depends: what a string names and what a subscript picks are reads

mapped()'s siblings now read the fields they name in a string literal,
through _named_reads (was _mapped_reads): filtered("a.b"), grouped("f"),
sorted("f") and, on Odoo 19, an order such as "date desc, id", and the
leaf fields of a filtered_domain() literal. _attr_path and
_resolve_iterable look through a subscript whose index is a literal
integer or a slice, so rec.line_ids[0].amount reads line_ids.amount;
record[name] and x[i] still stop the path. Every exemption applies to
the new reads. constrains-must-list-every-field-read makes the same
reads, and depends-must-not-name-unread-fields counts them when it
steps aside, which moved nothing.

OCA 99 -> 101, OpenSPP 157 -> 163, core 2338 -> 2358, nothing lost and
no other rule moved. All 28 read: 18 true, 10 false.
OCA, 2 true (account_move_name_sequence's journal hash flag,
account_spread_cost_revenue's line_ids), into classification-oca.
OpenSPP, 6 true (five spp_programs registrant counts filtered on
is_registrant, spp_approval's tier sequence), into
classification-openspp-rest.
Core, 20. True: hr_expense_sheet reversal, the accrual plan and level
units, hr_holidays_contract employee, gelato template ref, stock.scrap
line unit, POS product colour, base_automation, sale_expense_margin,
l10n_id_efaktur_coretax. False, each a class the checker already had:
unstored in another module (base_import_module, l10n_latam), depends
merged from sale_project (sale_timesheet), covered through another
compute (hr_expense, website_slides), a value kept on purpose (payment
term days, l10n_id_efaktur's name), writes refused while a session is
open (POS cash journal, two), a non-stored compute in constrains
(mail activity schedule). filtered_domain() and grouped() add nothing
on the three trees. 288 of 288 hand-classified true positives still
reported. ARCHITECTURE 3.71.

ARCHITECTURE.md

@@ -2612,7 +2612,7 @@ all of them, and in more than one direction at once.
 
 `bin/figures.py` recomputes every present-tense figure from the committed artifacts, and
 `--check` fails on any figure in README.md or ARCHITECTURE.md that disagrees. A figure is
-marked where it stands, `<!--fig:oca.rate-->2.9<!--/fig-->`, which renders as nothing.
+marked where it stands, `<!--fig:oca.rate-->3.0<!--/fig-->`, which renders as nothing.
 Dated sentences are not marked: "re-measured on 2026-09-16: 3.5" is a record of a past
 run and stays true after the next one, and a check that demanded it change would be
 demanding that history be rewritten. It runs in CI as its own job, needing no checkout
@@ -3500,6 +3500,154 @@ mistake the rule was written for (§3.7), and the three-segment spelling of it w
 passed there too. The corpus now decides 8 rules by a regex and 19 by an AST pass. All 280
 hand-classified true positives are still reported.
 
+### 3.71 What a string names, and what a subscript picks
+
+**Measured 2026-09-27.** §3.66 taught the depends check that `x.mapped("a.b")` reads `x.a.b`.
+The sweep that found §3.70's gap found the siblings of `mapped()` still silent, and one more
+place where a path stopped:
+
+- `x.filtered("is_paid")` reads `x.is_paid`, and `x.filtered("a.b")` reads `x.a.b`.
+- `x.sorted("sequence")` reads `x.sequence`. Odoo 18 takes one field name there, as
+  `itemgetter(key)`. On 19 the argument is an order, `"date desc, id"`, whose terms each name a
+  field (`_sorted_order_to_function`, `odoo/orm/models.py` on 19.0).
+- `x.filtered_domain([("state", "=", "done")])` reads `x.state` for every leaf written out, and
+  through an `any` leaf to the related records. `x.grouped("f")` keys on `x.f`.
+- `rec.line_ids[0].amount` read nothing past `line_ids`, because `_attr_path` and
+  `_resolve_iterable` stopped at a subscript. `rec.partner_id.child_ids[:1].email` reported
+  `partner_id.child_ids` and never the email, which is the field whose change goes unnoticed.
+
+`_named_reads` replaces `_mapped_reads` and reads all five methods, literals only. A lambda, a
+name and a domain built at run time stay unread, and an order with any word after a field but
+`asc`, `desc`, `nulls`, `first` or `last` is read not at all rather than in part. A subscript is
+looked through when its index is a literal integer or a slice, since indexing or slicing a
+recordset gives records of the same path. The other thing a subscript does is `record[name]`,
+which reads the field called `name`, so a string or a variable as the index stops the path as it
+did before. Every exemption the check has applies to every new read: a trailing `.id`, a field
+the method computes, a non-stored compute, a wizard, `display_name`, a declared longer path, and
+a read inside a `raise` or a log line.
+
+`constrains-must-list-every-field-read` had only ever read attributes, so
+`if any(self.mapped("date_end"))` under `@api.constrains("date_start")` was silent. It was
+measured with the same reads before it took them. `depends-must-not-name-unread-fields` steps
+aside when the body reads a field its decorator does not declare, because the depends check owns
+that disagreement, and it now counts the same reads when it decides. That moved nothing on the
+three trees.
+
+| | before | after |
+|---|---|---|
+| OCA | 99 | **101** |
+| OpenSPP | 157 | **163** |
+| odoo core | 2,338 | **2,358** |
+
+Nothing disappears, and no other rule moves. By part: the literal forms add 1, 6 and 11 depends
+findings on OCA, OpenSPP and core, the subscripts add 6 on core, and the constrains check adds 1
+on OCA and 3 on core. `filtered_domain()` and `grouped()` add nothing on the three trees. They
+name fields exactly as `filtered()` does and are kept for code these trees do not hold. A loop
+over `enumerate()`, the other shape the sweep sized, added nothing and was left out.
+
+Every addition was read.
+
+**OCA, 2, both true**, now in `classification-oca-2026-09.json`. `account_move_name_sequence`
+sets `made_sequence_gap` to `False` for moves outside a hashed journal with
+`self.filtered("journal_id.restrict_mode_hash_table")`, and neither its decorator nor
+`account`'s, which Odoo merges with it, names the flag: securing a journal leaves its existing
+moves on `False`. `account_spread_cost_revenue`'s journal check reads
+`mapped("line_ids.move_id")` and declares only `journal_id`. True as the rule states it, though
+every move the module creates for a line takes the spread's own journal.
+
+**OpenSPP, 6, all true**, in `classification-openspp-rest-2026-09.json` with the other findings
+later changes surfaced. `classification-openspp-2026-09.json` is the reading of the two flagship
+rules made on 2026-09-16 and is quoted as that reading. Five are `spp_programs`' registrant
+counts, each set to 0 for the partners `self.filtered("is_registrant")` leaves out, without
+`is_registrant` declared. Every create path in the tree sets the flag at creation and nothing
+rewrites it. The sixth is `spp_approval`'s current tier, the first pending tier review by
+`sequence`. A review's `sequence` is a stored related of its tier's, so reordering a
+definition's tiers while reviews are pending leaves each review on the tier the old order put
+first.
+
+**Core, 20: 10 true, 10 false.** The true ones:
+
+- `hr_expense`'s report is `reversed` once every entry has a reversal
+  (`filtered("reversal_move_ids")`). A company-paid report's entries are `entry` moves, whose
+  `payment_state` and `amount_residual`, the two fields declared, never move on a reversal, so
+  the report stays paid.
+- `hr_holidays`' accrual plan takes its unit from `level_ids[0].added_value_type`. Changing the
+  plan's time off type recomputes every level's unit, and the plan's own, which allocations
+  read, stays where it was. Each level's copy of the first level's unit is the same shape,
+  reached only by writing the first level directly: the form writes `level_ids` on the plan,
+  which is declared.
+- `hr_holidays_contract`'s multi-contract check filters on `employee_id` and declares the dates.
+  Moving a leave to an employee whose contracts under it keep different schedules is not
+  checked.
+- `website_sale_gelato`'s publishing check filters on `gelato_template_ref` and declares
+  `is_published`. A template set on a published product whose print images have no data is not
+  checked. The core sample already holds its sister check on `product.document` as true.
+- `stock.scrap` takes its quantity from `move_ids[0].quantity` and declares
+  `move_ids.move_line_ids.quantity`, one of the two things a move's quantity is computed from.
+  The other, the lines' unit, is the gap. Narrow.
+- `point_of_sale` copies the first POS category's colour onto the product and does not follow
+  a later change to it, on a `readonly=False` default. What §3.66 said of `incoterm_location`
+  applies.
+- Three with a field nothing in core rewrites, as §3.66 counted `response_code`.
+  `base_automation` gives an automatic name only to the actions `filtered("base_automation_id")`
+  keeps, and every core path creates the action already linked. `sale_expense_margin` costs a
+  reinvoiced line from its `expense_id`, set when the line is created. `l10n_id_efaktur_coretax`
+  names a document after its first and last invoice by `sorted("name")`, and a posted invoice
+  changes name only by resequencing.
+
+The false ones are classes the check already had for attribute reads. None comes from reading a
+line wrongly:
+
+- storedness in another module, two. `icon_image` in `base` and `highest_name` in `account` are
+  declared without `store=True`.
+- a decorator merged from another module, one. `sale_timesheet`'s project partner calls
+  `super()`, and `sale_project`'s `_compute_partner_id` declares `allow_billable`. Odoo merges
+  `@api.depends` across every override (§3.59), and the file in front of the check shows only
+  its own.
+- covered through another declared compute, two. `hr_expense` filters on `product_has_cost`,
+  which depends only on `product_id`, and the declared `tax_ids` depends on `product_id` too.
+  `website_slides` filters on `is_category`, and flipping it re-sections the channel through
+  `_compute_category_id`, which changes this slide's `slide_ids`, which is declared. This is the
+  class the OpenSPP classification calls `covered-by-its-own-depends`, one step further removed.
+- a value kept on purpose, two. An `account.payment.term.line` defaults its days to the
+  previous line's plus 30 only while they are unset, so declaring the sibling's days would
+  overwrite a deliberate 0 and make the field depend on itself. `l10n_id_efaktur`'s document
+  name is `readonly=False`, with a docstring saying it is computed at creation and may be
+  renamed.
+- refused by the model while it matters, two. The POS session's cash journal reads its payment
+  methods' `is_cash_count` and `journal_id` (`filtered("is_cash_count")[:1].journal_id`), and a
+  payment method refuses every write but `sequence` while a session using it is open.
+- advice that cannot be taken, one, on the constrains side. `mail.activity.schedule` filters on
+  `error`, a non-stored compute that `@api.constrains` cannot name: Odoo logs it as not
+  writeable. The decorator lists `error`'s writable inputs instead, and a comment says so.
+
+So 28 findings, 18 true. On core the depends additions read 8 of 17, below the 11 of 15 that
+rule's core sample read (§3.51), and the constrains additions 2 of 3, beside that rule's 10 of
+15 (§3.57). On OCA and OpenSPP they read 8 of 8. Each part was weighed apart, as
+§3.67 weighed its two, and none is left out. Each adds more true findings than false, and the
+false ones are not a new kind of mistake: they are what this check already says when the same
+field is read as an attribute, and keeping a spelling silent would not fix them, only hide them
+behind the spelling. None of the core readings goes into `classification-odoo-core-2026-09.json`,
+which is a fixed-seed sample. The hand-classified true positives are now 288, and all 288 are
+still reported.
+
+What it still does not follow, named so nobody finds it later:
+
+- a lambda, a name or a variable as the argument, a domain built at run time, and an Odoo 19
+  `Domain` object;
+- a subscript by a name, `rec.line_ids[i]`, which could be either kind of subscript;
+- a name assigned a recordset (`pending = ...sorted("sequence")[:1]`, then `pending.tier_id`):
+  `_aliases` binds loop variables only;
+- `mapped()` on the result of another `mapped()`, and a loop over a `mapped()` result, as §3.66
+  left them;
+- an attribute read straight off a call, `rec.sudo().partner_id.name` or
+  `rec.line_ids.filtered(...).amount`. Sized and not read: core +9 on the depends check (six
+  through `sudo()`, three through `with_context()`), OCA +1, OpenSPP 0;
+- a read another declared path already reaches: a read compute's own dependencies
+  (`product_has_cost` above, and OpenSPP's three older `covered-by-its-own-depends`), or a flag
+  whose change re-sections a declared relation (`is_category` above). Following either would be
+  a narrowing of its own.
+
 ## 4. Performance traps, all found by measurement
 
