@cplieger/deadset-ts 7.0.0-dev.2 → 7.0.0-dev.3

package/src/erased-stores.ts

@@ -0,0 +1,413 @@
+/**
+ * The values the program stores in a slot of a container: a property, an index signature,
+ * an array element, and a variable. A serializer walking the container emits the value the
+ * slot holds, so it walks each stored value at its own static type, a subtype stored where
+ * the slot's type names a supertype, `object`, `unknown` or `any` included. A container is
+ * identified by the checker's type identity, so two containers of one type share what
+ * either stores. A store into an erased property of a type the analyzed program does not
+ * declare hands the value to the code that declares the type.
+ */
+
+import {
+  isArrayLiteralExpression,
+  isBinaryExpression,
+  isCallExpression,
+  isElementAccessExpression,
+  isIdentifier,
+  isNoSubstitutionTemplateLiteral,
+  isNumericLiteral,
+  isObjectLiteralExpression,
+  isParenthesizedExpression,
+  isPropertyAccessExpression,
+  isPropertyAssignment,
+  isShorthandPropertyAssignment,
+  isSpreadElement,
+  isStringLiteral,
+  isVariableDeclaration,
+  SyntaxKind,
+  type Expression,
+  type Node,
+} from "@typescript/native/unstable/ast";
+import { SymbolFlags, TypeFlags, type Type } from "@typescript/native/unstable/sync";
+import { must } from "./query.ts";
+import type { ProjectView } from "./session.ts";
+
+/** The types that keep nothing of the value they are given. */
+const ERASED = TypeFlags.Any | TypeFlags.Unknown;
+
+/** The array methods whose arguments become elements of the array they are called on. */
+const ELEMENT_STORES: ReadonlySet<string> = new Set(["push", "unshift"]);
+
+/** One step into a value: a property's name, or an element's place. */
+type Step = string | number;
+
+/**
+ * What a store puts in its slot: the value of `value`, or, where a destructuring pattern
+ * takes it apart, the part of it `path` names.
+ */
+interface Stored {
+  readonly value: Expression;
+  readonly path: readonly Step[];
+}
+
+/** One store into a slot of a container: the property it names, or none for an element or an index. */
+interface Store extends Stored {
+  /** The expression whose type is the container, or the literal whose contextual type is. */
+  readonly container: Expression;
+  readonly contextual: boolean;
+  readonly name: string | undefined;
+}
+
+/** A store into an erased property of a type no file of the project declares. */
+interface OutsideStore {
+  readonly value: Expression;
+  readonly type: Type;
+  readonly property: string;
+}
+
+/** What the program stores where a type erases it. */
+export interface ErasedStores {
+  /** The static types of the values stored in a slot of a value of one type. */
+  readonly inside: (type: Type) => readonly Type[];
+  /** The static types stored in the variable one identifier names, if it names one the program stores into. */
+  readonly ofVariable: (node: Node) => readonly Type[] | undefined;
+  readonly outside: readonly OutsideStore[];
+}
+
+/** The name an element access's literal index spells, or none. */
+function literalKey(node: Expression): string | undefined {
+  return isStringLiteral(node) || isNoSubstitutionTemplateLiteral(node) || isNumericLiteral(node)
+    ? node.text
+    : undefined;
+}
+
+function unwrapped(node: Expression): Expression {
+  return isParenthesizedExpression(node) ? unwrapped(node.expression) : node;
+}
+
+/**
+ * Whether a variable declaration's type can differ from what is stored in it: it carries an
+ * annotation, or it has neither an annotation nor an initializer, so its type evolves.
+ */
+function declaresSlot(node: Node): boolean {
+  const held = node as { readonly type?: Node; readonly initializer?: Node };
+  return held.type !== undefined || held.initializer === undefined;
+}
+
+/** One target a destructuring assignment writes, and what it receives. */
+interface Target extends Stored {
+  readonly target: Expression;
+}
+
+/** The element of an array literal at one place, where no spread before it moves the places. */
+function elementAt(source: Expression, at: number): Expression | undefined {
+  if (!isArrayLiteralExpression(source)) {
+    return undefined;
+  }
+  const before = source.elements.slice(0, at + 1);
+  return before.some((one) => isSpreadElement(one)) ? undefined : source.elements[at];
+}
+
+/** The name a property spells, and none for a computed one. */
+function propertyName(name: Node): string | undefined {
+  return isIdentifier(name) || isStringLiteral(name) || isNumericLiteral(name)
+    ? name.text
+    : undefined;
+}
+
+/** The name one property of an object literal spells and the expression it holds, or none. */
+function propertyParts(
+  property: Node,
+): { readonly name: string; readonly value: Expression } | undefined {
+  if (isPropertyAssignment(property)) {
+    const name = propertyName(property.name);
+    return name === undefined ? undefined : { name, value: property.initializer };
+  }
+  if (isShorthandPropertyAssignment(property) && isIdentifier(property.name)) {
+    return { name: property.name.text, value: property.name };
+  }
+  return undefined;
+}
+
