The reviewer flagged the helper as dead code, but a string in the config was the only caller

A static review and an AI reviewer both flag processRefundLegacy as unused: nothing imports it directly, no test calls it, and the deletion diff looks clean. The function is reached from a string key in a dispatch table that only activates under a non-default payment flow, so typecheck and default-path tests stay green while removal breaks that flow in production. This piece explains why static reachability misses registry, manifest, and config-driven routing, what ships when the helper is deleted, and the reachability checks (grep the key, expand the dispatch table, trace the string to its config, check gated-path tests, require a caller trace) that prove a function is dead before deleting it.