 Within four instrumented runs the report showed the 7B at ~10 tok/s against a
@@ -3617,12 +3765,12 @@ mutations are formatting-level, so an equivalent algorithm written differently i
 generated, and the samples are still small and still written alongside the patterns.
 
 `nexa fieldtest` (§3.18) closes part of that gap and opens an honest number in its
-place: **<!--fig:oca.rate-->2.9<!--/fig--> hits per 1000 lines** on
+place: **<!--fig:oca.rate-->3.0<!--/fig--> hits per 1000 lines** on
 <!--fig:oca.lines-->33,960<!--/fig--> lines of reviewed OCA code, down from 11.3 when
 this started. It was 2.9 after §3.43, and has moved since as rules were composed in and
 narrowed; §3.53 is why this sentence can no longer fall behind it.
 
-<!--fig:oca.read-->96<!--/fig--> of today's <!--fig:oca.findings-->99<!--/fig-->
+<!--fig:oca.read-->98<!--/fig--> of today's <!--fig:oca.findings-->101<!--/fig-->
 findings have been read by hand, which makes it a false-positive rate rather than a hit
 rate; the other <!--fig:oca.unread-->3<!--/fig--> arrived after the last reading. The
 table below is the reading of 2026-09-15, done against the run in §3.42 and re-run

README.md

@@ -132,9 +132,9 @@ half of the wrapper.
 
 Measured against **reviewed, merged** OCA code — <!--fig:oca.lines-->33,960<!--/fig-->
 lines that passed human review and shipped — the corpus makes
-<!--fig:oca.findings-->99<!--/fig--> findings, <!--fig:oca.rate-->2.9<!--/fig--> per
-thousand lines. <!--fig:oca.read-->96<!--/fig--> of them have been read by hand:
-**<!--fig:oca.read.true-->83<!--/fig--> true positives,
+<!--fig:oca.findings-->101<!--/fig--> findings, <!--fig:oca.rate-->3.0<!--/fig--> per
+thousand lines. <!--fig:oca.read-->98<!--/fig--> of them have been read by hand:
+**<!--fig:oca.read.true-->85<!--/fig--> true positives,
 <!--fig:oca.read.false-->6<!--/fig--> false, <!--fig:oca.read.undecidable-->7<!--/fig-->
 undecidable from a single file**, and the other <!--fig:oca.unread-->3<!--/fig--> are
 newer than the last reading. Every verdict is in the `classification-*.json` files, so the
@@ -143,8 +143,8 @@ fails if this paragraph stops agreeing with them.
 