+/** The value an object literal gives one property, where it gives it by a plain or a shorthand property. */
+function propertyAt(source: Expression, name: string): Expression | undefined {
+  if (!isObjectLiteralExpression(source)) {
+    return undefined;
+  }
+  for (const property of source.properties) {
+    const parts = propertyParts(property);
+    if (parts?.name === name) {
+      return parts.value;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Every target one destructuring pattern writes at any depth, each with the expression
+ * whose value it receives: the matching element or property of a literal on the right,
+ * else the right side with the path into it. A rest element copies, so it is no target
+ * here, and a default value is stored in its target too.
+ */
+function patternTargets(pattern: Expression, from: Stored, out: Target[]): void {
+  const target = unwrapped(pattern);
+  const source = from.path.length === 0 ? unwrapped(from.value) : from.value;
+  const into = (element: Expression, step: Step, literal: Expression | undefined): void => {
+    patternTargets(
+      element,
+      literal === undefined
+        ? { value: from.value, path: [...from.path, step] }
+        : { value: literal, path: [] },
+      out,
+    );
+  };
+  if (isArrayLiteralExpression(target)) {
+    target.elements.forEach((element, at) => {
+      if (!isSpreadElement(element) && element.kind !== SyntaxKind.OmittedExpression) {
+        into(element, at, from.path.length === 0 ? elementAt(source, at) : undefined);
+      }
+    });
+    return;
+  }
+  if (isObjectLiteralExpression(target)) {
+    for (const property of target.properties) {
+      const parts = propertyParts(property);
+      if (parts !== undefined) {
+        into(
+          parts.value,
+          parts.name,
+          from.path.length === 0 ? propertyAt(source, parts.name) : undefined,
+        );
+      }
+      if (
+        parts !== undefined &&
+        isShorthandPropertyAssignment(property) &&
+        property.objectAssignmentInitializer !== undefined
+      ) {
+        out.push({ target: parts.value, value: property.objectAssignmentInitializer, path: [] });
+      }
+    }
+    return;
+  }
+  if (isBinaryExpression(target) && target.operatorToken.kind === SyntaxKind.EqualsToken) {
+    patternTargets(target.left, from, out);
+    out.push({ target: target.left, value: target.right, path: [] });
+    return;
+  }
+  out.push({ target, ...from });
+}
+
+/** Every store one project's own files write, and the stores into variables declared erased. */
+export function erasedStores<Brand>(project: ProjectView<Brand>): ErasedStores {
+  const queries = project.queries;
+  const own = project.ownPaths();
+  const stores: Store[] = [];
+  const assigned: (Stored & { readonly target: Node })[] = [];
+  const slotVariables: Node[] = [];
+  for (const file of project.ownSourceFiles()) {
+    const visit = (node: Node): void => {
+      if (isObjectLiteralExpression(node)) {
+        for (const property of node.properties) {
+          if (isShorthandPropertyAssignment(property) && isIdentifier(property.name)) {
+            const { name } = property;
+            stores.push({
+              container: node,
+              contextual: true,
+              name: name.text,
+              value: name,
+              path: [],
+            });
+          } else if (
+            isPropertyAssignment(property) &&
+            (isIdentifier(property.name) || isStringLiteral(property.name))
+          ) {
+            const value = property.initializer;
+            stores.push({
+              container: node,
+              contextual: true,
+              name: property.name.text,
+              value,
+              path: [],
+            });
+          }
+        }
+      } else if (isArrayLiteralExpression(node)) {
+        for (const element of node.elements) {
+          if (!isSpreadElement(element)) {
+            stores.push({
+              container: node,
+              contextual: true,
+              name: undefined,
+              value: element,
+              path: [],
+            });
+          }
+        }
+      } else if (isBinaryExpression(node) && node.operatorToken.kind === SyntaxKind.EqualsToken) {
+        const targets: Target[] = [];
+        patternTargets(node.left, { value: node.right, path: [] }, targets);
+        for (const { target, value, path } of targets) {
+          if (isPropertyAccessExpression(target)) {
+            stores.push({
+              container: target.expression,
+              contextual: false,
+              name: target.name.text,
+              value,
+              path,
+            });
+          } else if (isElementAccessExpression(target)) {
+            stores.push({
+              container: target.expression,
+              contextual: false,
+              name: literalKey(target.argumentExpression),
+              value,
+              path,
+            });
+          } else if (isIdentifier(target)) {
+            assigned.push({ target, value, path });
+          }
+        }
+      } else if (
+        isCallExpression(node) &&
+        isPropertyAccessExpression(node.expression) &&
