The Debt of Being Misread
There's a kind of diff that has started turning up in maintained projects: no behavior change, no defect fixed, a working function reshaped so that an automated vulnerability scanner stops filing false reports against it. Not a security fix. Not a feature. A rewrite whose only purpose is to change what a certain class of reader sees when it looks at the code.
Worth sitting with, because it names a cost nobody budgeted for a few years ago: code gets changed not to fix a defect, but to stop being misread by something that can't be corrected any other way.
Ordinary technical debt has a shape everyone recognizes. You ship the fast version, you note the corners you cut, and someday the cost of those corners comes due, usually as a bug or a slowdown or a refactor you'd rather not do under deadline. The debt is owed to the artifact itself. Pay it off and the code is better. Don't, and it rots on a schedule you can roughly predict.
This is a different ledger. The code in that kind of diff isn't wrong. It works, it has usually worked for years, and nothing about its behavior needs to change. What needs to change is its surface, the pattern a scanner's heuristics or model weights happen to associate with a vulnerability class, regardless of whether the logic underneath actually has one. The fix isn't correctness work. It's optics work performed on code that was never broken, aimed at an audience that was never supposed to be a stakeholder in how the function was written.
Call it audience debt: the cost of shaping a piece of working code around a reader you didn't choose and can't negotiate with.
The negotiation part is the whole difference from everything that came before it. A compiler warning, a linter rule, a static analyzer flag, all of those are readers too, and they've been shaping code for decades. But they're readers you can argue with exactly once and have the argument stick. You read the rule, you understand why it fired, and you either fix the thing or you drop a suppression comment into a config file the tool is contractually obligated to respect from then on. The relationship is stable. You settle it and it stays settled.
An LLM-based scanner trawling public repositories for vulnerabilities offers no such settlement. It isn't reading your suppression file, because there's no suppression file it's bound to honor, and there's no one on the other end of the report to explain yourself to even if there were. It's stateless and it's everywhere at once: anyone can stand one up, point it at your repository, and have it generate a plausible-sounding security report with zero marginal cost to them and real triage cost to you. You can't configure around a reader that doesn't remember you from last week and might not even be the same model next month. The only lever left is the code itself. Change the shape of the thing being read, and the misreading, this time, stops.
That's the part that makes it debt rather than just annoyance. A linter fix is permanent once applied; the rule is fixed, your fix satisfies it, done. A fix aimed at a probabilistic reader is provisional by construction. The scanner that misread your code today is not the scanner that will misread code tomorrow. There's no stable configuration to converge on, only a surface you keep adjusting as the population of automated readers drifts under you, each pass leaving a diff with no behavior change and a commit message that has to explain, to a human who will eventually wonder, why a working function got touched for reasons that have nothing to do with what it does.
None of this shows up in a code quality audit. Test coverage didn't move. Cyclomatic complexity, maybe it went up slightly, maybe down, who's to say the metric even noticed. The actual cost lives somewhere an audit doesn't look: in the fact that the next person to read that function, human or otherwise, inherits code shaped partly by an audience that was never meant to have a vote in how it was written, and has no way of knowing that without finding the commit that says so.
A function can only be reasoned with by something capable of being reasoned with back. Everything else just gets rewritten until it stops saying the wrong thing to the wrong reader.