Test-audit next steps

Test-audit next steps

Created: 15/07/2026

Current evidence

• scripts/audit_orphan_tests.py scans local imports and mocks from Python and TypeScript tests.
• The current high-confidence queue contains two stale mocks, not redundant test files:
  • __tests__/api/cron/process-queue.test.ts mocks @/lib/supabase/auth, which no longer exists. The route and its eight tests pass.
  • __tests__/app/settings/page.test.tsx mocks @/components/settings/activity-section, which the current settings page no longer uses. Its eleven tests pass.
• The optional filename heuristic produces many low-confidence candidates. Do not use it for deletion decisions.
• The mutmut calibration killed 2/2 known mutants.
• The URL-normalisation pilot killed 41/47 mutants; six survivors need edge-case review:
  • scheme-less URLs with a netloc;
  • URLs containing userinfo;
  • blank query-string values;
  • double-slash paths.

Immediate follow-up

1. Remove or update the two stale vi.mock declarations, retaining both test files.
2. Add focused URL-normalisation cases for the six survivor behaviours.
3. Rerun the mutmut pilot and confirm the new assertions kill the relevant mutants.
4. Keep mutation survivors as test-quality findings, not source-deletion evidence.

Broader audit sequence

1. Create a real Knip production profile using !-marked production entry and project patterns. The current --production result is not meaningful because those patterns are absent.
2. Run both comprehensive and production Knip reports. Treat test-only reachability and configured ignores as explicit evidence categories.
3. For each candidate, record a ledger entry containing:
   • candidate path and signal source;
   • static importers, references and re-export chains;
   • GitNexus upstream callers, process membership and risk;
   • cocoindex-code/ccc cross-language references;
   • memtrace runtime evidence;
   • test-discovery and fixture/helper dependencies;
   • mutation or targeted-test evidence;
   • reviewer decision and rationale.
4. Before editing a symbol, run GitNexus upstream impact analysis. Warn on HIGH or CRITICAL risk.
5. Remove only one low-risk file or tightly coupled cluster at a time.
6. Run targeted tests, relevant full suites, typecheck, lint, format and build after each deletion.
7. Re-run the audit tools and GitNexus change detection before any commit.
8. Update Knip or other baselines only after the deletion and validation are complete.

Tool boundaries

• Knip identifies reachability candidates but can be masked by test entries and ignores.
• GitNexus identifies callers and execution-flow blast radius.
• ast-dataflow validates imports, references, re-exports, enums and type relationships.
• cocoindex-code/ccc catches references outside the TypeScript graph, including Python, SQL and Markdown.
• memtrace shows runtime-loaded paths but absence at runtime is not proof of dead code.
• Mutation testing measures test strength around live code; it does not identify redundant test files by itself.
• Understand-Anything summaries can assist human review but are not deletion authority.

No files should be deleted solely because one tool reports them as unused.