+        ELEMENT_STORES.has(node.expression.name.text)
+      ) {
+        for (const argument of node.arguments) {
+          stores.push({
+            container: node.expression.expression,
+            contextual: false,
+            name: undefined,
+            value: argument,
+            path: [],
+          });
+        }
+      } else if (isVariableDeclaration(node) && declaresSlot(node)) {
+        slotVariables.push(node);
+        if (node.initializer !== undefined) {
+          assigned.push({ target: node, value: node.initializer, path: [] });
+        }
+      }
+      node.forEachChild(visit);
+    };
+    file.forEachChild(visit);
+  }
+
+  const contextual = stores.filter((one) => one.contextual);
+  const contexts = queries.contextualTypes(contextual.map((one) => one.container)).map(must);
+  const containerOf = new Map<Store, Type | undefined>(
+    contextual.map((one, at) => [one, contexts[at]]),
+  );
+  const typed = stores.filter((one) => !one.contextual);
+  queries
+    .typesAt(typed.map((one) => one.container))
+    .map(must)
+    .forEach((type, at) => {
+      const one = typed[at];
+      if (one !== undefined) {
+        containerOf.set(one, type);
+      }
+    });
+
+  const slotTypes = new Map<string, Type | undefined>();
+  /** The type a slot of one object type holds: a property's, else the string index's, else an element's. */
+  const slotOf = (type: Type, name: string | undefined): Type | undefined => {
+    const key = `${String(type.id)}\u0000${name ?? ""}`;
+    if (slotTypes.has(key)) {
+      return slotTypes.get(key);
+    }
+    let found: Type | undefined;
+    const property =
+      name === undefined
+        ? undefined
+        : must(queries.propertiesOf(type)).find((one) => one.name === name);
+    if (property !== undefined) {
+      found =
+        (property.flags & SymbolFlags.Property) !== 0
+          ? must(queries.typeOfSymbol(property))
+          : undefined;
+    } else if (type.isTypeReference() && must(queries.isArray(type))) {
+      found = must(queries.typeArguments(type))[0];
+    } else {
+      found = must(queries.indexInfosOf(type))[0]?.valueType;
+    }
+    slotTypes.set(key, found);
+    return found;
+  };
+  const declaredOutside = (type: Type): boolean => {
+    const symbol = must(queries.symbolOfType(type));
+    return (
+      symbol !== undefined &&
+      symbol.declarations.length > 0 &&
+      symbol.declarations.every((handle) => !own.has(handle.path))
+    );
+  };
+
+  /** The type of the part of a stored value its path names, a step at a time. */
+  const partOf = (type: Type | undefined, path: readonly Step[]): Type | undefined =>
+    path.reduce<Type | undefined>(
+      (at, step) => (at === undefined ? undefined : slotOf(at, String(step))),
+      type,
+    );
+  const valueTypes = queries
+    .typesAt(stores.map((one) => one.value))
+    .map((type, at) => partOf(must(type), stores[at]?.path ?? []));
+  const inside = new Map<number, Type[]>();
+  const outside: OutsideStore[] = [];
+  stores.forEach((store, at) => {
+    const container = containerOf.get(store);
+    const value = valueTypes[at];
+    if (container === undefined || value === undefined) {
+      return;
+    }
+    const parts =
+      container.isUnionType() || container.isIntersectionType()
+        ? must(queries.constituents(container))
+        : [container];
+    for (const part of parts) {
+      if (!part.isObjectType()) {
+        continue;
+      }
+      const { name } = store;
+      const erased = name !== undefined && ((slotOf(part, name)?.flags ?? 0) & ERASED) !== 0;
+      if (erased && declaredOutside(part)) {
+        outside.push({ value: store.value, type: value, property: name });
+      } else {
+        inside.set(part.id, [...(inside.get(part.id) ?? []), value]);
+      }
+    }
+  });
+
+  const targets = assigned.map((one) =>
+    isVariableDeclaration(one.target) ? one.target.name : one.target,
+  );
+  const symbols = queries.symbolsAt(targets).map(must);
+  const slots = new Set(slotVariables);
+  const declarationOf = (symbol: (typeof symbols)[number]): Node | undefined => {
+    const handle = symbol?.valueDeclaration ?? symbol?.declarations[0];
+    return handle === undefined ? undefined : project.declarationAt(handle)?.node;
+  };
+  const assignedTypes = queries
+    .typesAt(assigned.map((one) => one.value))
+    .map((type, at) => partOf(must(type), assigned[at]?.path ?? []));
+  const byVariable = new Map<Node, Type[]>();
+  assigned.forEach((_one, at) => {
+    const declaration = declarationOf(symbols[at]);
+    const type = assignedTypes[at];
+    if (declaration !== undefined && slots.has(declaration) && type !== undefined) {
+      byVariable.set(declaration, [...(byVariable.get(declaration) ?? []), type]);
+    }
+  });
+
+  return {
+    inside: (type) => inside.get(type.id) ?? [],
+    ofVariable: (node) => {
+      if (byVariable.size === 0 || !isIdentifier(node)) {
+        return undefined;
+      }
+      const [symbol] = queries.symbolsAt([node]).map(must);
+      const declaration = declarationOf(symbol);
+      return declaration === undefined ? undefined : byVariable.get(declaration);
+    },
+    outside,
+  };
+}

