ensure method(obj, key) can't mutate the loop.

- [ ] write a test
- [ ] update commit message
we may want to put this in its own method. Depending on the structure of deps