@cplieger/deadset-ts 7.0.0-dev.1 → 7.0.0-dev.3

package/dist/src/references.js

@@ -7,7 +7,10 @@ import { namespaceUses } from "./namespace-objects.js";
 import { globExpression } from "./glob.js";
 import { declarationsByName, nodeKey } from "./inventory.js";
 import { augmentationReferences } from "./augmentations.js";
+import { elementAccessReferences } from "./element-access.js";
 import { indexedAccessReferences } from "./indexed-access.js";
+import { keyofComparisonReferences } from "./keyof-comparisons.js";
+import { unimplementedCalleeReads } from "./unimplemented-callees.js";
 import { moduleDeclarationReferences } from "./module-declarations.js";
 import { overrideReferences } from "./overrides.js";
 import { dirnamePath, queriedModulePath, relativePath, resolvePath } from "./paths.js";
@@ -816,7 +819,8 @@ export function references(project, held, targetRoot, options) {
     const testFile = new Map();
     for (const { file } of walked) {
         const path = renderPosition(file, root, 0).path;
-        const test = patterns.some((pattern) => pattern.test(path));
+        const test = patterns.some((pattern) => pattern.test(path)) ||
+            options.testFileNames?.has(file.fileName) === true;
         testFile.set(file, test);
         if (test) {
             tests.push(path);
@@ -1109,18 +1113,24 @@ export function references(project, held, targetRoot, options) {
             }
         }
     }
+    let typedLookups = 0;
     if (consumer === undefined) {
         found.push(...overrideReferences(project, held, chains, new Set(tests)));
+        const before = options.requestCount?.() ?? 0;
         found.push(...indexedAccessReferences(project, held, chains, root, new Set(tests)));
+        found.push(...elementAccessReferences(project, held, chains, root, new Set(tests)));
+        found.push(...keyofComparisonReferences(project, held, chains, root, new Set(tests)));
+        found.push(...unimplementedCalleeReads(project, held, chains, root, new Set(tests)));
+        typedLookups = (options.requestCount?.() ?? 0) - before;
         found.push(...moduleDeclarationReferences(project, held, root, new Set(tests)));
     }
-    found.push(...augmentationReferences(held, found));
+    const scripts = new Set(walked.filter((one) => one.file.externalModuleIndicator === undefined).map((one) => one.fileId));
+    found.push(...augmentationReferences(held, found, scripts));
     found.sort((a, b) => byPosition(a.position, b.position) ||
         compare(a.to, b.to) ||
         compare(a.from, b.from) ||
         compare(a.use, b.use));
     return {
-        configFile: project.configFile,
         references: consumer === undefined
             ? found
             : found.map((reference) => ({ ...reference, consumer: consumer.id })),
@@ -1135,6 +1145,7 @@ export function references(project, held, targetRoot, options) {
             patternLookups: destructured.cost.patternLookups,
             contextualBatches: contextual.batches,
             contextualLookups: contextual.lookups,
+            typedLookups,
         },
     };
 }

package/dist/src/report.js

@@ -4,7 +4,7 @@
  * renders this document, so no two renderings disagree about which findings exist.
  */
 /** The version of the report schema this analyzer writes a report to. */
-const SCHEMA_VERSION = "8.0.0";
+const SCHEMA_VERSION = "8.1.0";
 /** Every report schema version this analyzer reads: the one the Contract it implements admits. */
 export const SCHEMA_VERSIONS_ACCEPTED = [SCHEMA_VERSION];
 /** The name this analyzer writes every document under and mints every identifier with. */
@@ -55,6 +55,9 @@ function wireDetails(details) {
                 },
             }),
         ...(details.overlap === undefined ? {} : { overlap: details.overlap }),
+        ...(details.removesLastUseOf === undefined
+            ? {}
+            : { removes_last_use_of: details.removesLastUseOf }),
     };
 }
 /** One finding as the finding schema spells it, member for member in its order. */

