@cplieger/deadset-ts 7.0.0-dev.2 → 7.0.0-dev.3

package/src/suppress.ts

@@ -2,8 +2,9 @@
  * The suppression grammar's records, and the ledger that decides what each one did. A
  * record is one code bound to one site with its reason, from an inline directive, an
  * ignore entry or a baseline row. A bound record marks its declaration live before the
- * sweep, and is in effect when it withholds the finding its code would have produced
- * there, dormant when the configuration withholds that finding anyway, and stale otherwise.
+ * sweep, unless its code reports a part or a dependency row, and is in effect when it
+ * withholds a finding its code would have produced there, dormant when the configuration
+ * withholds every such finding anyway, and stale otherwise.
  */
 
 import { ConfigError } from "./config.ts";
@@ -141,8 +142,8 @@ export type Verdict = "in-effect" | "dormant" | "stale";
  * them withholds is dormant.
  */
 export interface Dials<F extends Finding = Finding> {
-  /** Whether the configuration withholds every finding of one code from one declaration. */
-  readonly withholdsCode: (code: string, bound: string) => boolean;
+  /** Whether the configuration sets the severity of one code to `allow`. */
+  readonly allows: (code: string) => boolean;
   /** Whether it withholds one finding: by its severity, its confidence, or its component's root. */
   readonly withholds: (finding: F) => boolean;
 }
@@ -155,31 +156,55 @@ export interface Ledger {
   readonly withheld: (finding: Finding) => boolean;
 }
 
+/**
+ * The subject kinds that are a dependency row, each with the code that reports one. An
+ * ignore entry or a baseline row naming the row's reference and file withholds its finding
+ * and marks nothing, and an inline directive never binds one.
+ */
+const DEPENDENCY_SUBJECTS: ReadonlyMap<string, readonly string[]> = new Map([
+  ["dependency", ["DS1601"]],
+  ["module-directive", ["DS1605"]],
+]);
+
 /**
  * The subject kinds that are a row of a document rather than a declaration of the program,
- * each with the codes that report one. A record binds to a declaration, so nothing
- * withholds a finding about one.
+ * each with the codes that report one. Apart from a dependency row, nothing withholds a
+ * finding about one.
  */
 const ROW_SUBJECTS: ReadonlyMap<string, readonly string[]> = new Map([
   ["file", ["DS1501", "DS1502"]],
-  ["dependency", ["DS1601"]],
-  ["module-directive", ["DS1605"]],
+  ...DEPENDENCY_SUBJECTS,
   ["root", ["DS1704"]],
   ["configured-declaration", ["DS1706"]],
   ["suppression", ["DS1701", "DS1702", "DS1703"]],
   ["edge", ["DS1705"]],
 ]);
 
-/** Whether a finding's subject is a row of a document, which no record can withhold. */
+/** Whether a finding's subject is a row of a document rather than a declaration. */
 export function isRowSubject(kind: string): boolean {
   return ROW_SUBJECTS.has(kind);
 }
 
-/** Whether a code reports a row of a document, so no record naming it can match. */
+/** Whether a code reports a row of a document. */
 export function isRowCode(code: string): boolean {
   return [...ROW_SUBJECTS.values()].some((codes) => codes.includes(code));
 }
 
