What are ghost beans and can I trust the detection?

[ddsha441981]

The report has a ghostCandidates section listing some of my beans. Does this mean those beans are dead code I can delete?

[ddsha441981]

No — never delete based on the list alone. The wording is deliberate: WireDoctor never claims a bean is "unused", and every payload carries confidence: LOW plus a disclaimer.

Ghost detection works in two phases with different trust postures:

Phase 1 — Ghost Candidates (passive, always on): crosses three metadata signals with zero intrusion:

1. bean was eagerly instantiated at startup (it cost you memory/boot time)
2. 0 incoming edges in the resolved dependency graph
3. no detectable entry point — @Controller/@RestController, @Scheduled/@EventListener (incl. private/inherited methods), messaging listeners (@KafkaListener etc.), CommandLineRunner, Lifecycle, HealthIndicator, @Configuration, @Aspect, …

Detection errs broad on purpose — a false entry-point match just shrinks the candidate list, while a missed one would wrongly accuse a working bean. The entryPointsExcluded / notInstantiatedExcluded counts show why the list is shorter than the raw orphan list.

Phase 2 — First-Touch Tracking (opt-in, dev/staging): wraps beans in a thin counting proxy and reports which were never invoked during this run (wiredoctor-ghost-report.json at shutdown). Confidence scales with run duration — but a bean idle in a 5-minute dev run may be the month-end batch job.

Treat candidates as investigation leads: check for ApplicationContext.getBean() lookups, reflection, and scheduled/batch paths before removing anything. Full details: Ghost Detector guide.