package/dist/src/reporters/sarif.js

@@ -122,6 +122,10 @@ function relatedOf(found) {
     for (const at of found.details.write_positions ?? []) {
         related.push({ label: "write", at, endLine: at.end_line });
     }
+    if (found.details.name_literal !== undefined) {
+        const at = found.details.name_literal;
+        related.push({ label: "name", at, endLine: at.end_line });
+    }
     for (const one of found.component.members ?? []) {
         if (declarationKey(one.ref, one.position.path) !==
             declarationKey(found.symbol.ref, found.position.path)) {

package/dist/src/roots.js

@@ -268,7 +268,6 @@ export function roots(project, held, targetRoot, options) {
         return site || compare(a.kind, b.kind) || compare(a.source, b.source);
     });
     return {
-        configFile: project.configFile,
         liveUnderReachability: ordered,
         unmatched,
         unanswered: answered ? api.guessed : held.symbols.map((symbol) => symbol.id),

package/dist/src/run.js

@@ -1,6 +1,5 @@
 import { ConfigError, REPOSITORY_DOCUMENT } from "./config.js";
 import { DiscoveryError, renderDiagnostic } from "./discover.js";
-import { EMITTERS } from "./findings/emitters.js";
 import { joinPath, resolvePath } from "./paths.js";
 import { readScope, ScopeError, scopeForDir } from "./scope.js";
 import { SetupError, setupLine } from "./setup-failure.js";
@@ -201,7 +200,6 @@ function invoke(verb, own, args, streams, openClient) {
                 });
                 return opened;
             },
-            emitters: EMITTERS,
         });
     }
     catch (error) {

package/dist/src/schema.js

@@ -216,7 +216,7 @@ export function malformed(label, path, detail) {
  * A refusal of a key the closed key list does not declare, naming the nearest key
  * it does.
  */
-export function unimplementedKey(label, path) {
+function unimplementedKey(label, path) {
     const nearest = nearestKey(path);
     let hint = "";
     if (nearest === path) {

package/dist/src/scope.js

@@ -2,8 +2,8 @@ import { ConfigError } from "./config.js";
 import { dirnamePath, isAbsolutePath, joinPath, resolvePath } from "./paths.js";
 import { checkDocument } from "./schema.js";
 /** The roles a scope document declares for a module. */
-export const ROLE_TARGET = "target";
-export const ROLE_CONSUMER = "consumer";
+const ROLE_TARGET = "target";
+const ROLE_CONSUMER = "consumer";
 /**
  * A scope document above this length is refused rather than decoded. It names one
  * target and its consumers, so a larger file is not one.