+/** Whether a finding's subject is a dependency row. */
+export function isDependencySubject(kind: string): boolean {
+  return DEPENDENCY_SUBJECTS.has(kind);
+}
+
+/** Whether a code reports a dependency row, which only an ignore entry or a baseline row names. */
+export function isDependencyCode(code: string): boolean {
+  return [...DEPENDENCY_SUBJECTS.values()].some((codes) => codes.includes(code));
+}
+
+/** Whether a code reports a row of a document that no record of any mechanism can name. */
+export function isUnsuppressibleCode(code: string): boolean {
+  return isRowCode(code) && !isDependencyCode(code);
+}
+
 /**
  * The subject kinds that are a part of a declaration rather than a declaration: a part
  * has no reference of its own, so a finding about one names the declaration that holds
@@ -219,10 +244,21 @@ function claimKey(finding: Finding): string {
  * Whether one record names one finding. A record reaches a finding in two ways: it bound
  * the declaration at the finding's position, or it names the finding's reference and the
  * file the finding is reported in, each exactly. The second is how an entry copied from a
- * finding about a part of a declaration reaches the part.
+ * finding about a part of a declaration reaches the part, and the only way any record
+ * reaches a dependency row.
  */
 export function pairs(record: SuppressionRecord, finding: Finding): boolean {
-  if (record.code !== finding.code || ROW_SUBJECTS.has(finding.symbol.kind)) {
+  if (record.code !== finding.code) {
+    return false;
+  }
+  if (DEPENDENCY_SUBJECTS.has(finding.symbol.kind)) {
+    return (
+      record.mechanism !== "inline" &&
+      record.symbol === finding.symbol.ref &&
+      record.path === finding.position.path
+    );
+  }
+  if (ROW_SUBJECTS.has(finding.symbol.kind)) {
     return false;
   }
   if (record.bound !== "" && record.bound === positionKey(finding.position)) {
@@ -233,11 +269,11 @@ export function pairs(record: SuppressionRecord, finding: Finding): boolean {
 
 /**
  * Decides every record against `would`, the findings the run would produce were no record
- * there: swept with no mark, where a kind about liveness reports the marked declaration,
- * and as swept, where a kind whose subject the sweep holds live reports it. The first
- * record in reading order claims a finding, so a second naming it is stale. A record whose
- * code the dials withhold from its declaration, or whose claimed finding they withhold, is
- * dormant.
+ * there: swept with no mark for a liveness kind, and as swept otherwise. The first record
+ * in reading order claims a finding, so a second naming it is stale; a part-kind record
+ * claims every finding of its code about a part of its declaration. A record is dormant
+ * when the dials withhold every finding it claims, read from those findings alone, or when
+ * it claims none and its code's severity is `allow`.
  */
 export function ledgerOf<F extends Finding>(
   records: readonly SuppressionRecord[],
@@ -247,23 +283,22 @@ export function ledgerOf<F extends Finding>(
   const taken = new Set<string>();
   const verdicts: Verdict[] = [];
   for (const record of records) {
-    if (record.bound !== "" && dials.withholdsCode(record.code, record.bound)) {
-      verdicts.push("dormant");
+    const open = (finding: F): boolean => !taken.has(claimKey(finding)) && pairs(record, finding);
+    const first = would.find(open);
+    const claimed =
+      first === undefined ? [] : isPartKind(record.code) ? would.filter(open) : [first];
+    if (claimed.length === 0) {
+      verdicts.push(record.bound !== "" && dials.allows(record.code) ? "dormant" : "stale");
       continue;
     }
-    const claimed = would.find(
-      (finding) => !taken.has(claimKey(finding)) && pairs(record, finding),
-    );
-    if (claimed === undefined) {
-      verdicts.push("stale");
-      continue;
+    for (const finding of claimed) {
+      taken.add(claimKey(finding));
     }
-    taken.add(claimKey(claimed));
-    verdicts.push(dials.withholds(claimed) ? "dormant" : "in-effect");
+    verdicts.push(claimed.every((finding) => dials.withholds(finding)) ? "dormant" : "in-effect");
   }
   return {
     verdicts,
-    withheld: (finding) => taken.has(claimKey(finding)) && !ROW_SUBJECTS.has(finding.symbol.kind),
+    withheld: (finding) => taken.has(claimKey(finding)),
   };
 }
 

