Propagate matched sensitivity with one work queue

internal/engine/resolution_compare_test.go

@@ -675,3 +675,37 @@ func TestMovedDynamicTaggedValueStaysHidden(t *testing.T) {
 		}
 	}
 }
+
+func TestMovedDependencyProtectsEarlierMatchedValue(t *testing.T) {
+	type item struct {
+		ID     string `yaml:"id"`
+		Secret string `yaml:"secret"`
+		Value  string `yaml:"value"`
+	}
+	type config struct {
+		Items []item `yaml:"items"`
+	}
+	definition := DefinitionWithSequenceIdentityRegistrations(Definition[config]{
+		Secret: func(path Path) bool { return path.String() == "/items/0/secret" },
+		Resolve: func(value *config, r *Resolution) error {
+			value.Items[0], value.Items[1] = value.Items[1], value.Items[0]
+			value.Items[0].Value = value.Items[1].Secret
+			r.RecordNormalization(Keys("items"), "reorder")
+			r.RecordNormalization(Keys("items").Index(0).Key("value"), "derive", Keys("items").Index(1).Key("secret"))
+			return nil
+		},
+	}, []SequenceIdentityRegistrationInput{{ExactPath: pathPointer(Keys("items")), IdentityFields: []string{"id"}}})
+	result, err := testLoad(Bytes("records", []byte("items: [{id: a, secret: HIDDEN_A, value: public}, {id: b, value: EARLIER_PRIVATE}]\n")), Options[config]{Definition: definition})
+	if err != nil {
+		t.Fatal(err)
+	}
+	explanation, ok := result.Inspection.Explain(Keys("items").Index(0).Key("value"))
+	if !ok {
+		t.Fatal("missing explanation")
+	}
+	for _, change := range explanation.History {
+		if strings.Contains(change.Before.YAML, "EARLIER_PRIVATE") || strings.Contains(change.After.YAML, "EARLIER_PRIVATE") || strings.Contains(change.After.YAML, "HIDDEN_A") {
+			t.Fatalf("sensitive lineage leaked: %#v", change)
+		}
+	}
+}