaches any of them. Mapnostics finds them by building the call graph and walking it from every real entry point.

Zombie versus dead

The two scans answer different questions, which is why they are separate tabs with separate counts.

Dead code has no caller at all. A single export that nothing imports.
Zombie code has callers. It sits inside a cluster of functions that call one another, and the whole cluster is orphaned — nothing outside it ever calls in.

Dead-code scanners miss zombies for exactly this reason: every function in the cluster has a reference, so a reference count never drops to zero. Only reachability from an entry point tells you the truth.

NOTE

A finding can carry both badges. Two analyzers landing on the same lines is corroboration, and the tab keeps both rows rather than collapsing them.

How detection runs

The scan has three phases and runs in batches from your browser, so you can stop it and resume:

Clear — previous zombie findings for this repository are removed, so a re-run never mixes two scans.
Build the call graph — every file is walked and each call site recorded as an edge.
Detect — the graph is walked from every entry point. Whatever is never reached is a zombie.

NOTE

Run the Dead Code analysis first. Zombie detection walks the indexed corpus that scan populates, and the tab says so on an empty repository.

The tab

mapnostics.com/repo/mapnostics-app/zombie-code

🧟

Zombie Code

Functions that exist in a call chain but are never triggered by any entry point.

Last scanned 31 Aug, 09:31Re-run Detection

Zombie Detection Pipeline100%

Clearing previous zombie data…Building call graph…✓ 312 files walked · 4,180 call edgesDetecting unreachable functions…✓ Detection complete — 8 zombie functions in 5 files

Zombie Code Overview

8 zombie functions detected

5 high-confidence zombies (≥90%) — verify, then remove

3 medium-confidence zombies — review recommended

5 files affected

Fix firstlib/reports/export.ts3 zombies · start here →

FilterAll (8)High (5)Medium (3)

export.ts

lib/reports/export.ts

3 zombiesHigh⌄

handleLegacyExport

L44–91ZOMBIE

Reachable from two other functions, but no route, page, job or CLI entry point reaches any of them.

Nobody callshandleLegacyExport→buildCsvRows→escapeCell— all zombie

Feature flags

Flags stuck permanently on or off are the most common form of zombie code

Re-scan

Decided in code — safe to act on

ENABLE_NEW_BILLINGalways onlib/flags.ts

LEGACY_CSV_EXPORTalways offlib/reports/export.ts

Set at runtime — needs production data

Mapnostics can find these flags but not their live values. A flag stuck on for months reads identically to one toggled yesterday.

The call chain

Every zombie finding can show the chain behind it: Nobody calls A → B → C — all zombie. Read it as the path the scan followed. The first name is the function nothing outside the cluster calls, and each arrow is a call it makes into the rest of the orphaned group.

The chain is what makes a zombie safe to act on. It names the whole cluster to delete rather than one function whose removal would only break the next one along.

Confidence

Zombie findings carry the same confidence scale as dead code, and the same filter: All, High (≥90%), Medium. Dynamic dispatch is the usual reason a score sits in the middle — a call made through a variable cannot be resolved statically, so the scan cannot rule out a caller it never saw.

Feature flags

A card below the findings scans for feature flags, because a flag that has been hard-off for a year is the most common way live code becomes unreachable. It splits them in two:

Decided in code — the flag resolves to a constant. Safe to act on from the repository alone.
Set at runtime — the value comes from a service or an environment variable.

NOTE

Mapnostics can find runtime flags but not their live values. A flag stuck on for months reads identically to one toggled yesterday. Confirm against your flag dashboard before removing anything behind one.

What to do next

Delete the whole chain, not the head of it. The rest becomes dead code the moment the head goes.
Check the Impact Simulator for the file first — a zombie cluster can still be imported by a test.
Look at the feature flags card before concluding a route is unreachable.
Re-run detection after the deletion merges, so the Health Score reflects it.

TIP

Zombie code is worth up to 20 points of the Health Score, second only to dead code.