package/src/unimplemented-callees.ts

@@ -0,0 +1,411 @@
+/**
+ * The members read where code the target cannot see receives a value of a target type. An
+ * object literal argument of a call or a `new` whose callee has no implementation in the
+ * target has every member of the parameter type it is checked against read, nested
+ * literals included. An `as` expression over an object no file of the project declares, and
+ * a `new` through an unimplemented construct signature, hand the target a value the
+ * outside code holds, so every member of the type it is given is read.
+ */
+
+import {
+  isArrowFunction,
+  isAsExpression,
+  isCallExpression,
+  isClassDeclaration,
+  isClassExpression,
+  isFunctionDeclaration,
+  isFunctionExpression,
+  isHeritageClause,
+  isIdentifier,
+  isMethodDeclaration,
+  isNewExpression,
+  isObjectLiteralExpression,
+  isParameterDeclaration,
+  isParenthesizedExpression,
+  isPropertyAccessExpression,
+  isPropertyAssignment,
+  isPropertyDeclaration,
+  isSatisfiesExpression,
+  isTypeReferenceNode,
+  isVariableDeclaration,
+  type CallExpression,
+  type Expression,
+  type NewExpression,
+  type Node,
+  type ObjectLiteralExpression,
+  type ParameterDeclaration,
+  type SourceFile,
+} from "@typescript/native/unstable/ast";
+import { SymbolFlags, type Symbol as TSSymbol, type Type } from "@typescript/native/unstable/sync";
+import type { AliasChains } from "./alias-chain.ts";
+import { nodeKey, type Inventory } from "./inventory.ts";
+import { renderPosition } from "./position.ts";
+import { UNANSWERED } from "./query.ts";
+import type { Reference } from "./references.ts";
+import type { ProjectView } from "./session.ts";
+
+/** One call or construction passing an object literal, and the declaration that writes it. */
+interface Passing {
+  readonly file: SourceFile;
+  readonly from: string;
+  readonly call: CallExpression | NewExpression;
+}
+
+/** A node where an outside value takes a type of the target, and the declaration that writes it. */
+interface HandedOver {
+  readonly file: SourceFile;
+  readonly from: string;
+  readonly node: Expression;
+}
+
+/** The value an `as` expression asserts a type of, through every `as` and parenthesis around it. */
+function castOperand(node: Expression): Expression {
+  let at = node;
+  while (isAsExpression(at) || isParenthesizedExpression(at)) {
+    at = at.expression;
+  }
+  return at;
+}
+
+/** Whether a declaration node carries a body of statements or an expression. */
+function hasBody(node: Node): boolean {
+  return (node as { readonly body?: Node }).body !== undefined;
+}
+
+function isFunctionLike(node: Node | undefined): boolean {
+  return (
+    node !== undefined &&
+    (isArrowFunction(node) ||
+      isFunctionExpression(node) ||
+      isFunctionDeclaration(node) ||
+      isClassExpression(node))
+  );
+}
+
+/** The name a declaration is declared under, where it has one an identifier spells. */
+function nameOf(node: Node): string | undefined {
+  const name = (node as { readonly name?: Node }).name;
+  return name !== undefined && isIdentifier(name) ? name.text : undefined;
+}
+
+/**
+ * Whether an overload signature has its implementation beside it: a declaration of the same
+ * name and kind, in the same statement list or class body, that carries a body.
+ */
+function overloadImplemented(node: Node): boolean {
+  if (!isFunctionDeclaration(node) && !isMethodDeclaration(node)) {
+    return false;
+  }
+  const name = nameOf(node);
+  let implemented = false;
+  node.parent.forEachChild((sibling) => {
+    implemented ||= sibling.kind === node.kind && nameOf(sibling) === name && hasBody(sibling);
+  });
+  return implemented;
+}
+
+/** Every object literal one argument holds, the argument itself included, through nested property values. */
+function literalsOf(argument: Expression): readonly ObjectLiteralExpression[] {
+  if (!isObjectLiteralExpression(argument)) {
+    return [];
+  }
+  return [
