Small cleanup nits from reading the source

Dead route: POST /-/delete-webhooks always throwUnimpl

The route is wired up but the handler unconditionally throws TyE5R2MRSH35, so it's a discoverable endpoint that can only ever return an error.

• WebhooksController.scala:98

Harmless — it just fails cleanly. Could drop the route until it does something, so integrators poking at the surface don't find a dead door.

Commented-out routes left in conf/routes

Two commented lines still sit in the routes file: #POST /-/v0/do-action-batch and #GET /-/events (the latter superseded by list with listWhat:"Events").

• conf/routes:309, conf/routes:395

Zero runtime effect since they're commented — purely a housekeeping note. Fine to leave as intentional breadcrumbs if that's the plan.

GET /-/v0/search handler body is fully commented out

The route exists but the handler just throws TyEUSEPOST ("use POST") — the actual ?freetext= branch below it is commented dead code.

• SearchController.scala:136-151

This one is arguably good as-is: the TyEUSEPOST message is a friendly nudge to callers who GET instead of POST. Just flagging that the commented ?freetext= branch underneath is never reachable, in case it reads as still-live when someone next opens the file.

Unreachable if (!isOk) block in login-with-secret

Right after a throwForbiddenIf(!isOk, ...), there's an if (!isOk) { ... } block — but if !isOk were true the throwForbiddenIf would already have thrown, so the block can never run.

• SsoAuthnController.scala:163-167

Harmless dead branch — no behavior change either way. Probably a leftover from a refactor where the guard moved above it.

list-users usersOnly is a fixed route value, so its guard is unreachable

The route hardcodes usersOnly = true, so the dieIf(!usersOnly, "TyE206KTTR4") guard and the accompanying "list groups" TODO can never be exercised over HTTP.

• UserController.scala:1512; route conf/routes:416

No impact today. Either wire up a ?usersOnly= param to reach the group-listing path, or drop the dead branch — whichever matches where you want that feature to go.

ApiV0Controller match/case dispatch is marked DEPRECATED but still live

The old match/case dispatch in ApiV0Controller is annotated DEPRECATED in favor of the apiv0_* controller methods — just noting it's still the live path for ping / export-site-json / feed, so the deprecation isn't fully retired yet.

• ApiV0Controller.scala:63-64

Nothing broken — it works fine; this is a "the TODO comment is still accurate" note more than anything.

SitePatchParser.MaxBytes looks unused for these endpoints

SitePatchParser.MaxBytes = 1001000 appears dead for the upsert path — the real body cap in play is talkyard.maxImportDumpBytes. Not fully verified — a quick grep suggested MaxBytes is unreferenced on the upsert route, so I'd double-check before removing it.

• SitePatchParser.scala:54

If it really is unused it's just a stray constant — harmless, but a small trap if someone assumes it's the enforced limit.