 On <!--fig:openspp.lines-->226,937<!--/fig--> lines of OpenSPP the rate is
 <!--fig:openspp.rate-->0.7<!--/fig-->, and those findings have been read too: of the
-<!--fig:openspp.findings-->157<!--/fig--> it makes today,
-**<!--fig:openspp.read.true-->134<!--/fig--> true, <!--fig:openspp.read.false-->17<!--/fig-->
+<!--fig:openspp.findings-->163<!--/fig--> it makes today,
+**<!--fig:openspp.read.true-->140<!--/fig--> true, <!--fig:openspp.read.false-->17<!--/fig-->
 false, <!--fig:openspp.read.undecidable-->3<!--/fig--> undecidable**, with
 <!--fig:openspp.unread-->3<!--/fig--> not yet read. One rule produced 97 false positives
 along the way and has been rewritten because of them — that story is
@@ -609,15 +609,15 @@ Same principle as `z.infer<typeof Schema>`: one definition, derived artifacts, n
 | Recall under meaning-preserving rewrite | 79/79 |
 | Satisfied patterns bypassable by a comment | 0 of <!--fig:corpus.satisfied_patterns-->1<!--/fig--> |
 | Retrievable by their own probe | 27 of 27 at top 6, 25 of them at top 3 |
-| Hit rate on <!--fig:oca.lines-->33,960<!--/fig--> lines of reviewed OCA code | <!--fig:oca.rate-->2.9<!--/fig--> per 1000 lines: <!--fig:oca.findings-->99<!--/fig--> findings |
-| Those findings, read by hand | **<!--fig:oca.read.true-->83<!--/fig--> true positives**, <!--fig:oca.read.false-->6<!--/fig--> false, <!--fig:oca.read.undecidable-->7<!--/fig--> undecidable from one file, <!--fig:oca.unread-->3<!--/fig--> not yet read |
-| Hit rate on <!--fig:openspp.lines-->226,937<!--/fig--> lines of OpenSPP (Odoo 19) | <!--fig:openspp.rate-->0.7<!--/fig--> per 1000 lines: <!--fig:openspp.findings-->157<!--/fig--> findings, +<!--fig:openspp.decided-->127<!--/fig--> another tool had already flagged, +<!--fig:openspp.advisory-->82<!--/fig--> advisory |
-| Those findings, read by hand | **<!--fig:openspp.read.true-->134<!--/fig--> true positives**, <!--fig:openspp.read.false-->17<!--/fig--> false, <!--fig:openspp.read.undecidable-->3<!--/fig--> undecidable, <!--fig:openspp.unread-->3<!--/fig--> not yet read |
+| Hit rate on <!--fig:oca.lines-->33,960<!--/fig--> lines of reviewed OCA code | <!--fig:oca.rate-->3.0<!--/fig--> per 1000 lines: <!--fig:oca.findings-->101<!--/fig--> findings |
+| Those findings, read by hand | **<!--fig:oca.read.true-->85<!--/fig--> true positives**, <!--fig:oca.read.false-->6<!--/fig--> false, <!--fig:oca.read.undecidable-->7<!--/fig--> undecidable from one file, <!--fig:oca.unread-->3<!--/fig--> not yet read |
+| Hit rate on <!--fig:openspp.lines-->226,937<!--/fig--> lines of OpenSPP (Odoo 19) | <!--fig:openspp.rate-->0.7<!--/fig--> per 1000 lines: <!--fig:openspp.findings-->163<!--/fig--> findings, +<!--fig:openspp.decided-->127<!--/fig--> another tool had already flagged, +<!--fig:openspp.advisory-->82<!--/fig--> advisory |
+| Those findings, read by hand | **<!--fig:openspp.read.true-->140<!--/fig--> true positives**, <!--fig:openspp.read.false-->17<!--/fig--> false, <!--fig:openspp.read.undecidable-->3<!--/fig--> undecidable, <!--fig:openspp.unread-->3<!--/fig--> not yet read |
 | …the two `depends`/`constrains` rules alone | **<!--fig:cls.openspp.true-->87<!--/fig--> true**, <!--fig:cls.openspp.false-->15<!--/fig--> false, <!--fig:cls.openspp.undecidable-->3<!--/fig--> undecidable: <!--fig:cls.openspp.precision-->85<!--/fig-->% |
 | …the 8 composed-in Python rules alone | **<!--fig:cls.python.true-->9<!--/fig--> true**, <!--fig:cls.python.false-->42<!--/fig--> false: <!--fig:cls.python.precision-->18<!--/fig-->%, after 18 datetime verdicts were reversed: Odoo runs in UTC |
 | …`sudo-bypasses-record-rules` alone, before it was narrowed | <!--fig:cls.openspp-rest.sudo-bypasses-record-rules.true-->6<!--/fig--> true, <!--fig:cls.openspp-rest.sudo-bypasses-record-rules.false-->97<!--/fig--> false — 5.8%, and the reason it is now an AST pass |
-| Hit rate on <!--fig:core.lines-->559,663<!--/fig--> lines of odoo core 18.0 | <!--fig:core.rate-->4.2<!--/fig--> per 1000 lines: <!--fig:core.findings-->2,338<!--/fig--> findings, <!--fig:core.read-->89<!--/fig--> of them read by hand: <!--fig:core.read.true-->45<!--/fig--> true, <!--fig:core.read.false-->44<!--/fig--> false |
-| Hand-classified true positives still reported | **<!--fig:survival.found-->280<!--/fig--> of <!--fig:survival.true-->280<!--/fig-->**, across <!--fig:survival.artifacts-->9<!--/fig--> classifications |
+| Hit rate on <!--fig:core.lines-->559,663<!--/fig--> lines of odoo core 18.0 | <!--fig:core.rate-->4.2<!--/fig--> per 1000 lines: <!--fig:core.findings-->2,358<!--/fig--> findings, <!--fig:core.read-->89<!--/fig--> of them read by hand: <!--fig:core.read.true-->45<!--/fig--> true, <!--fig:core.read.false-->44<!--/fig--> false |
+| Hand-classified true positives still reported | **<!--fig:survival.found-->288<!--/fig--> of <!--fig:survival.true-->288<!--/fig-->**, across <!--fig:survival.artifacts-->9<!--/fig--> classifications |
 | **Recall against real Odoo bugfixes** | **<!--fig:recall.all.caught-->20<!--/fig--> of <!--fig:recall.all.in_scope-->334<!--/fig-->, <!--fig:recall.all.pct-->6<!--/fig-->%, across three ecosystems. See below.** |
 | Verdict stability, 12 questions x 5 runs | 12/12 same verdict every run |
 | Escalation rescued a bad draft | 11 of 21, 95% CI 32–72% |
@@ -743,8 +743,8 @@ files on a `float_compare` written somewhere else in them.
 The check that makes all of this safe is the same one every time, and it is worth
 stating as a number rather than a promise: across all
 <!--fig:survival.artifacts-->9<!--/fig--> classification artifacts,
-**<!--fig:survival.true-->280<!--/fig--> hand-classified true positives,
-<!--fig:survival.found-->280<!--/fig--> still found, none lost.** That is asserted by
+**<!--fig:survival.true-->288<!--/fig--> hand-classified true positives,
+<!--fig:survival.found-->288<!--/fig--> still found, none lost.** That is asserted by
 `python bin/figures.py --check`, which matches every `true` verdict to a finding in the
 committed fieldtest artifact for the same checkout at the same commit, and runs in CI.
 It is not done by reading the diff and hoping, and no longer by re-running against a
@@ -1055,7 +1055,7 @@ are now classified across the four rules that make 70% of them:
 | `stored-compute-needs-complete-depends` | **11/15** | 49/57 OCA |
 | `assert-is-not-validation` | **3/15** | 6/10 OCA |
 | `sudo-bypasses-record-rules` | **0/15** | 6 true on OpenSPP |
-| `constrains-must-list-every-field-read` | **<!--fig:cls.odoo-core.constrains-must-list-every-field-read.true-->10<!--/fig-->/15** | <!--fig:cls.openspp.constrains-must-list-every-field-read.true-->38<!--/fig-->/<!--fig:cls.openspp.constrains-must-list-every-field-read.rows-->45<!--/fig--> OpenSPP, <!--fig:cls.oca.constrains-must-list-every-field-read.true-->7<!--/fig-->/<!--fig:cls.oca.constrains-must-list-every-field-read.rows-->7<!--/fig--> OCA |
+| `constrains-must-list-every-field-read` | **<!--fig:cls.odoo-core.constrains-must-list-every-field-read.true-->10<!--/fig-->/15** | <!--fig:cls.openspp.constrains-must-list-every-field-read.true-->38<!--/fig-->/<!--fig:cls.openspp.constrains-must-list-every-field-read.rows-->45<!--/fig--> OpenSPP, <!--fig:cls.oca.constrains-must-list-every-field-read.true-->8<!--/fig-->/<!--fig:cls.oca.constrains-must-list-every-field-read.rows-->8<!--/fig--> OCA |
 | `depends-must-not-name-unread-fields` | **<!--fig:cls.odoo-core.depends-must-not-name-unread-fields.true-->5<!--/fig-->/15** | <!--fig:cls.openspp-rest.depends-must-not-name-unread-fields.true-->10<!--/fig-->/<!--fig:cls.openspp-rest.depends-must-not-name-unread-fields.rows-->11<!--/fig--> OpenSPP, <!--fig:cls.oca.depends-must-not-name-unread-fields.true-->3<!--/fig-->/<!--fig:cls.oca.depends-must-not-name-unread-fields.rows-->3<!--/fig--> OCA |
 | `naive-and-aware-datetimes-do-not-compare` | **<!--fig:cls.odoo-core.naive-and-aware-datetimes-do-not-compare.true-->0<!--/fig-->/15** | 3/33 after the re-read below |
 
@@ -1087,7 +1087,7 @@ Reading them turned up three more checker defects, all of the same family as the
 `sudo(False)` one above: a model with `_auto = False` is a SQL view with no foreign key,
 so `ondelete` is not a decision about it; `sudo(flag=False)` is de-escalation by
 keyword; and `x.sudo(self.env.su)` restores the ambient level and cannot raise
-privilege. Core is now **<!--fig:core.findings-->2,338<!--/fig--> findings at
+privilege. Core is now **<!--fig:core.findings-->2,358<!--/fig--> findings at
 <!--fig:core.rate-->4.2<!--/fig--> per 1000 lines**.
 
