From aa017c61ff3803dea3b823664ae255c4059c19d4 Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Wed, 11 Nov 2026 15:10:41 -0500
Subject: [PATCH] fix(audit): retract map declarations once per source spelling

---
 src/artifacts/ReleaseExposureReader.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/artifacts/ReleaseExposureReader.ts b/src/artifacts/ReleaseExposureReader.ts
index aef93cc944..389f7e7b84 100644
--- a/src/artifacts/ReleaseExposureReader.ts
+++ b/src/artifacts/ReleaseExposureReader.ts
@@ -1944,9 +1944,9 @@ const noteScriptReference = (
 const noteScriptTarget = (state: ScanState, location: string): void => {
   const target = memberLocationKey(state, location);
   const spellings = state.scriptTargets.get(target);
-  retractLinkerMapGuesses(state, location);
   const spelling = anchoredLocation(state, location);
   if (spellings?.has(spelling)) return;
+  retractLinkerMapGuesses(state, location);
   state.scriptTargetBytes += Buffer.byteLength(spelling);
   if (state.scriptTargetBytes > MAX_RELEASE_EXPOSURE_SCRIPT_TARGET_BYTES) {
     state.skippedMaps += 1;
@@ -2058,11 +2058,12 @@ const noteLocalMapReference = (
  */
 const noteMapTarget = (state: ScanState, location: string): void => {
   const target = memberLocationKey(state, location);
-  // A map read before its declaration may have settled as a linker map.
-  state.skippedMaps += retractLinkerMapGuesses(state, location);
   const spellings = state.mapTargets.get(target);
   const spelling = anchoredLocation(state, location);
   if (spellings?.has(spelling)) return;
+  // Retract once per exact declaration; repeating it must not consume peers
+  // that only share its normalized lookup key.
+  state.skippedMaps += retractLinkerMapGuesses(state, location);
   state.mapTargetBytes += Buffer.byteLength(spelling);
   if (state.mapTargetBytes > MAX_RELEASE_EXPOSURE_MAP_TARGET_BYTES) {
     state.skippedMaps += 1;