i think i might see a path forward though: essentially, the injection is supposed to be lazy. if the thing does already exist on disk, then it can be tracked as a dependency. but if it is injected, then we wouldn't want to report it anyway.