package/src/file-facts.ts

@@ -49,6 +49,8 @@ export interface FileFacts {
   readonly heldByInclusion: ReadonlySet<string>;
   /** The paths below the target root of the generated files. */
   readonly generated?: ReadonlySet<string>;
+  /** The property names an `in` expression of a production file tests by a literal. */
+  readonly inOperands?: ReadonlySet<string>;
 }
 
 /** The line of the last character of one text, counted from one; an empty text is one line. */

package/src/findings/completion.ts

@@ -9,6 +9,7 @@ import { componentId, type Component } from "../components.ts";
 import type { Cascade, Confidence, Severity } from "../config.ts";
 import type { CompletedFinding, Finding, FindingComponent, PositionedSymbol } from "../finding.ts";
 import { OUTSIDE, type Graph } from "../graph.ts";
+import type { SymbolKind } from "../inventory.ts";
 import { KINDS, type KindRow } from "../kinds.ts";
 import { byPosition, positionKey } from "../position.ts";
 import { declarationKey } from "../ref.ts";
@@ -17,6 +18,17 @@ import { isPartSubject, isRowSubject, type Dials } from "../suppress.ts";
 import type { Boundary } from "./boundary.ts";
 import type { EmitterInput } from "./emitter.ts";
 
+/** The fixability grammar/analysis.md "Fixability" gives a finding about a held declaration. */
+const MANUAL = "manual";
+
+/** The member kinds an object property can declare, which an `in` expression tests by name. */
+const IN_TESTED: ReadonlySet<SymbolKind> = new Set([
+  "class-member",
+  "method",
+  "type-member",
+  "interface-method",
+]);
+
 /** The classes ranked by the claim each makes, the strongest highest. */
 const RANK: Readonly<Record<Confidence, number>> = { certain: 3, probable: 2, possible: 1 };
 
@@ -54,19 +66,43 @@ function publishedIds(union: Graph): ReadonlySet<string> {
   );
 }
 