 One finding is worth acting on outside this project. Core's
@@ -1101,7 +1101,7 @@ Seven rules are now sampled on core, <!--fig:cls.odoo-core.rows-->105<!--/fig-->
 read, and the <!--fig:cls.sudo-core.rows-->45<!--/fig--> `sudo` findings a stricter
 re-scoping test added were read in full: <!--fig:cls.sudo-core.true-->1<!--/fig--> true,
 <!--fig:cls.sudo-core.false-->44<!--/fig--> false. Core makes
-<!--fig:core.findings-->2,338<!--/fig--> live ones. The rest stay unread,
+<!--fig:core.findings-->2,358<!--/fig--> live ones. The rest stay unread,
 and a rate on core is a statement about how often the rules fire there, not how often
 they are right.
 

bin/semantics.py

@@ -154,20 +154,45 @@ def _attr_path(node, aliases):
     rec.line_ids.price with rec bound to self yields ('line_ids', 'price').
     Returns None when the base is not something known to be self-derived, which
     is the honest answer for a name the checker never saw bound.
+
+    A chain may start from records picked by position. rec.line_ids[0].price and
+    rec.line_ids.sorted("sequence")[:1].price both yield ('line_ids', 'price'),
+    because indexing or slicing a recordset gives records of the same path.
+    Stopping at the subscript left the price unread, and a compute that takes
+    its value from the first line looked as if it read nothing from it.
     """
     segments = []
     cursor = node
     while isinstance(cursor, ast.Attribute):
         segments.append(cursor.attr)
         cursor = cursor.value
-    if not isinstance(cursor, ast.Name):
+    if isinstance(cursor, ast.Subscript) and _indexes_records(cursor):
+        base = _resolve_iterable(cursor.value, aliases)
+    elif isinstance(cursor, ast.Name):
+        base = aliases.get(cursor.id)
+    else:
         return None
-    base = aliases.get(cursor.id)
     if base is None:
         return None
     return base + tuple(reversed(segments))
 
 
+def _indexes_records(subscript):
+    """Does this subscript pick records by position: x[0], x[-1], x[1:]?
+
+    record[name] is the other thing a subscript on a recordset does, and it
+    reads the field called name, not records of the same path. So a subscript is
+    looked through only when its index is a literal integer or a slice.
+    rec.line_ids[i] could be either, and stays unresolved.
+    """
+    index = subscript.slice
+    if isinstance(index, ast.Slice):
+        return True
+    if isinstance(index, ast.UnaryOp) and isinstance(index.op, ast.USub):
+        index = index.operand
+    return isinstance(index, ast.Constant) and type(index.value) is int
+
+
 def _aliases(fn):
     """Names that stand for a recordset, and the path each reaches it by.
 
@@ -200,14 +225,17 @@ def _aliases(fn):
 def _resolve_iterable(node, aliases):
     """The recordset path an expression iterates over, if it is one.
 
-    Unwraps the calls that return a recordset of the same shape. mapped() is
-    excluded on purpose: it returns values, not records, and treating it as a
-    recordset would invent dependencies that do not exist.
+    Unwraps the calls that return a recordset of the same shape, and a subscript
+    by position, which picks records out of one. mapped() is excluded on
+    purpose: it returns values, not records, and treating it as a recordset
+    would invent dependencies that do not exist.
     """
     if isinstance(node, ast.Name):
         return aliases.get(node.id)
     if isinstance(node, ast.Attribute):
         return _attr_path(node, aliases)
+    if isinstance(node, ast.Subscript) and _indexes_records(node):
+        return _resolve_iterable(node.value, aliases)
     if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
         if node.func.attr in ("filtered", "sorted", "exists", "with_context", "sudo"):
             return _resolve_iterable(node.func.value, aliases)
@@ -325,8 +353,8 @@ def _field_reads(fn, aliases):
     return reads
 
 
-def _mapped_reads(fn, aliases):
-    """Field paths read through mapped() with a literal string, as (path, lineno).
+def _named_reads(fn, aliases):
+    """Field paths a recordset method names in a string, as (path, lineno).
 
     account.invoice_ids.mapped("amount_residual") reads invoice_ids.amount_residual
     exactly as sum(inv.amount_residual for inv in account.invoice_ids) does, but
@@ -334,35 +362,125 @@ def _mapped_reads(fn, aliases):
     first spelling looked fully declared by @api.depends("invoice_ids") and the
     second did not, so the checker was silent on the more idiomatic of the two.
 
-    Only a literal string is followed. mapped(lambda l: ...) and mapped(name)
-    stay unread: the fields a lambda touches or a variable holds are a guess
-    from here, and every guess in this checker is a finding somebody has to
-    read. The receiver resolves the way a loop's iterable does -- through
-    filtered(), sorted() and sudo() -- and a mapped() inside a raise or a log
-    line is phrasing a message, as it is for an attribute read.
+    mapped() was the first of these (ARCHITECTURE 3.66). Its siblings name what
+    they read the same way: filtered("a.b") tests a.b on every record,
+    grouped("f") keys on f, sorted("f") orders on f, and filtered_domain() reads
+    the field of every leaf written out in its domain. _named_paths says which
+    paths each call names.
+
+    Only literals are followed. filtered(lambda l: ...) and mapped(name) stay
+    unread: the fields a lambda touches or a variable holds are a guess from
+    here, and every guess in this checker is a finding somebody has to read.
+    The receiver resolves the way a loop's iterable does, through filtered(),
+    sorted(), sudo() and a subscript by position. A call inside a raise or a
+    log line is phrasing a message, as an attribute read there is.
     """
     quiet = _message_only_attrs(fn)
     reads = []
     for node in ast.walk(fn):
-        if not (isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute)
-                and node.func.attr == "mapped" and len(node.args) == 1
-                and not node.keywords) or id(node) in quiet:
+        if not (isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute)) \
+                or id(node) in quiet:
             continue
-        spec = node.args[0]
-        if not (isinstance(spec, ast.Constant) and isinstance(spec.value, str)):
-            continue
-        segments = tuple(spec.value.strip().split("."))
-        if not all(segment.isidentifier() for segment in segments):
+        named = _named_paths(node)
+        if not named:
             continue
         base = _resolve_iterable(node.func.value, aliases)
         if base is None:
             continue
-        path = base + segments
-        if path[0] not in ORM_ATTRS and not path[0].startswith("_"):
-            reads.append((path, node.lineno))
+        for segments in named:
+            path = base + segments
+            if path[0] not in ORM_ATTRS and not path[0].startswith("_"):
+                reads.append((path, node.lineno))
     return reads
 
 
+# Recordset methods whose one argument can be a field path. mapped("a.b") and
+# filtered("a.b") follow it through the relations; grouped("f") keys on f.
+PATH_ARGUMENT_METHODS = frozenset(["mapped", "filtered", "grouped"])
+
+
+def _named_paths(call):
+    """The field paths, relative to its receiver, that a recordset call names."""
+    method = call.func.attr
+    if method in PATH_ARGUMENT_METHODS:
+        if len(call.args) != 1 or call.keywords:
+            return []
+        path = _literal_path(call.args[0])
+        return [path] if path else []
+    if method == "sorted":
+        keys = list(call.args[:1]) + [k.value for k in call.keywords if k.arg == "key"]
+        if len(keys) == 1 and isinstance(keys[0], ast.Constant) \
+                and isinstance(keys[0].value, str):
+            return _order_fields(keys[0].value)
+        return []
+    if method == "filtered_domain":
+        if len(call.args) == 1 and not call.keywords \
+                and isinstance(call.args[0], (ast.List, ast.Tuple)):
+            return _domain_fields(call.args[0])
+    return []
+
+
+def _literal_path(node):
+    """('a', 'b') for the string literal "a.b"; None for anything else."""
+    if not (isinstance(node, ast.Constant) and isinstance(node.value, str)):
+        return None
+    return _path_segments(node.value)
+
+
+def _path_segments(text):
+    """('a', 'b') for "a.b"; None when the text is not a dotted field path."""
+    segments = tuple(text.strip().split("."))
+    return segments if all(segment.isidentifier() for segment in segments) else None
+
+
+ORDER_WORDS = frozenset(["asc", "desc", "nulls", "first", "last"])
+
+
+def _order_fields(spec):
+    """The field paths an order sorts on: "date desc, id" names date and id.
+
+    Odoo 18 takes one field name here, as itemgetter(key). Odoo 19 takes an
+    order: comma-separated terms, each a field with an optional .property and
+    :granularity, then asc or desc and nulls first or last
+    (_sorted_order_to_function in odoo/orm/models.py, 19.0). A spec with any
+    other word in it is read not at all rather than in part.
+    """
+    paths = []
+    for term in spec.split(","):
+        words = term.split()
+        if not words or any(word.lower() not in ORDER_WORDS for word in words[1:]):
+            return []
+        path = _path_segments(words[0].split(":")[0])
+        if path is None:
+            return []
+        paths.append(path)
+    return paths
+
+
+def _domain_fields(domain):
+    """The field path of every leaf a domain literal writes out.
+
+    [("state", "=", "done"), ("partner_id.country_id", "in", ids)] names state and
+    partner_id.country_id. A leaf whose operator is any or not any holds a
+    domain on the related records, read through the leaf's own field:
+    ("line_ids", "any", [("paid", "=", True)]) names line_ids and line_ids.paid.
+    "&", "|" and "!" name nothing, and neither does a leaf built at run time.
+    """
+    paths = []
+    for leaf in domain.elts:
+        if not (isinstance(leaf, (ast.Tuple, ast.List)) and len(leaf.elts) == 3):
+            continue
+        field, operator, value = leaf.elts
+        path = _literal_path(field)
+        if path is None:
+            continue
+        paths.append(path)
+        if isinstance(operator, ast.Constant) and operator.value in ("any", "not any") \
+                and isinstance(value, (ast.List, ast.Tuple)):
+            paths.extend(path + inner for inner in _domain_fields(value))
+    return paths
+
+
 # A decorator that is present and cannot be read statically is neither absent
 # nor empty. @api.constrains(*FIELDS) used to collapse into "declares nothing",
 # which made every field the body reads a missing declaration and phrased it
@@ -445,6 +563,14 @@ def constrains_lists_every_field_read(code, gaps=None):
     asymmetry with @api.depends is its own rule
     (odoo.constrains-ignores-dotted-names, constrains_declares_a_dotted_name
     below); this checker only respects it.
+
+    Reads are the ones the depends check makes: attribute accesses, including
+    one after a subscript by position, and the fields a recordset method names
+    in a string (_named_reads). `if any(self.mapped("date_end"))` under
+    @api.constrains("date_start") was silent. Measured before it was taken: OCA
+    +1, OpenSPP 0, core +3, all read, 3 true. The false one filters on a
+    non-stored compute, which @api.constrains cannot name: a class this rule
+    already had for attribute reads (ARCHITECTURE 3.71).
     """
     tree, _ = parse_python(code)
     if tree is None:
@@ -459,7 +585,8 @@ def constrains_lists_every_field_read(code, gaps=None):
             continue
         registered = {d.split(".")[0] for d in declared}
         missing = {}
-        for path, lineno in _field_reads(fn, _aliases(fn)):
+        aliases = _aliases(fn)
+        for path, lineno in _field_reads(fn, aliases) + _named_reads(fn, aliases):
             if path[0] not in registered:
                 missing.setdefault(path[0], lineno)
         names = ", ".join(sorted(registered))
@@ -594,11 +721,15 @@ def depends_covers_compute_reads(code, gaps=None):
     file's evidence is used when it exists and the rule's assumption stands when
     it does not: proven-not-stored is dropped, unknown stays a finding.
 