package/dist/src/serialization-contract.js

@@ -1,12 +1,10 @@
 /**
- * The serialization-contract class: the data members and `toJSON` of every class,
- * interface and object type a value's static type names, and of every such type its
- * data members' types reach, where the value reaches `JSON.stringify` or a call
- * `ts.serializers` names, and those and `toString` where it is passed to an `unknown`
- * or `any` parameter of a function outside the analysis. A function of the project
- * handing such a parameter of its own to a destination is one, holding back what that
- * destination does, to a fixpoint. A function invoked through `Function.prototype.call`,
- * `apply` or `bind` is the callee, given the arguments those methods pass it.
+ * The serialization-contract class: the data members and `toJSON` of every type a value's
+ * static type reaches, where the value reaches `JSON.stringify` or a call `ts.serializers`
+ * names, and `toString` too where it reaches an `unknown` or `any` parameter of a function
+ * outside the analysis or an erased property of a type the program does not declare. A
+ * function of the project handing such a parameter to a destination is one, to a fixpoint,
+ * and a function invoked through `call`, `apply` or `bind` is the callee.
  */
 import { isArrayLiteralExpression, isArrowFunction, isCallExpression, isClassDeclaration, isClassExpression, isClassStaticBlockDeclaration, isFunctionDeclaration, isFunctionExpression, isGetAccessorDeclaration, isIdentifier, isMethodDeclaration, isNoSubstitutionTemplateLiteral, isNumericLiteral, isObjectLiteralExpression, isParenthesizedExpression, isPropertyAccessExpression, isSetAccessorDeclaration, isSpreadElement, isStringLiteral, isVariableDeclaration, ModifierFlags, SyntaxKind, } from "@typescript/native/unstable/ast";
 import { SignatureKind, SymbolFlags, TypeFlags, } from "@typescript/native/unstable/sync";
@@ -17,6 +15,7 @@ import { names, namesADeclaration, resolveEntries, spelledEntry, } from "./confi
 import { nodeKey } from "./inventory.js";
 import { renderPosition } from "./position.js";
 import { must } from "./query.js";
+import { erasedStores } from "./erased-stores.js";
 import { valueReach } from "./value-reach.js";
 /** The serializer every run reads, whatever the configuration names. */
 const JSON_STRINGIFY = { shape: "global", global: "JSON.stringify" };
@@ -351,9 +350,13 @@ function destinations(input, chains, walked) {
     };
     return { invocation, at, mayReceive };
 }
+/** What two reaches carry together. */
+function joined(a, b) {
+    return { classes: new Set([...a.classes, ...b.classes]), members: [...a.members, ...b.members] };
+}
 /** Each argument of a call that can receive one whose value carries a class of the target. */
-function flowsOf(project, held, sites, to) {
-    const reach = valueReach(project, held);
+function flowsOf(project, held, sites, to, stores) {
+    const reach = valueReach(project, held, stores.inside);
     const arguments_ = sites.flatMap((site) => to.mayReceive(site.call)
         ? to.invocation(site.call).arguments.flatMap((argument, index) => {
             const value = evaluated(argument);
@@ -363,7 +366,7 @@ function flowsOf(project, held, sites, to) {
     const asked = arguments_.filter((one) => one.value.kind !== SyntaxKind.ThisKeyword);
     const types = typesAt(project, asked.map((one) => one.value));
     const typeOf = new Map(asked.map((one, index) => [one.value, types[index]]));
-    return arguments_.flatMap((one) => {
+    const passed = arguments_.flatMap((one) => {
         const type = typeOf.get(one.value);
         let reached = { classes: new Set(), members: [] };
         if (one.value.kind === SyntaxKind.ThisKeyword) {
@@ -375,12 +378,38 @@ function flowsOf(project, held, sites, to) {
         else if (type !== undefined) {
             reached = reach.reachedFrom(type);
         }
+        for (const stored of stores.ofVariable(one.value) ?? []) {
+            reached = joined(reached, reach.reachedFrom(stored));
+        }
         const carries = reached.classes.size > 0 || reached.members.length > 0;
         const destination = carries ? to.at(one.site.call, one.argument) : undefined;
         return destination === undefined
             ? []
-            : [{ site: one.value, classes: reached.classes, members: reached.members, to: destination }];
+            : [
+                {
+                    site: one.value,
+                    classes: reached.classes,
+                    members: reached.members,
+                    to: destination,
+                    detail: `passed to ${destination.callee}`,
+                },
+            ];
+    });
+    const left = stores.outside.flatMap((store) => {
+        const reached = reach.reachedFrom(store.type);
+        return reached.classes.size === 0 && reached.members.length === 0
+            ? []
+            : [
+                {
+                    site: store.value,
+                    classes: reached.classes,
+                    members: reached.members,
+                    to: { reach: "conversions", callee: store.property },
+                    detail: `stored in the property ${store.property} of a type the program does not declare`,
+                },
+            ];
     });
+    return [...passed, ...left];
 }
 /**
  * The serialization-contract detector: each data member and `toJSON` of each class,
@@ -392,7 +421,7 @@ export function serializationContract(input) {
     const { project, held, targetRoot } = input;
     const walked = walkProject(project, held);
     const chains = aliasChains(project, held);
-    const flows = flowsOf(project, held, walked.sites, destinations(input, chains, walked));
+    const flows = flowsOf(project, held, walked.sites, destinations(input, chains, walked), erasedStores(project));
     if (flows.length === 0) {
         return [];
     }
@@ -406,7 +435,7 @@ export function serializationContract(input) {
     const found = [];
     for (const flow of flows) {
         const site = renderPosition(flow.site.getSourceFile(), targetRoot, flow.site.getStart());
-        const detail = `passed to ${flow.to.callee}`;
+        const { detail } = flow;
         for (const member of [...flow.classes].flatMap((id) => members.get(id) ?? [])) {
             const symbol = byId.get(member.id);
             const name = symbol === undefined ? "" : (memberComponent(symbol, byId) ?? "");