+/**
+ * The members whose name an `in` expression of a production file tests by a literal: a
+ * value narrowed that way is read back by the name, which no type links to the member.
+ */
+function testedByIn(input: EmitterInput): ReadonlySet<string> {
+  const names = input.files.inOperands ?? new Set<string>();
+  const union = input.swept.matrix.union;
+  if (names.size === 0) {
+    return names;
+  }
+  return new Set(
+    union.symbols.flatMap((symbol, at) => {
+      const parent = union.symbols[union.parent[at] ?? OUTSIDE];
+      return IN_TESTED.has(symbol.kind) &&
+        parent !== undefined &&
+        symbol.name.startsWith(`${parent.name}.`) &&
+        names.has(symbol.name.slice(parent.name.length + 1))
+        ? [symbol.id]
+        : [];
+    }),
+  );
+}
+
 /**
  * The reachability class of one declaration of the run. A declaration of a library's
  * published API, a public member of a published type included, is `certain` where the
  * run loaded every consumer the scope declared and declared one, `probable` where one did
  * not load, and `possible` where it declared none, whatever the configuration says of the
- * consumer set. A declaration of test-support code that test code references, outside the
- * test-of-dead-code rule, is `possible`. Every other declaration is `certain`.
+ * consumer set. Test-support code test code references, outside the test-of-dead-code
+ * rule, what it contains, and a member an `in` expression tests by name are `possible`.
  */
 function reachabilityClasses(input: EmitterInput): (id: string) => Confidence {
+  const tested = testedByIn(input);
   const published = publishedIds(input.swept.matrix.union);
   const usedByTests = new Set(
     input.swept.sweep.candidates
-      .filter((candidate) => candidate.heldByTests === candidate.id)
+      .filter((candidate) => candidate.heldByTests !== undefined)
       .map((candidate) => candidate.id),
   );
   const { declared } = input.boundary.consumers;
@@ -77,7 +113,7 @@ function reachabilityClasses(input: EmitterInput): (id: string) => Confidence {
         ? "certain"
         : "probable";
   return (id) => {
-    if (usedByTests.has(id)) {
+    if (usedByTests.has(id) || tested.has(id)) {
       return "possible";
     }
     return published.has(id) ? outside : "certain";
@@ -185,6 +221,9 @@ export function completed(
   const classOf = reachabilityClasses(input);
   const ceilingOf = testCeilings(input, classOf);
   const componentOf = findingComponents(swept, input.config.reporters.cascade);
+  const held = new Set(
+    swept.sweep.components.filter((one) => one.held).flatMap((one) => one.members),
+  );
   let minted = swept.sweep.components.length;
   const dead = new Set(swept.sweep.components.map((component) => component.id));
   const fallingWith = new Map<string, number>();
@@ -242,7 +281,14 @@ export function completed(
     const reachabilityClass =
       judged === undefined ? (finding.reachabilityClass ?? "certain") : classOf(judged.id);
     const generated = input.files.generated?.has(finding.position.path) === true;
-    const fixability = generated ? "none" : row.fixability;
+    const fixability = generated
+      ? "none"
+      : found !== undefined &&
+          symbol !== undefined &&
+          held.has(symbol.id) &&
+          row.findingFixabilities?.includes(MANUAL) === true
+        ? MANUAL
+        : row.fixability;
     const lastUses =
       fixability === "deletable" && candidate !== undefined
         ? input.dependencies.lastUses.get(candidate.id)
@@ -319,34 +365,22 @@ function dialed(
  * below the minimum confidence is withheld, and so is every finding of the component of a
  * root the dials withhold, because a symbol that falls with a root is dead only through it
  * and its deletion does not compile while the root stays. A withheld finding that is no
- * root withholds itself alone. A code is withheld from a declaration when the finding it
- * would report there, completed, is withheld by its own severity or confidence.
+ * root withholds itself alone.
  */
 export function dialsOf(
   input: EmitterInput,
   findings: readonly CompletedFinding[],
 ): Dials<CompletedFinding> {
   const minConfidence = input.config.analysis.minConfidence;
-  const classOf = reachabilityClasses(input);
-  const ceilingOf = testCeilings(input, classOf);
   const components = new Set(
     findings
       .filter((finding) => finding.component.root && dialed(finding, minConfidence))
       .map((finding) => finding.component.id),
   );
   return {
-    withholdsCode: (code, id) => {
+    allows: (code) => {
       const row = KINDS.get(code);
-      return (
-        row !== undefined &&
-        dialed(
-          {
-            severity: severityOf(input, code, row.defaultSeverity),
-            confidence: capped(capped(classOf(id), row.maxClass), ceilingOf(id)),
-          },
-          minConfidence,
-        )
-      );
+      return row !== undefined && severityOf(input, code, row.defaultSeverity) === "allow";
     },
     withholds: (finding) => dialed(finding, minConfidence) || components.has(finding.component.id),
   };

package/src/findings/dependencies-and-module-machinery.ts

@@ -19,7 +19,7 @@ function unusedDependencies(dependencies: Dependencies): Finding[] {
   return dependencies.declared
     .filter(
       (dependency) =>
-        !dependencies.needed.has(dependency.name) &&
+        !dependencies.needed.has(declarationKey(dependency)) &&
         !dependencies.ran.has(declarationKey(dependency)),
     )
     .map((dependency) => ({

