fix(members): three false positives in unused-class-members

[Jerc92]

What

Three confirmed false positives in unused-class-members, all reproduced against a freshly built main (3.3.0) before any code was written, each pinned by a cross-file regression fixture with a positive control.

1. A member reached through a local (non-exported) subclass.

// base.ts
export abstract class Base { static someStatic(v: string) { return v } }
// sub.ts
class Sub extends Base {}                 // not exported
export const config = { a: Sub.someStatic('x') }

Base.someStatic was reported unused. Sub never becomes an export, so the analyze layer's import/export map cannot resolve the object Sub, and build_parent_to_children is built from exports alone. Exporting Sub makes the identical code resolve — that is the tell. Fixed in extract, by walking the local extends chain to the first name that is not locally declared and re-emitting the access against it. No synthetic export keys: an ExportKey for a non-export is semantically wrong and collides across files.

2 and 3. A factory result read without a named binding.

useApi().member                 // chained call
const { member } = useApi()     // destructure

Cross-module factory-return propagation already worked for const s = f(); s.m. It never fired for these two, because the extractor recorded a candidate only for a plain BindingIdentifier declarator, and a chained call is not a declarator at all. Those two shapes are what real composables and singletons use, so every member of the returned class was reported unused.

Both now record (callee, member) directly. A same-file factory binds the class; an imported callee emits the typed fact the analyze layer resolves through the strict, value-proven exported_factory_returns gate. Any other callee resolves to no proven factory export and credits nothing, so recording every identifier().member is safe.

Only the first level of the result belongs to the factory's class. f().a.b credits a; b is read off whatever type a has. { a: { b } } credits a for the same reason.

The opaque-destructure trap. const { a, ...rest } = f() and a computed key can read any property. Crediting only the visible keys would leave every other live member reported — the same false positive, narrowed. The returned class is marked wholly used instead, via a new FactoryFnWholeObject fact resolved through the same gate. Reporting nothing for that class is a deliberate false negative.

The final commit is a pure refactor: the callee -> re-export origins -> exported_factory_returns -> class-with-members chain existed in three copies, and every link of it is an over-credit gate, so three copies are three places for the gates to drift apart.

Why

Every fix here is additive credit: it can turn a reported member into an unreported one, never the reverse. Neither can introduce a new false positive. That is the direction this rule must err in — a false positive is what makes it untrustworthy, and it was disabled downstream because 81% of its findings were false positives.

Corrections to the original report

Two of the three diagnoses in the bug report were wrong, and following them would have produced the wrong fix:

• The chained-call/destructure bug is not missing cross-file factory propagation. That works. Every repro in the report happened to use only the two unsupported consumer shapes, which is why an explicit getState(): State return type looked ignored. It never was.
• The subclass bug's discriminator is not "static method vs static arrow property". That divergence does not exist — static arrowViaSub = (v) => v is flagged identically. The discriminator is that the subclass is not exported.

Deliberately not fixed

Each is pinned by a test, so a future change has to decide the case rather than flip it by accident:

• class Sub extends mixin(Base) — no superclass name is recorded; a mixin may redefine what the subclass exposes, so crediting through it would be a guess.
• class Sub extends ns.Base — the dotted name resolves to no bare local. Pre-existing, and wider than subclassing: a direct ns.Base.someStatic() is equally uncredited on main, verified by running both binaries against the same fixture. Closing it means resolving namespace aliases in the analyze layer.
• A member access through an inferred property hop (computed(() => new C()).value.m, or a plain { value: new C() } wrapper). Annotated hops already work via the typed-property path; inferred ones and generic type arguments (Ref<T> / ComputedRef<T>) do not. Not Vue-specific; Vue just makes it ubiquitous.
• The same-file abstain: a class whose instance escapes through a same-file factory is skipped wholesale by the whole-object gate, so genuinely dead members go unreported. It under-reports rather than over-reports, and widening it would manufacture findings in exactly the rule that was disabled for being noisy.

Happy to take any of these on in a follow-up.

Test plan

• Two new cross-file fixtures with positive controls, plus a third pinning the opaque destructure. Fixtures are cross-file on purpose: a same-file factory is skipped by the whole-object gate, so a same-file fixture reports nothing and passes for the wrong reason. That is why the fixture added with the previous fix for this bug went green while the reported bug stayed live.
• Covered and asserted: static method, static passed as a value, static arrow property, a two-level local chain, an 18-deep local chain (cycle detection, not a depth cap — a cap would abstain and report the member falsely), an instance member through a local subclass, chained call, chained-then-call, chained-then-deep (first level only), destructure, renamed key, defaulted key, nested key (first level only), optional chaining, a non-factory callee crediting and suppressing nothing, and the opaque destructure suppressing the class.
• Also asserted: deep and inner (second-level keys) never become members of the factory's class.
• cargo test --workspace --lib --bins --tests — 58 test binaries, 0 failures. cargo clippy --workspace --all-targets -- -D warnings and cargo fmt --all -- --check clean. generate:contracts:check and a --features schema-emit build both pass.
• Both commits that change extraction semantics bump CACHE_VERSION (227 -> 228 -> 229); stale cached modules would otherwise carry pre-fix facts. The new SemanticFact variant is appended, never inserted: bitcode encodes an enum by ordinal, so moving an existing variant would make an old cache decode one fact as another.

The change was reviewed by four independent adversarial passes — on the plan, on the first commit, on the branch, and for redundancy. Findings acted on include: replacing a depth cap that was itself a false-positive source; moving the subclass pass after resolve_bound_member_accesses, which is what materializes the access for const s = new Sub(); s.member; appending rather than inserting the enum variant; and removing a stand-in-local mechanism that made every helper().x a resolution candidate.

Note: the commits are unsigned — no GPG key on the machine they were authored on. Happy to re-sign if that blocks merge.