package/dist/src/session.js

@@ -190,7 +190,6 @@ export function ownedAs(project, own) {
 /** The three diagnostic sets one project carries, read before any analysis. */
 export function diagnosticsOf(project) {
     return {
-        configFile: project.configFile,
         syntactic: project.program.getSyntacticDiagnostics(),
         semantic: project.program.getSemanticDiagnostics(),
         configParsing: project.program.getConfigFileParsingDiagnostics(),
@@ -228,12 +227,12 @@ function projectsOf(snapshot, built, written) {
 /**
  * Runs `visit` over every project the compiler configurations name, inside one never updated
  * snapshot of one client, and answers in their order. A configuration `programs` describes is
- * built as that program, or opened from the configuration it writes, instead of as a project.
- * One the snapshot holds nothing for ends the run under `"refuse"` and is named in the result
- * under `"record"`. `last` runs after the last visit while the client still answers; the
- * snapshot is disposed and the client released after it, whether the visit completed or threw.
+ * built as that program, or opened from the configuration it writes. One the snapshot holds
+ * nothing for ends the run under `"refuse"` and is named in the result under `"record"`.
+ * `first` runs over every opened project before the first visit and `last` after the last,
+ * both while the client answers; the snapshot and the client are then released.
  */
-export function runSession(engine, configFiles, visit, unopened = "refuse", programs = new Map(), last = () => undefined) {
+export function runSession(engine, configFiles, visit, unopened = "refuse", programs = new Map(), last = () => undefined, first = () => undefined) {
     try {
         const built = [];
         const params = [];
@@ -254,7 +253,7 @@ export function runSession(engine, configFiles, visit, unopened = "refuse", prog
         try {
             const opened = projectsOf(snapshot, built, written);
             const log = new UnansweredLog();
-            const projects = [];
+            const views = [];
             const missing = [];
             for (const configFile of configFiles) {
                 const project = opened.get(configFile);
@@ -265,8 +264,13 @@ export function runSession(engine, configFiles, visit, unopened = "refuse", prog
                     missing.push(configFile);
                     continue;
                 }
-                projects.push(visit(viewOf(project, configFile, engine, log)));
+                views.push(viewOf(project, configFile, engine, log));
             }
+            first(views.map((view) => ({
+                configFile: view.configFile,
+                fileNames: () => view.ownSourceFiles().map((file) => file.fileName),
+            })));
+            const projects = views.map((view) => visit(view));
             last();
             return {
                 projects,