-    Reads are attribute accesses plus mapped() with a literal path
-    (_mapped_reads), and every exemption above applies to both. Before that,
-    sum(rec.invoice_ids.mapped("amount_residual")) under a bare
+    Reads are attribute accesses plus the fields a recordset method names in a
+    string (_named_reads), and every exemption above applies to both. mapped()
+    came first: sum(rec.invoice_ids.mapped("amount_residual")) under a bare
     @api.depends("invoice_ids") was silent while the same read spelled as a
-    generator was reported. Core 2,336 -> 2,345; all 9 read, 8 true.
+    generator was reported. Core 2,336 -> 2,345; all 9 read, 8 true. filtered(),
+    sorted(), grouped() and filtered_domain() followed, with a read after a
+    subscript by position (rec.line_ids[0].amount, _attr_path): OCA +1, OpenSPP
+    +6, core +17, all 24 read, 15 true. The 9 false are classes this checker
+    already had for attribute reads (ARCHITECTURE 3.71).
     """
     tree, _ = parse_python(code)
     if tree is None:
@@ -643,7 +774,7 @@ def depends_covers_compute_reads(code, gaps=None):
             continue
         missing = {}
         aliases = _aliases(fn)
-        for path, lineno in _field_reads(fn, aliases) + _mapped_reads(fn, aliases):
+        for path, lineno in _field_reads(fn, aliases) + _named_reads(fn, aliases):
             while len(path) > 1 and path[-1] in ORM_ATTRS:
                 path = path[:-1]
             if path[0] in produced:
@@ -2070,7 +2201,9 @@ def depends_names_unread_fields(code):
       depends_covers_compute_reads -- reporting it twice from opposite
       directions is two findings about one confusion. It is also how a compute
       reading another stored compute looks from here, and those declare the
-      upstream source on purpose.
+      upstream source on purpose. "Reads" here are the ones that rule makes,
+      fields named in a string (_named_reads) among them, so the two agree
+      about what the body reads.
     """
     tree, _ = parse_python(code)
     if tree is None:
@@ -2089,7 +2222,8 @@ def depends_names_unread_fields(code):
             # file cannot tell intent, so that shape stays a finding.
             continue
         aliases = _aliases(fn)
-        read = set(".".join(path) for path, _ in _field_reads(fn, aliases))
+        read = set(".".join(path) for path, _ in
+                   _field_reads(fn, aliases) + _named_reads(fn, aliases))
         produced = set(_assigned_attrs(fn))
         if _reads_outside_the_declarations(read - produced, declared):
             continue

classification-oca-2026-09.json

@@ -13,7 +13,7 @@
  },
  "totals": {
   "false": 11,
-  "true": 78,
+  "true": 80,
   "undecidable": 13
  },
  "classes": {
@@ -944,7 +944,25 @@
    "class": "registry-model",
    "why": "search_read on ir.model.fields, which has no company_id and so no tenant boundary",
    "evidence": null
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_name_sequence/models/account_move.py",
+   "line": 106,
+   "verdict": "true",
+   "class": null,
+   "why": "made_sequence_gap is stored in account and set to False here for moves outside a hashed journal, and neither this decorator nor account's own names journal_id.restrict_mode_hash_table (Odoo merges the two). Securing a journal leaves its existing moves on False.",
+   "evidence": "_compute_made_sequence_gap() reads 'journal_id.restrict_mode_hash_table' but @api.depends does not declare it -- the stored value goes stale when 'journal_id.restrict_mode_hash_table' changes"
+  },
+  {
+   "rule": "odoo.constrains-must-list-every-field-read",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 303,
+   "verdict": "true",
+   "class": null,
+   "why": "the check reads the moves reached through line_ids and declares only journal_id, so a write of line_ids alone is not checked. True as the rule states it; every move the module creates for a line takes the spread's own journal.",
+   "evidence": "_check_journal() reads 'line_ids' but @api.constrains declares only journal_id -- writing 'line_ids' alone skips the check entirely"
   }
  ],
- "note": "Re-measured after sudo-bypasses-record-rules became an AST pass and suppression learned to read a marker across the statement it sits in. Three findings are new: the AST pass also sees .sudo().search_count( and .sudo().search_read(, which the regex could not, and all three are false. One false positive left -- a sql-needs-query-parameters in base_multi_image/hooks.py that carries a marker on the line above it. All 79 true positives survived both changes.\n\n2026-09-26: 1 recursion-check-on-hierarchy verdict(s) reversed from true to false, class parent-store-refuses-the-cycle. Reading spp_area behind a true verdict showed the model sets _parent_store = True, which makes the ORM refuse the cycle itself; every other true verdict for the rule was checked the same way. The rule moved to an AST pass (semantics.parent_can_form_a_cycle) that asks whether the field points at its own model and whether _parent_store already guards it. Each reversed row keeps was: true."
+ "note": "Re-measured after sudo-bypasses-record-rules became an AST pass and suppression learned to read a marker across the statement it sits in. Three findings are new: the AST pass also sees .sudo().search_count( and .sudo().search_read(, which the regex could not, and all three are false. One false positive left -- a sql-needs-query-parameters in base_multi_image/hooks.py that carries a marker on the line above it. All 79 true positives survived both changes.\n\n2026-09-26: 1 recursion-check-on-hierarchy verdict(s) reversed from true to false, class parent-store-refuses-the-cycle. Reading spp_area behind a true verdict showed the model sets _parent_store = True, which makes the ORM refuse the cycle itself; every other true verdict for the rule was checked the same way. The rule moved to an AST pass (semantics.parent_can_form_a_cycle) that asks whether the field points at its own model and whether _parent_store already guards it. Each reversed row keeps was: true.\n\n2026-09-27: 2 findings added and read, both true, surfaced when the depends and constrains checks started reading the fields a recordset method names in a string (ARCHITECTURE 3.71): account_move_name_sequence filters on journal_id.restrict_mode_hash_table, and account_spread_cost_revenue's journal check reads mapped(\"line_ids.move_id\")."
 }