+    argument,
+    ...argument.properties.flatMap((property) =>
+      isPropertyAssignment(property) ? literalsOf(property.initializer) : [],
+    ),
+  ];
+}
+
+/**
+ * The reads the object-literal arguments of one project's own files make of the members of
+ * the types they are checked against, where the callee has no implementation in the target.
+ */
+export function unimplementedCalleeReads<Brand>(
+  project: ProjectView<Brand>,
+  held: Inventory,
+  chains: AliasChains,
+  root: string,
+  testFiles: ReadonlySet<string>,
+): readonly Reference[] {
+  const queries = project.queries;
+  const own = project.ownPaths();
+  const passing: Passing[] = [];
+  const implementing: Node[] = [];
+  const asserted: (HandedOver & { readonly operand: Expression })[] = [];
+  const constructed: Passing[] = [];
+  const handing: (CallExpression | NewExpression)[] = [];
+  for (const file of project.ownSourceFiles()) {
+    const fileId = held.declarations.get(nodeKey(file, file));
+    if (fileId === undefined) {
+      continue;
+    }
+    const visit = (node: Node, from: string): void => {
+      const holder = held.declarations.get(nodeKey(file, node)) ?? from;
+      if (
+        (isCallExpression(node) || isNewExpression(node)) &&
+        (node.arguments ?? []).some((argument) => isObjectLiteralExpression(argument))
+      ) {
+        passing.push({ file, from: holder, call: node });
+      }
+      if (isNewExpression(node)) {
+        constructed.push({ file, from: holder, call: node });
+      }
+      if (
+        (isCallExpression(node) || isNewExpression(node)) &&
+        (node.arguments ?? []).some(
+          (argument) => isFunctionLike(argument) || isIdentifier(argument),
+        )
+      ) {
+        handing.push(node);
+      }
+      if (isAsExpression(node) && !isAsExpression(node.parent)) {
+        asserted.push({ file, from: holder, node, operand: castOperand(node) });
+      }
+      if (isClassDeclaration(node) || isClassExpression(node)) {
+        for (const clause of node.heritageClauses ?? []) {
+          if (isHeritageClause(clause)) {
+            implementing.push(
+              ...clause.types.map((one) =>
+                isTypeReferenceNode(one) ? one.typeName : one.expression,
+              ),
+            );
+          }
+        }
+      }
+      // An object literal typed as an interface implements that interface's methods.
+      if (
+        isVariableDeclaration(node) &&
+        node.type !== undefined &&
+        isTypeReferenceNode(node.type) &&
+        node.initializer !== undefined &&
+        isObjectLiteralExpression(node.initializer)
+      ) {
+        implementing.push(node.type.typeName);
+      }
+      if (
+        (isSatisfiesExpression(node) || isAsExpression(node)) &&
+        isObjectLiteralExpression(node.expression) &&
+        isTypeReferenceNode(node.type)
+      ) {
+        implementing.push(node.type.typeName);
+      }
+      node.forEachChild((child) => {
+        visit(child, holder);
+      });
+    };
+    file.forEachChild((child) => {
+      visit(child, fileId);
+    });
+  }
+  if (passing.length === 0 && asserted.length === 0 && constructed.length === 0) {
+    return [];
+  }
+
+  const resolved = (symbol: TSSymbol | undefined | typeof UNANSWERED): TSSymbol | undefined => {
+    if (symbol === UNANSWERED || symbol === undefined) {
+      return undefined;
+    }
+    if ((symbol.flags & SymbolFlags.Alias) === 0) {
+      return symbol;
+    }
+    const target = queries.aliased(symbol);
+    return target === UNANSWERED ? undefined : target;
+  };
+  const declarationsOf = (symbol: TSSymbol | undefined): readonly Node[] =>
+    (symbol?.declarations ?? []).flatMap((handle) => {
+      const node = project.declarationAt(handle)?.node;
+      return node === undefined ? [] : [node];
+    });
+
+  const implemented = new Set<Node>(
+    queries.symbolsAt(implementing).flatMap((symbol) => declarationsOf(resolved(symbol))),
+  );
+