package/dist/src/suppress-file.js

@@ -27,6 +27,12 @@ const BASELINE_SHAPE = {
     documentWant: "an object carrying the baseline array, and an optional description",
     recordWant: "a row naming code, symbol, path and reason, each a string",
 };
+/**
+ * The reference scheme of this analyzer's language. A record of the other scheme is
+ * form-checked and then left to the analyzer of its language: it binds nothing here, counts
+ * in neither total and is reported under no code.
+ */
+const OWN_SCHEME = "ts://";
 /** The closed key list of one entry or row. */
 const RECORD_KEYS = new Set(["code", "symbol", "path", "reason"]);
 const CODE_WANT = "DS followed by four digits";
@@ -80,6 +86,9 @@ function readRecord(value, site, byReference, shape) {
     if (path !== undefined && path !== "" && !isEntryPath(path)) {
         return refuse(JSON.stringify(path), PATH_WANT);
     }
+    if (!symbol.startsWith(OWN_SCHEME)) {
+        return { records: [], refusals: [] };
+    }
     const written = {
         code,
         symbol,
@@ -196,12 +205,55 @@ export function rowReason(provenance) {
     return `recorded by ${provenance.analyzer} ${provenance.version}`;
 }
 /**
- * A baseline holding one row per finding, in the order given, which is the report's. Every
- * row carries the provenance as its reason. A finding missing a value a row needs, and an
- * identity missing its name or version, are refused rather than written, because the
- * grammar requires a reason on every row.
+ * The rows of the other language's scheme that the baseline document `text` holds, in
+ * document order and as written, which a write keeps. A document that is not a baseline,
+ * or a row in a shape no record takes, is refused rather than dropped.
+ */
+export function otherSchemeRows(text) {
+    const refuse = (detail) => {
+        throw new Error(`${BASELINE_FILE} cannot be rewritten keeping the other language's rows: ${detail}`);
+    };
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        return refuse(error instanceof Error ? error.message : String(error));
+    }
+    const held = isObject(parsed) ? parsed[BASELINE_SHAPE.array] : undefined;
+    if (!Array.isArray(held)) {
+        return refuse(BASELINE_SHAPE.documentWant);
+    }
+    return held.flatMap((value) => {
+        try {
+            readRecord(value, documentSite(BASELINE_SHAPE), new Map(), BASELINE_SHAPE);
+        }
+        catch (error) {
+            return refuse(error instanceof Error ? error.message : String(error));
+        }
+        // readRecord has checked every member is a string and the code and symbol are present.
+        const { code, symbol, path, reason } = value;
+        if (code === undefined || symbol === undefined || symbol.startsWith(OWN_SCHEME)) {
+            return [];
+        }
+        return [
+            {
+                code,
+                symbol,
+                ...(path === undefined ? {} : { path }),
+                ...(reason === undefined ? {} : { reason }),
+            },
+        ];
+    });
+}
+/**
+ * A baseline holding one row per finding, in the order given, which is the report's, after
+ * the other language's rows `kept`, so two analyzers writing one document in either order
+ * write the same bytes. Every recorded row carries the provenance as its reason. A finding
+ * missing a value a row needs, and an identity missing its name or version, are refused
+ * rather than written, because the grammar requires a reason on every row.
  */
-export function writeBaseline(findings, provenance) {
+export function writeBaseline(findings, provenance, kept = []) {
     if (provenance.analyzer === "" || provenance.version === "") {
         throw new Error(`a baseline row would carry no reason: the analyzer identity names ${JSON.stringify(provenance.analyzer)} at version ${JSON.stringify(provenance.version)}`);
     }
@@ -212,5 +264,5 @@ export function writeBaseline(findings, provenance) {
         }
         return { code: found.code, symbol: found.symbol, path: found.path, reason };
     });
-    return jsonChunks({ description: BASELINE_DESCRIPTION, baseline }, 2);
+    return jsonChunks({ description: BASELINE_DESCRIPTION, baseline: [...kept, ...baseline] }, 2);
 }

package/dist/src/suppress-inline.js

@@ -1,7 +1,7 @@
 /**
  * The inline directive: `deadset:ignore`, the first token of a `//` line comment, naming
  * one or more codes and a reason, and binding to every declaration that begins on the line
- * below it.
+ * below it, or on its own line where it trails a token there.
  */
 import { SyntaxKind } from "@typescript/native/unstable/ast";
 import { nodeKey } from "./inventory.js";
@@ -95,7 +95,7 @@ export function tokenStart(text, from) {
  * syntax tree holds are skipped, so a `//` inside a string, a template or a regular
  * expression starts nothing.
  */
-export function lineComments(file) {
+function lineComments(file) {
     const text = file.text;
     const spans = [];
     const visit = (node) => {
@@ -170,6 +170,14 @@ function declarationLines(file, held, symbols) {
     file.forEachChild(visit);
     return below;
 }
+/**
+ * Whether the comment at `offset` follows a token on its own line, so it binds the
+ * declarations that begin on that line rather than on the next.
+ */
+function trails(file, offset) {
+    const { line } = file.getLineAndCharacterOfPosition(offset);
+    return tokenStart(file.text, file.getPositionOfLineAndCharacter(line, 0)) < offset;
+}
 /**
  * Every comment in the namespace one project's own files hold, each with the declarations
  * it binds, read while the project's view is open.
@@ -187,19 +195,20 @@ export function inlineDirectives(project, held, targetRoot) {
         const below = declarationLines(file, held, symbols);
         for (const comment of comments) {
             const site = renderPosition(file, targetRoot, comment.offset);
+            const target = trails(file, comment.offset) ? site.line : site.line + 1;
             found.push({
                 site,
                 text: comment.text,
                 directive: classifyComment(comment.text),
-                bound: [...(below.get(site.line + 1) ?? [])],
+                bound: [...(below.get(target) ?? [])],
             });
         }
     }
     return found;
 }
 /**
- * The inline directives of a run's projects, each bound to the declarations that begin on
- * the line below it, one directive binding the union of what each project holding its file
+ * The inline directives of a run's projects, each bound to the declarations the placement
+ * rule gives it, one directive binding the union of what each project holding its file
  * declares there. A directive that lacks only its reason is one {@link Refusal} per code;
  * any other malformed comment in the namespace ends the read with a
  * {@link SuppressionError} naming the first one written.