classification-openspp-rest-2026-09.json

@@ -11,7 +11,7 @@
  "files": 1351,
  "lines": 226937,
  "totals": {
-  "true": 49,
+  "true": 55,
   "false": 115,
   "undecidable": 3
  },
@@ -49,6 +49,9 @@
   },
   "odoo.commit-inside-a-loop-splits-the-transaction": {
    "true": 1
+  },
+  "odoo.stored-compute-needs-complete-depends": {
+   "true": 6
   }
  },
  "false_classes": {
@@ -1677,8 +1680,62 @@
    "verdict": "true",
    "class": null,
    "why": "one head per group is checked here and in the group's write(); spp_change_request_v2's add_member creates memberships directly, past both"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "spp_approval/models/approval_review_multitier.py",
+   "line": 53,
+   "evidence": "_compute_current_tier() reads 'tier_review_ids.sequence' but @api.depends does not declare it -- the stored value goes stale when 'tier_review_ids.seq",
+   "verdict": "true",
+   "class": null,
+   "why": "current_tier_id is stored and takes the first pending tier by sequence, and the decorator names only tier_review_ids.status. A tier review's sequence is a stored related of its tier's, so reordering a definition's tiers while reviews are pending leaves each review on the tier the old order put first."
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "spp_programs/models/registrant.py",
+   "line": 54,
+   "evidence": "_compute_cycle_membership_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' chang",
+   "verdict": "true",
+   "class": null,
+   "why": "the stored count is set to 0 for every partner self.filtered(\"is_registrant\") leaves out, and the decorator does not name is_registrant, so a partner whose flag changes keeps the count it had. True as the rule states it; every create path in the tree sets is_registrant at creation and nothing rewrites it."
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "spp_programs/models/registrant.py",
+   "line": 96,
+   "evidence": "_compute_program_membership_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' cha",
+   "verdict": "true",
+   "class": null,
+   "why": "the stored count is set to 0 for every partner self.filtered(\"is_registrant\") leaves out, and the decorator does not name is_registrant, so a partner whose flag changes keeps the count it had. True as the rule states it; every create path in the tree sets is_registrant at creation and nothing rewrites it."
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "spp_programs/models/registrant.py",
+   "line": 121,
+   "evidence": "_compute_entitlements_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' changes",
+   "verdict": "true",
+   "class": null,
+   "why": "the stored count is set to 0 for every partner self.filtered(\"is_registrant\") leaves out, and the decorator does not name is_registrant, so a partner whose flag changes keeps the count it had. True as the rule states it; every create path in the tree sets is_registrant at creation and nothing rewrites it."
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "spp_programs/models/registrant.py",
+   "line": 146,
+   "evidence": "_compute_cycle_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' changes",
+   "verdict": "true",
+   "class": null,
+   "why": "the stored count is set to 0 for every partner self.filtered(\"is_registrant\") leaves out, and the decorator does not name is_registrant, so a partner whose flag changes keeps the count it had. True as the rule states it; every create path in the tree sets is_registrant at creation and nothing rewrites it."
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "spp_programs/models/registrant.py",
+   "line": 171,
+   "evidence": "_compute_inkind_entitlements_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' ch",
+   "verdict": "true",
+   "class": null,
+   "why": "the stored count is set to 0 for every partner self.filtered(\"is_registrant\") leaves out, and the decorator does not name is_registrant, so a partner whose flag changes keeps the count it had. True as the rule states it; every create path in the tree sets is_registrant at creation and nothing rewrites it."
   }
  ],
- "what_this_changed": "sudo-bypasses-record-rules went 6 true / 97 false / 3 undecidable, 5.8%. 73 of the 97 were on models the tree gives no ir.rule at all and 10 on a model whose only rule is [(1,'=',1)], so sudo dropped nothing at 83 of 106 sites. The rule is now an AST pass that asks the tree whether a filtering rule exists, and answers UNKNOWN -- keeping the finding -- for any model the walk did not see declared. The 14 remaining false positives constrain the search by hand to records the caller already named, in a spelling the rule does not recognise because it names only company_id. That is a worklist entry, not a narrowing: deciding a domain is already scoped means evaluating it.\n\n2026-09-26: 5 recursion-check-on-hierarchy verdict(s) reversed from true to false, class parent-store-refuses-the-cycle. Reading spp_area behind a true verdict showed the model sets _parent_store = True, which makes the ORM refuse the cycle itself; every other true verdict for the rule was checked the same way. The rule moved to an AST pass (semantics.parent_can_form_a_cycle) that asks whether the field points at its own model and whether _parent_store already guards it. Each reversed row keeps was: true.\n\n2026-09-27: 4 onchange-is-not-validation findings added and read, surfaced when the checker stopped letting any constraint in the file clear it and started asking whether a constraint covers a field the onchange watches (ARCHITECTURE 3.68). 3 true, 1 false (backed-by-the-parent-constraint).",
+ "what_this_changed": "sudo-bypasses-record-rules went 6 true / 97 false / 3 undecidable, 5.8%. 73 of the 97 were on models the tree gives no ir.rule at all and 10 on a model whose only rule is [(1,'=',1)], so sudo dropped nothing at 83 of 106 sites. The rule is now an AST pass that asks the tree whether a filtering rule exists, and answers UNKNOWN -- keeping the finding -- for any model the walk did not see declared. The 14 remaining false positives constrain the search by hand to records the caller already named, in a spelling the rule does not recognise because it names only company_id. That is a worklist entry, not a narrowing: deciding a domain is already scoped means evaluating it.\n\n2026-09-26: 5 recursion-check-on-hierarchy verdict(s) reversed from true to false, class parent-store-refuses-the-cycle. Reading spp_area behind a true verdict showed the model sets _parent_store = True, which makes the ORM refuse the cycle itself; every other true verdict for the rule was checked the same way. The rule moved to an AST pass (semantics.parent_can_form_a_cycle) that asks whether the field points at its own model and whether _parent_store already guards it. Each reversed row keeps was: true.\n\n2026-09-27: 4 onchange-is-not-validation findings added and read, surfaced when the checker stopped letting any constraint in the file clear it and started asking whether a constraint covers a field the onchange watches (ARCHITECTURE 3.68). 3 true, 1 false (backed-by-the-parent-constraint).\n\n2026-09-27: 6 stored-compute-needs-complete-depends findings added and read, surfaced when the depends check started reading the fields a recordset method names in a string (filtered(\"is_registrant\"), sorted(\"sequence\")) as it already read mapped(\"a.b\") (ARCHITECTURE 3.71). All 6 true. They are recorded here, with the other findings later changes surfaced, rather than in classification-openspp-2026-09.json, which is the reading of the two flagship rules made on 2026-09-16 and is quoted as that reading.",
  "worklist": "float-comparison-needs-float-utils is the next one down at 2 true / 5 false. All five compare an INTEGER to zero -- search_count, a read_group _count, SELECT COUNT(*) -- which the regex cannot see because it matches on the variable's name. Fixing it means tracing the assignment, so it is named here and not yet done. onchange-is-not-validation is 4 true / 3 false, and all three false ones are an onchange that sets a field rather than enforcing anything, which the rule's existing narrowing was supposed to exclude and does not catch when the write is to a Many2one."
 }

fieldtest-oca-2026-09.json

@@ -1,5 +1,5 @@
 {
-  "generated_utc": "2026-09-27T16:00:57+00:00",
+  "generated_utc": "2026-09-27T16:45:43+00:00",
   "stack": "odoo",
   "roots": [
     "server-tools",
@@ -873,6 +873,16 @@
       "likelihood": "unproven",
       "path": "account-financial-tools/account_move_name_sequence/models/account_journal.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 106,
+      "evidence": "_compute_made_sequence_gap() reads 'journal_id.restrict_mode_hash_table' but @api.depends does not declare it -- the stored value goes stale when 'journal_id.restrict_mode_hash_table' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_name_sequence/models/account_move.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -1083,6 +1093,16 @@
       "likelihood": "construct",
       "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
     },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 303,
+      "evidence": "_check_journal() reads 'line_ids' but @api.constrains declares only journal_id -- writing 'line_ids' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
     {
       "rule": "odoo.float-comparison-needs-float-utils",
       "severity": "high",