+  /** Whether a declaration is a function or a class of the target, or a variable or property it initializes. */
+  const ownFunction = (node: Node): boolean =>
+    own.has(node.getSourceFile().fileName) &&
+    (isFunctionLike(node) ||
+      ((isVariableDeclaration(node) || isPropertyAssignment(node) || isPropertyDeclaration(node)) &&
+        isFunctionLike(node.initializer)));
+
+  /**
+   * Whether a function or a class of the target reaches one parameter of a function of the
+   * target, passed for it by a call that names the function. A call through another name
+   * is not followed, so its callee keeps no implementation and its literal reads more.
+   */
+  const reachedParameters = new Map<ParameterDeclaration, boolean>();
+  const parameterReached = (parameter: ParameterDeclaration): boolean => {
+    const known = reachedParameters.get(parameter);
+    if (known !== undefined) {
+      return known;
+    }
+    const fn = parameter.parent;
+    const fnName = nameOf(fn) ?? (isVariableDeclaration(fn.parent) ? nameOf(fn.parent) : undefined);
+    const at =
+      (fn as { readonly parameters?: readonly Node[] }).parameters?.indexOf(parameter) ?? -1;
+    const passed = handing.flatMap((call) => {
+      const callee = call.expression;
+      const name = isPropertyAccessExpression(callee) ? callee.name : callee;
+      if (fnName === undefined || !isIdentifier(name) || name.text !== fnName) {
+        return [];
+      }
+      const signature = queries.resolvedSignature(call);
+      const handle =
+        signature === UNANSWERED || signature === undefined ? undefined : signature.declaration;
+      const argument =
+        handle === undefined || project.declarationAt(handle)?.node !== fn
+          ? undefined
+          : (call.arguments ?? [])[at];
+      return argument === undefined || at < 0 ? [] : [argument];
+    });
+    const named = passed.filter((argument) => isIdentifier(argument));
+    const reached =
+      passed.some((argument) => isFunctionLike(argument)) ||
+      queries
+        .symbolsAt(named)
+        .some((symbol) => declarationsOf(resolved(symbol)).some((node) => ownFunction(node)));
+    reachedParameters.set(parameter, reached);
+    return reached;
+  };
+
+  /** Whether some function, class or object literal of the target stands for a signature. */
+  const standsFor = (passed: Passing): boolean => {
+    const signature = queries.resolvedSignature(passed.call);
+    const handle =
+      signature === UNANSWERED || signature === undefined ? undefined : signature.declaration;
+    const declaration = handle === undefined ? undefined : project.declarationAt(handle)?.node;
+    if (declaration === undefined) {
+      return true;
+    }
+    if (hasBody(declaration) || overloadImplemented(declaration)) {
+      return own.has(handle?.path ?? "");
+    }
+    const holder = declaration.parent as Node | undefined;
+    if (holder !== undefined && implemented.has(holder)) {
+      return true;
+    }
+    const callee = passed.call.expression;
+    const name = isPropertyAccessExpression(callee) ? callee.name : callee;
+    const [named] = queries.symbolsAt([name]);
+    return declarationsOf(resolved(named)).some((node) =>
+      isParameterDeclaration(node)
+        ? own.has(node.getSourceFile().fileName) && parameterReached(node)
+        : ownFunction(node) && !isFunctionLike(node),
+    );
+  };
+
+  const literals: { readonly passed: Passing; readonly literal: ObjectLiteralExpression }[] = [];
+  for (const passed of passing) {
+    if (standsFor(passed)) {
+      continue;
+    }
+    for (const argument of passed.call.arguments ?? []) {
+      literals.push(...literalsOf(argument).map((literal) => ({ passed, literal })));
+    }
+  }
+  const contexts = queries.contextualTypes(literals.map((one) => one.literal));
+
+  const found: Reference[] = [];
+  literals.forEach(({ passed, literal }, at) => {
+    const context = contexts[at];