package/dist/src/suppress.js

@@ -2,8 +2,9 @@
  * The suppression grammar's records, and the ledger that decides what each one did. A
  * record is one code bound to one site with its reason, from an inline directive, an
  * ignore entry or a baseline row. A bound record marks its declaration live before the
- * sweep, and is in effect when it withholds the finding its code would have produced
- * there, dormant when the configuration withholds that finding anyway, and stale otherwise.
+ * sweep, unless its code reports a part or a dependency row, and is in effect when it
+ * withholds a finding its code would have produced there, dormant when the configuration
+ * withholds every such finding anyway, and stale otherwise.
  */
 import { ConfigError } from "./config.js";
 import { positionKey } from "./position.js";
@@ -14,8 +15,6 @@ export const SUPPRESSION_WITHOUT_REASON = "DS1701";
 export const UNSCOPED_ENTRY = "DS1702";
 /** The code a suppression that withholds nothing is reported under. */
 export const STALE_SUPPRESSION = "DS1703";
-/** A target that carries no suppression. */
-export const NO_SUPPRESSIONS = { records: [], refusals: [] };
 /**
  * A directive, an entry or a document the grammar refuses before any finding exists: an
  * instruction the analysis cannot carry out. It is a malformed input, so the command line
@@ -71,22 +70,47 @@ export function blankReason(reason) {
     return reason === undefined || /^[ \t\r\n]*$/u.test(reason);
 }
 /**
- * The subject kinds that are a row of a document rather than a declaration of the program.
- * A record binds to a declaration, so nothing withholds a finding about one.
+ * The subject kinds that are a dependency row, each with the code that reports one. An
+ * ignore entry or a baseline row naming the row's reference and file withholds its finding
+ * and marks nothing, and an inline directive never binds one.
  */
-const ROW_SUBJECTS = new Set([
-    "file",
-    "dependency",
-    "module-directive",
-    "root",
-    "configured-declaration",
-    "suppression",
-    "edge",
+const DEPENDENCY_SUBJECTS = new Map([
+    ["dependency", ["DS1601"]],
+    ["module-directive", ["DS1605"]],
 ]);
-/** Whether a finding's subject is a row of a document, which no record can withhold. */
+/**
+ * The subject kinds that are a row of a document rather than a declaration of the program,
+ * each with the codes that report one. Apart from a dependency row, nothing withholds a
+ * finding about one.
+ */
+const ROW_SUBJECTS = new Map([
+    ["file", ["DS1501", "DS1502"]],
+    ...DEPENDENCY_SUBJECTS,
+    ["root", ["DS1704"]],
+    ["configured-declaration", ["DS1706"]],
+    ["suppression", ["DS1701", "DS1702", "DS1703"]],
+    ["edge", ["DS1705"]],
+]);
+/** Whether a finding's subject is a row of a document rather than a declaration. */
 export function isRowSubject(kind) {
     return ROW_SUBJECTS.has(kind);
 }
+/** Whether a code reports a row of a document. */
+export function isRowCode(code) {
+    return [...ROW_SUBJECTS.values()].some((codes) => codes.includes(code));
+}
+/** Whether a finding's subject is a dependency row. */
+export function isDependencySubject(kind) {
+    return DEPENDENCY_SUBJECTS.has(kind);
+}
+/** Whether a code reports a dependency row, which only an ignore entry or a baseline row names. */
+export function isDependencyCode(code) {
+    return [...DEPENDENCY_SUBJECTS.values()].some((codes) => codes.includes(code));
+}
+/** Whether a code reports a row of a document that no record of any mechanism can name. */
+export function isUnsuppressibleCode(code) {
+    return isRowCode(code) && !isDependencyCode(code);
+}
 /**
  * The subject kinds that are a part of a declaration rather than a declaration: a part