fieldtest-odoo-core-2026-09.json

@@ -1,5 +1,5 @@
 {
-  "generated_utc": "2026-09-27T16:18:40+00:00",
+  "generated_utc": "2026-09-27T16:53:36+00:00",
   "stack": "odoo",
   "roots": [
     "odoo"
@@ -1651,6 +1651,16 @@
       "likelihood": "construct",
       "path": "addons/account/models/account_payment_term.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 356,
+      "evidence": "_compute_days() reads 'payment_id.line_ids.nb_days' but @api.depends does not declare it -- the stored value goes stale when 'payment_id.line_ids.nb_days' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/account/models/account_payment_term.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -2971,6 +2981,16 @@
       "likelihood": "unmeasured",
       "path": "addons/base_automation/models/base_automation.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 42,
+      "evidence": "_compute_name() reads 'base_automation_id' but @api.depends does not declare it -- the stored value goes stale when 'base_automation_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/base_automation/models/ir_actions_server.py"
+    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",
@@ -2981,6 +3001,16 @@
       "likelihood": "construct",
       "path": "addons/base_iban/models/res_partner_bank.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 55,
+      "evidence": "_get_icon_image() reads 'imported' but @api.depends does not declare it -- the stored value goes stale when 'imported' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/base_import_module/models/ir_module.py"
+    },
     {
       "rule": "python.assert-is-not-validation",
       "severity": "critical",
@@ -5201,6 +5231,16 @@
       "likelihood": "construct",
       "path": "addons/hr_expense/models/hr_expense.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 318,
+      "evidence": "_compute_total_amount_currency() reads 'product_has_cost' but @api.depends does not declare it -- the stored value goes stale when 'product_has_cost' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/hr_expense/models/hr_expense.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -5421,6 +5461,16 @@
       "likelihood": "construct",
       "path": "addons/hr_expense/models/hr_expense_sheet.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 246,
+      "evidence": "_compute_from_account_move_ids() reads 'account_move_ids.reversal_move_ids' but @api.depends does not declare it -- the stored value goes stale when 'account_move_ids.reversal_move_ids' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/hr_expense/models/hr_expense_sheet.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -5831,6 +5881,16 @@
       "likelihood": "unproven",
       "path": "addons/hr_holidays/models/hr_leave.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 114,
+      "evidence": "_compute_added_value_type() reads 'level_ids.added_value_type' but @api.depends does not declare it -- the stored value goes stale when 'level_ids.added_value_type' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/hr_holidays/models/hr_leave_accrual_plan.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -5841,6 +5901,16 @@
       "likelihood": "construct",
       "path": "addons/hr_holidays/models/hr_leave_accrual_plan_level.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 186,
+      "evidence": "_compute_added_value_type() reads 'accrual_plan_id.level_ids.added_value_type' but @api.depends does not declare it -- the stored value goes stale when 'accrual_plan_id.level_ids.added_value_type' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/hr_holidays/models/hr_leave_accrual_plan_level.py"
+    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -6031,6 +6101,16 @@
       "likelihood": "unproven",
       "path": "addons/hr_holidays_attendance/models/hr_leave_allocation.py"
     },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 63,
+      "evidence": "_check_contracts() reads 'employee_id' but @api.constrains declares only date_from, date_to -- writing 'employee_id' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/hr_holidays_contract/models/hr_leave.py"
+    },
     {
       "rule": "odoo.depends-must-not-name-unread-fields",
       "severity": "medium",
@@ -8141,6 +8221,16 @@
       "likelihood": "unmeasured",
       "path": "addons/l10n_id_efaktur/models/efaktur_document.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 293,
+      "evidence": "_compute_name() reads 'invoice_ids.name' but @api.depends does not declare it -- the stored value goes stale when 'invoice_ids.name' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/l10n_id_efaktur/models/efaktur_document.py"
+    },
     {
       "rule": "python.assert-is-not-validation",
       "severity": "critical",
@@ -8181,6 +8271,16 @@
       "likelihood": "construct",
       "path": "addons/l10n_id_efaktur_coretax/models/account_move.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 30,
+      "evidence": "_compute_name() reads 'invoice_ids.name' but @api.depends does not declare it -- the stored value goes stale when 'invoice_ids.name' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/l10n_id_efaktur_coretax/models/efaktur_document.py"
+    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -9151,6 +9251,16 @@
       "likelihood": "construct",
       "path": "addons/l10n_latam_check/models/l10n_latam_check.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 146,
+      "evidence": "_compute_highest_name() reads 'l10n_latam_manual_document_number' but @api.depends does not declare it -- the stored value goes stale when 'l10n_latam_manual_document_number' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/l10n_latam_invoice_document/models/account_move.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -11191,6 +11301,16 @@
       "likelihood": "unmeasured",
       "path": "addons/mail/wizard/mail_activity_schedule.py"
     },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 201,
+      "evidence": "_check_consistency() reads 'error' but @api.constrains declares only activity_type_id, activity_user_id, plan_id, plan_on_demand_user_id, res_ids, res_model_id -- writing 'error' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/mail/wizard/mail_activity_schedule.py"
+    },
     {
       "rule": "odoo.commit-inside-a-loop-splits-the-transaction",
       "severity": "high",
@@ -13511,6 +13631,26 @@
       "likelihood": "unmeasured",
       "path": "addons/point_of_sale/models/pos_session.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 291,
+      "evidence": "_compute_cash_journal() reads 'payment_method_ids.is_cash_count' but @api.depends does not declare it -- the stored value goes stale when 'payment_method_ids.is_cash_count' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/point_of_sale/models/pos_session.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 291,
+      "evidence": "_compute_cash_journal() reads 'payment_method_ids.journal_id' but @api.depends does not declare it -- the stored value goes stale when 'payment_method_ids.journal_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/point_of_sale/models/pos_session.py"
+    },
     {
       "rule": "odoo.prefer-sql-constraint",
       "severity": "high",
@@ -13581,6 +13721,16 @@
       "likelihood": "unproven",
       "path": "addons/point_of_sale/models/pos_session.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 31,
+      "evidence": "_compute_color() reads 'pos_categ_ids.color' but @api.depends does not declare it -- the stored value goes stale when 'pos_categ_ids.color' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/point_of_sale/models/product.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -17191,6 +17341,16 @@
       "likelihood": "defect",
       "path": "addons/sale_crm/models/sale_order.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 12,
+      "evidence": "_compute_purchase_price() reads 'expense_id' but @api.depends does not declare it -- the stored value goes stale when 'expense_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/sale_expense_margin/models/sale_order_line.py"
+    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -18401,6 +18561,16 @@
       "likelihood": "construct",
       "path": "addons/sale_timesheet/models/hr_timesheet.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 163,
+      "evidence": "_compute_partner_id() reads 'allow_billable' but @api.depends does not declare it -- the stored value goes stale when 'allow_billable' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/sale_timesheet/models/project_project.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -20011,6 +20181,16 @@
       "likelihood": "unmeasured",
       "path": "addons/stock/models/stock_scrap.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 100,
+      "evidence": "_compute_scrap_qty() reads 'move_ids.quantity' but @api.depends does not declare it -- the stored value goes stale when 'move_ids.quantity' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/stock/models/stock_scrap.py"
+    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -22381,6 +22561,16 @@
       "likelihood": "construct",
       "path": "addons/website_sale_gelato/models/product_document.py"
     },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 14,
+      "evidence": "_check_print_images_are_set_before_publishing() reads 'gelato_template_ref' but @api.constrains declares only is_published -- writing 'gelato_template_ref' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/website_sale_gelato/models/product_template.py"
+    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",
@@ -22671,6 +22861,16 @@
       "likelihood": "construct",
       "path": "addons/website_slides/models/slide_slide.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 384,
+      "evidence": "_compute_slides_statistics() reads 'is_category' but @api.depends does not declare it -- the stored value goes stale when 'is_category' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "addons/website_slides/models/slide_slide.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",

fieldtest-openspp-2026-09.json

@@ -1,5 +1,5 @@
 {
-  "generated_utc": "2026-09-27T16:05:31+00:00",
+  "generated_utc": "2026-09-27T16:45:07+00:00",
   "stack": "odoo",
   "roots": [
     "OpenSPP2-19.0"
@@ -811,6 +811,16 @@
       "likelihood": "construct",
       "path": "spp_approval/models/approval_review_multitier.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 53,
+      "evidence": "_compute_current_tier() reads 'tier_review_ids.sequence' but @api.depends does not declare it -- the stored value goes stale when 'tier_review_ids.sequence' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "spp_approval/models/approval_review_multitier.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -2971,6 +2981,56 @@
       "likelihood": "unproven",
       "path": "spp_programs/models/programs.py"
     },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 54,
+      "evidence": "_compute_cycle_membership_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "spp_programs/models/registrant.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 96,
+      "evidence": "_compute_program_membership_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "spp_programs/models/registrant.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 121,
+      "evidence": "_compute_entitlements_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "spp_programs/models/registrant.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 146,
+      "evidence": "_compute_cycle_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "spp_programs/models/registrant.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 171,
+      "evidence": "_compute_inkind_entitlements_count() reads 'is_registrant' but @api.depends does not declare it -- the stored value goes stale when 'is_registrant' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "spp_programs/models/registrant.py"
+    },
     {
       "rule": "odoo.sql-needs-query-parameters",
       "severity": "critical",

tests/test_semantics.py

@@ -432,6 +432,186 @@ def test_a_mapped_lambda_or_name_is_not_guessed():
         assert semantics.run_check("depends_covers_compute_reads", code) == [], call
 