+    if (context === UNANSWERED || context === undefined) {
+      return;
+    }
+    const parts = queries.constituents(context);
+    const position = renderPosition(passed.file, root, literal.getStart());
+    for (const part of parts === UNANSWERED ? [context] : parts) {
+      const properties = queries.propertiesOf(part);
+      for (const property of properties === UNANSWERED ? [] : properties) {
+        for (const to of chains.declarationsOf(property)) {
+          found.push({
+            from: passed.from,
+            to,
+            position,
+            use: "read",
+            resolution: "contextual",
+            test: testFiles.has(position.path),
+          });
+        }
+      }
+    }
+  });
+  found.push(...handedOver());
+  return found;
+
+  /** Whether a type is an object no file of the project declares, a platform object's among them. */
+  function outsideValue(type: Type): boolean {
+    if (!type.isObjectType()) {
+      return false;
+    }
+    const symbol = queries.symbolOfType(type);
+    const declared = symbol === UNANSWERED ? undefined : symbol;
+    return declared?.declarations.every((handle) => !own.has(handle.path)) === true;
+  }
+
+  /** Whether a type is an object type a file of the project declares. */
+  function ownObject(type: Type | undefined | typeof UNANSWERED): type is Type {
+    const known = type === UNANSWERED ? undefined : type;
+    if (!known?.isObjectType()) {
+      return false;
+    }
+    const symbol = queries.symbolOfType(known);
+    const declared = symbol === UNANSWERED ? undefined : symbol;
+    return declared?.declarations.some((handle) => own.has(handle.path)) === true;
+  }
+
+  /** The reads of every member of each target type an outside value is handed over as. */
+  function handedOver(): readonly Reference[] {
+    const operandTypes = queries.typesAt(asserted.map((one) => one.operand));
+    const fromCasts: HandedOver[] = asserted.filter((_one, at) => {
+      const type = operandTypes[at];
+      return type !== UNANSWERED && type !== undefined && outsideValue(type);
+    });
+    const newTypes = queries.typesAt(constructed.map((one) => one.call));
+    // A construct signature whose declared result is one of its type parameters names no
+    // type the target declares, so only a result the signature itself names is handed over.
+    const fromConstructors: HandedOver[] = constructed
+      .filter((one, at) => {
+        if (!ownObject(newTypes[at]) || standsFor(one)) {
+          return false;
+        }
+        const signature = queries.resolvedSignature(one.call);
+        const result =
+          signature === UNANSWERED || signature === undefined
+            ? undefined
+            : queries.returnTypeOf(signature);
+        return result !== UNANSWERED && result !== undefined && !result.isTypeParameter();
+      })
+      .map((one) => ({ file: one.file, from: one.from, node: one.call }));
+    const handed = [...fromCasts, ...fromConstructors];
+    const types = queries.typesAt(handed.map((one) => one.node));
+    const reads: Reference[] = [];
+    handed.forEach((one, at) => {
+      const type = types[at];
+      if (type === UNANSWERED || type === undefined) {
+        return;
+      }
+      const position = renderPosition(one.file, root, one.node.getStart());
+      const parts = queries.constituents(type);
+      for (const part of parts === UNANSWERED ? [type] : parts) {
+        if (!ownObject(part)) {
+          continue;
+        }
+        const properties = queries.propertiesOf(part);
+        for (const property of properties === UNANSWERED ? [] : properties) {
+          for (const to of chains.declarationsOf(property)) {
+            reads.push({
+              from: one.from,
+              to,
+              position,
+              use: "read",
+              resolution: "contextual",
+              test: testFiles.has(position.path),
+            });
+          }
+        }
+      }
+    });
+    return reads;
+  }
+}