package/src/findings/emitters.ts

@@ -116,7 +116,7 @@ function dialsOver(
   const before = dialsOf(suppressed.unmarked, unmarked);
   const fromUnmarked = new Set(unmarked);
   return {
-    withholdsCode: marked.withholdsCode,
+    allows: marked.allows,
     withholds: (finding) =>
       fromUnmarked.has(finding) ? before.withholds(finding) : marked.withholds(finding),
   };

package/src/findings/self-check.ts

@@ -4,7 +4,8 @@ import type { InventorySymbol } from "../inventory.ts";
 import { FIXED_SEVERITY_CODES } from "../kinds.ts";
 import type { Position } from "../position.ts";
 import {
-  isRowCode,
+  isDependencyCode,
+  isUnsuppressibleCode,
   STALE_SUPPRESSION,
   SUPPRESSION_WITHOUT_REASON,
   type Mechanism,
@@ -181,16 +182,29 @@ export function staleSuppressions(
     const reports = [...new Set(records.flatMap((one) => one.reports))]
       .filter((code) => !codes.includes(code))
       .sort();
-    const rows = codes.filter(isRowCode);
+    const rows = codes.filter(isUnsuppressibleCode);
+    const dependencies = first.mechanism === "inline" ? codes.filter(isDependencyCode) : [];
     const settable = rows.filter((code) => !FIXED_SEVERITY_CODES.includes(code));
     const remedy =
       settable.length === 0
         ? "fix what the finding names instead"
         : `fix what the finding names or set the severity of ${spelled(settable)} instead`;
     const declared = reports.length === 0 ? "" : `its declaration reports ${spelled(reports)}`;
+    const because = [
+      ...(rows.length > 0
+        ? [
+            `${spelled(rows)} ${rows.length === 1 ? "reports a row" : "report rows"} of a document, which no suppression can name; ${remedy}`,
+          ]
+        : []),
+      ...(dependencies.length > 0
+        ? [
+            `${spelled(dependencies)} ${dependencies.length === 1 ? "reports a dependency row" : "report dependency rows"}, which only an ignore entry or a baseline row can name`,
+          ]
+        : []),
+    ];
     const instead =
-      rows.length > 0
-        ? `, because ${spelled(rows)} ${rows.length === 1 ? "reports a row" : "report rows"} of a document, which no suppression can name; ${remedy}${declared === "" ? "" : `; ${declared}`}`
+      because.length > 0
+        ? `, because ${because.join("; ")}${declared === "" ? "" : `; ${declared}`}`
         : declared === ""
           ? ""
           : `, and ${declared}`;

package/src/findings-pass.ts

@@ -15,7 +15,13 @@ import {
   type StaleRecord,
   type StaleSuppression,
 } from "./findings/self-check.ts";
-import { isRowSubject, pairs, suppressionCounts, type Ledger } from "./suppress.ts";
+import {
+  isDependencySubject,
+  isRowSubject,
+  pairs,
+  suppressionCounts,
+  type Ledger,
+} from "./suppress.ts";
 import type { Provenance, Recorded } from "./suppress-file.ts";
 import { EXIT_CLEAN, EXIT_FINDINGS } from "./verbs/verb.ts";
 
@@ -134,14 +140,15 @@ export interface RecordableFinding {
 
 /**
  * The rows one round of a baseline write records from its findings, in their order. A
- * finding about a row of a document is not recorded: no record withholds one, so a row
- * recording it would be stale on the first read back. Two findings that would record the
- * same row, two parts of one declaration under one code, record it once.
+ * finding about a row of a document other than a dependency row is not recorded: no record
+ * withholds one, so a row recording it would be stale on the first read back. Two findings
+ * that would record the same row, two parts of one declaration under one code, record it
+ * once.
  */
 export function recordedFindings(findings: readonly RecordableFinding[]): readonly Recorded[] {
   const rows = new Map<string, Recorded>();
   for (const finding of findings) {
-    if (isRowSubject(finding.symbol.kind)) {
+    if (isRowSubject(finding.symbol.kind) && !isDependencySubject(finding.symbol.kind)) {
       continue;
     }
     const row = { code: finding.code, symbol: finding.symbol.ref, path: finding.position.path };