Propagate matched sensitivity with one work queue

internal/engine/secret.go

@@ -80,34 +80,11 @@ func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Pa
 			classifyPath(resolved)
 		}
 	}
-	classified := closeSecretDependencies(paths, secret, dependencies, inherited)
+	var correspondence resolutionCorrespondence
 	if model := metadata.historyEvidence(); model != nil && model.resolutionPayload != nil {
-		// Project from the completed entry classification into a separate map so
-		// one side of a swap cannot influence the other while it is being read.
-		projected := make(map[string]Path)
-		for _, path := range paths {
-			if !pathIsSecret(classified, path) {
-				continue
-			}
-			if target, matched := model.resolutionPayload.correspondence.finalPath(path); matched {
-				projected[target.String()] = target
-			}
-			if prior, matched := model.resolutionPayload.correspondence.entryPath(path); matched {
-				projected[prior.String()] = prior
-			}
-		}
-		for pointer, path := range projected {
-			paths[pointer] = path
-			secret[pointer] = true
-		}
-		for pointer, sensitive := range classified {
-			if sensitive {
-				secret[pointer] = true
-			}
-		}
-		return closeSecretDependencies(paths, secret, dependencies, inherited)
+		correspondence = model.resolutionPayload.correspondence
 	}
-	return classified
+	return closeSecretDependenciesWithCorrespondence(paths, secret, dependencies, inherited, correspondence)
 }
 
 func addSecretPath(paths map[string]Path, pointer string) {