package/src/value-reach.ts

@@ -1,11 +1,10 @@
 /**
  * The classes of the target a value of one type carries, and the members of the other
- * object types the target writes that it carries, as a serializer walking the value
- * reaches them: through union and intersection constituents, array and tuple elements,
- * and the data members and index signatures of the target's classes and of the
- * interfaces and object types the target writes. The walk stops at `any`, `unknown`, a
- * type parameter, a function and an interface or class of another program, so an
- * instance held only there is missed.
+ * object types the target writes that it carries, as a serializer walking the value reaches
+ * them: through constituents, array and tuple elements, the data members and index
+ * signatures of the types the target writes, and the values `stored` gives for a type where
+ * it erases them. The walk stops at `any`, `unknown`, a type parameter, a function and an
+ * interface or class of another program, so an instance held only there is missed.
  */
 
 import {
@@ -60,7 +59,11 @@ function arrayTargets<Brand>(project: ProjectView<Brand>): ReadonlySet<number> {
  * The walk over one project's types, against the classes of `held`, the same
  * project's inventory.
  */
-export function valueReach<Brand>(project: ProjectView<Brand>, held: Inventory): ValueReach {
+export function valueReach<Brand>(
+  project: ProjectView<Brand>,
+  held: Inventory,
+  stored: (type: Type) => readonly Type[] = () => [],
+): ValueReach {
   const queries = project.queries;
   const names = [...classNames(project, held)];
   const declared = typesAt(
@@ -161,6 +164,7 @@ export function valueReach<Brand>(project: ProjectView<Brand>, held: Inventory):
         found = must(queries.typeArguments(type));
       }
     }
+    found = [...found, ...stored(type)];
     children.set(type.id, found);
     return found;
   };

package/src/verbs/analyze.ts

@@ -26,7 +26,7 @@ import { json } from "../reporters/json.ts";
 import { RENDERINGS } from "../reporters/reporters.ts";
 import { parseTemplate, TemplateError, type Template } from "../reporters/template.ts";
 import { resolve } from "../resolve.ts";
-import { rowReason, writeBaseline, type Recorded } from "../suppress-file.ts";
+import { otherSchemeRows, rowReason, writeBaseline, type Recorded } from "../suppress-file.ts";
 import { CONTRACT_VERSION } from "../version.ts";
 import { EXIT_CLEAN, EXIT_FAILURE, type Verb, type VerbOptions } from "./verb.ts";
 
@@ -174,13 +174,12 @@ interface Documents {
 }
 
 /**
- * Analyzes the scope under the configuration and writes the JSON report to the path
- * `--report` names, each rendering `--format` names beside it at the report's path with the
- * format's suffix appended, and where `--baseline-write` names a path the baseline a fixpoint
- * over the analysis records, the report then being its first round, which reads no
- * baseline. The template format renders the template `--template` names. Nothing is written to
- * the output stream; diagnostics go to the error stream and the verdict is the exit code, or 0
- * under `--exit-code=off`, and a rendering that cannot be written ends the run with 3.
+ * Analyzes the scope and writes the JSON report to the path `--report` names, each
+ * `--format` rendering beside it with the format's suffix appended, and under
+ * `--baseline-write` the baseline a fixpoint over the analysis records, the report being its
+ * first round. Diagnostics go to the error stream and nothing to the output stream; the
+ * verdict is the exit code, or 0 under `--exit-code=off`, and a rendering that cannot be
+ * written ends the run with 3.
  */
 export const analyzeVerb: Verb = ({ err, host, inputs, scope, openClient, option, repeated }) => {
   const reportPath = option("report");
@@ -304,7 +303,14 @@ export const analyzeVerb: Verb = ({ err, host, inputs, scope, openClient, option
       }
     }
     if (documents.baseline !== undefined) {
-      host.writeDocument(documents.baseline, writeBaseline(recorded, analyzerProvenance(version)));
+      const kept =
+        host.kindOf(documents.baseline) === "file"
+          ? otherSchemeRows(host.readFile(documents.baseline))
+          : [];
+      host.writeDocument(
+        documents.baseline,
+        writeBaseline(recorded, analyzerProvenance(version), kept),
+      );
     }
   } catch (error: unknown) {
     err.write(`deadset-ts: ${error instanceof Error ? error.message : String(error)}\n`);