  * has no reference of its own, so a finding about one names the declaration that holds
@@ -121,10 +145,19 @@ function claimKey(finding) {
  * Whether one record names one finding. A record reaches a finding in two ways: it bound
  * the declaration at the finding's position, or it names the finding's reference and the
  * file the finding is reported in, each exactly. The second is how an entry copied from a
- * finding about a part of a declaration reaches the part.
+ * finding about a part of a declaration reaches the part, and the only way any record
+ * reaches a dependency row.
  */
 export function pairs(record, finding) {
-    if (record.code !== finding.code || ROW_SUBJECTS.has(finding.symbol.kind)) {
+    if (record.code !== finding.code) {
+        return false;
+    }
+    if (DEPENDENCY_SUBJECTS.has(finding.symbol.kind)) {
+        return (record.mechanism !== "inline" &&
+            record.symbol === finding.symbol.ref &&
+            record.path === finding.position.path);
+    }
+    if (ROW_SUBJECTS.has(finding.symbol.kind)) {
         return false;
     }
     if (record.bound !== "" && record.bound === positionKey(finding.position)) {
@@ -134,35 +167,31 @@ export function pairs(record, finding) {
 }
 /**
  * Decides every record against `would`, the findings the run would produce were no record
- * there: swept with no mark, where a kind about liveness reports the marked declaration,
- * and as swept, where a kind whose subject the sweep holds live reports it. The first
- * record in reading order claims a finding, so a second naming it is stale. A record whose
- * code the dials withhold from its declaration, or whose claimed finding they withhold, is
- * dormant.
+ * there: swept with no mark for a liveness kind, and as swept otherwise. The first record
+ * in reading order claims a finding, so a second naming it is stale; a part-kind record
+ * claims every finding of its code about a part of its declaration. A record is dormant
+ * when the dials withhold every finding it claims, read from those findings alone, or when
+ * it claims none and its code's severity is `allow`.
  */
 export function ledgerOf(records, would, dials) {
     const taken = new Set();
     const verdicts = [];
-    const claims = [];
     for (const record of records) {
-        if (record.bound !== "" && dials.withholdsCode(record.code, record.bound)) {
-            verdicts.push("dormant");
-            claims.push(undefined);
+        const open = (finding) => !taken.has(claimKey(finding)) && pairs(record, finding);
+        const first = would.find(open);
+        const claimed = first === undefined ? [] : isPartKind(record.code) ? would.filter(open) : [first];
+        if (claimed.length === 0) {
+            verdicts.push(record.bound !== "" && dials.allows(record.code) ? "dormant" : "stale");
             continue;
         }
-        const claimed = would.find((finding) => !taken.has(claimKey(finding)) && pairs(record, finding));
-        claims.push(claimed);
-        if (claimed === undefined) {
-            verdicts.push("stale");
-            continue;
+        for (const finding of claimed) {
+            taken.add(claimKey(finding));
         }
-        taken.add(claimKey(claimed));
-        verdicts.push(dials.withholds(claimed) ? "dormant" : "in-effect");
+        verdicts.push(claimed.every((finding) => dials.withholds(finding)) ? "dormant" : "in-effect");
     }
     return {
         verdicts,
-        claims,
-        withheld: (finding) => taken.has(claimKey(finding)) && !ROW_SUBJECTS.has(finding.symbol.kind),
+        withheld: (finding) => taken.has(claimKey(finding)),
     };
 }
 /** The suppression counts of one run's records and the ledger over them. */