 
+# mapped()'s siblings name what they read the same way, and were silent after
+# it was not. Each call below reads the paths beside it, relative to
+# invoice_ids; a trailing id names the relation and is never asked for.
+NAMED_READS = [
+    ('filtered("is_paid")', ["is_paid"]),
+    ('filtered("partner_id.is_company")', ["partner_id.is_company"]),
+    ('grouped("journal_id")', ["journal_id"]),
+    ('sorted("sequence")', ["sequence"]),
+    ('sorted(key="sequence", reverse=True)', ["sequence"]),
+    ('sorted("date desc, id")', ["date"]),
+    ('sorted("partner_id.name DESC NULLS LAST, date:month")', ["partner_id.name", "date"]),
+    ('filtered_domain([("state", "=", "done"), "|", (1, "=", 1), '
+     '("partner_id.id", "=", 7)])', ["partner_id", "state"]),
+    ('filtered_domain([("line_ids", "any", [("paid", "=", True)])])',
+     ["line_ids", "line_ids.paid"]),
+]
+
+
+@pytest.mark.parametrize("call, reads", NAMED_READS)
+def test_a_field_named_in_a_string_is_a_read_the_depends_must_declare(call, reads):
+    code = MAPPED_COMPUTE.format(declared='"invoice_ids"', call=call)
+    hits = semantics.run_check("depends_covers_compute_reads", code)
+    reported = sorted(message.split("'")[1] for _, message, _ in hits)
+    assert reported == sorted("invoice_ids." + read for read in reads), hits
+
+
+@pytest.mark.parametrize("call, reads", NAMED_READS)
+def test_a_field_named_in_a_string_the_depends_declares_is_quiet(call, reads):
+    declared = ", ".join('"invoice_ids.{0}"'.format(read) for read in reads)
+    code = MAPPED_COMPUTE.format(declared=declared, call=call)
+    assert semantics.run_check("depends_covers_compute_reads", code) == []
+
+
+@pytest.mark.parametrize("call", [
+    "filtered(lambda i: i.is_paid)",
+    "sorted(key=lambda i: i.sequence)",
+    "sorted(ORDER)",
+    "grouped(KEY)",
+    "filtered_domain(DOMAIN)",
+    "filtered_domain(DOMAIN + [LEAF])",
+    'sorted("date desc limit 1")',
+    'filtered("line_ids[0]")',
+])
+def test_a_field_not_written_as_a_literal_is_not_guessed(call):
+    code = MAPPED_COMPUTE.format(declared='"invoice_ids"', call=call)
+    assert semantics.run_check("depends_covers_compute_reads", code) == [], call
+
+
+NAMED_EXEMPT = """{head}
+    @api.depends("invoice_ids", "line_ids.partner_id.name")
+    def _compute_total(self):
+        for rec in self:
+            {body}
+"""
+
+
+@pytest.mark.parametrize("head, body", [
+    # declared as a longer path: line_ids.partner_id.name covers line_ids.partner_id
+    ("class A(models.Model):", 'rec.total = rec.line_ids.filtered("partner_id")'),
+    # the field this method computes
+    ("class A(models.Model):", 'rec.total = rec.filtered("total") and 1'),
+    # a non-stored compute
+    ('class A(models.Model):\n    total = fields.Float(compute="_compute_total")',
+     'rec.total = len(rec.invoice_ids.filtered("is_paid"))'),
+    # a wizard
+    ("class A(models.TransientModel):",
+     'rec.total = len(rec.invoice_ids.filtered("is_paid"))'),
+    # phrasing a message
+    ("class A(models.Model):",
+     'raise UserError(rec.invoice_ids.filtered("is_paid").mapped("name"))'),
+    ("class A(models.Model):",
+     '_logger.info("%s", rec.invoice_ids.sorted("date")[:1].name)'),
+])
+def test_a_field_named_in_a_string_keeps_the_checkers_exemptions(head, body):
+    code = NAMED_EXEMPT.format(head=head, body=body)
+    assert semantics.run_check("depends_covers_compute_reads", code) == [], body
+
+
+def test_a_named_display_name_override_is_left_alone():
+    code = """@api.depends("invoice_ids")
+def _compute_display_name(self):
+    for rec in self:
+        rec.display_name = ", ".join(rec.invoice_ids.sorted("date").mapped("name"))
+"""
+    assert semantics.run_check("depends_covers_compute_reads", code) == []
+
+
+# A subscript stopped the path. rec.line_ids[0].amount read nothing past
+# line_ids, so a compute taking its value from the first line looked declared.
+SUBSCRIPT_COMPUTE = """@api.depends({declared})
+def _compute_first(self):
+    for rec in self:
+        rec.first = {read}
+"""
+
+
+@pytest.mark.parametrize("read, path", [
+    ("rec.line_ids[0].amount", "line_ids.amount"),
+    ("rec.line_ids[-1].amount", "line_ids.amount"),
+    ("rec.line_ids[1:3].amount", "line_ids.amount"),
+    ("rec.line_ids.filtered(lambda l: l.paid)[:1].amount", "line_ids.amount"),
+    ("self[0].line_ids.amount", "line_ids.amount"),
+    ('rec.line_ids[:1].mapped("amount")', "line_ids.amount"),
+])
+def test_a_read_after_a_subscript_by_position_is_a_read(read, path):
+    code = SUBSCRIPT_COMPUTE.format(declared='"line_ids"', read=read)
+    hits = semantics.run_check("depends_covers_compute_reads", code)
+    assert ["'{0}'".format(path) in message for _, message, _ in hits] == [True], hits
+    code = SUBSCRIPT_COMPUTE.format(declared='"{0}"'.format(path), read=read)
+    assert semantics.run_check("depends_covers_compute_reads", code) == [], read
+
+
+def test_a_subscript_reads_every_segment_of_the_chain_after_it():
+    """rec.partner_id.child_ids[:1].email reported partner_id.child_ids and
+    never the email, which is the field whose change goes unnoticed."""
+    code = SUBSCRIPT_COMPUTE.format(declared='"partner_id"',
+                                    read="rec.partner_id.child_ids[:1].email")
+    hits = semantics.run_check("depends_covers_compute_reads", code)
+    assert sorted(message.split("'")[1] for _, message, _ in hits) == [
+        "partner_id.child_ids", "partner_id.child_ids.email"], hits
+
+
+def test_a_loop_over_a_slice_binds_the_same_path():
+    code = """@api.depends("line_ids")
+def _compute_rest(self):
+    for rec in self:
+        for line in rec.line_ids.sorted("sequence")[1:]:
+            rec.rest += line.discount
+"""
+    hits = semantics.run_check("depends_covers_compute_reads", code)
+    assert sorted(message.split("'")[1] for _, message, _ in hits) == [
+        "line_ids.discount", "line_ids.sequence"], hits
+
+
+@pytest.mark.parametrize("read", [
+    "rec[fname].name",            # a field read by name, not records by position
+    "rec.line_ids[i].amount",     # a name could hold either
+    'rec["partner_id"].name',
+    "rec.line_ids[0].id",         # the relation itself, which is declared
+])
+def test_a_subscript_that_does_not_pick_records_by_position_is_not_followed(read):
+    code = SUBSCRIPT_COMPUTE.format(declared='"line_ids"', read=read)
+    assert semantics.run_check("depends_covers_compute_reads", code) == [], read
+
+
+# A constraint reads a field through a string as a compute does, and writing
+# that field alone skips the check. Only the root is compared, as for every
+# other read here: @api.constrains cannot follow a dotted name.
+NAMED_CONSTRAINT = """@api.constrains({declared})
+def _check_dates(self):
+    {body}
+"""
+
+
+@pytest.mark.parametrize("body, root", [
+    ('if any(self.mapped("date_end")):\n        raise ValidationError("x")', "date_end"),
+    ('for rec in self.filtered("active"):\n        rec._check()', "active"),
+    ('if self.sorted("sequence")[:1].date_start:\n        raise ValidationError("x")',
+     "sequence"),
+    ('if self.filtered_domain([("state", "=", "done")]):\n        raise ValidationError("x")',
+     "state"),
+    ('if self[0].code:\n        raise ValidationError("x")', "code"),
+    ('for spread in self:\n        moves = spread.mapped("line_ids.move_id")', "line_ids"),
+])
+def test_a_constraint_reading_a_field_through_a_string_must_list_it(body, root):
+    code = NAMED_CONSTRAINT.format(declared='"date_start"', body=body)
+    hits = semantics.run_check("constrains_lists_every_field_read", code)
+    assert ["reads '{0}'".format(root) in message for _, message, _ in hits] == [True], hits
+    code = NAMED_CONSTRAINT.format(declared='"date_start", "{0}"'.format(root), body=body)
+    assert semantics.run_check("constrains_lists_every_field_read", code) == [], body
+
+
+def test_a_constraint_naming_a_field_only_in_its_message_is_quiet():
+    code = NAMED_CONSTRAINT.format(
+        declared='"date_start"',
+        body='if self.date_start:\n'
+             '        raise ValidationError(", ".join(self.mapped("name")))')
+    assert semantics.run_check("constrains_lists_every_field_read", code) == []
+
+
 # ------------------------------------------- narrowed by `nexa recall --aim`
 
 # Placed against the method each fix edited, prefer-sql-constraint scored 0