@ngockhoale/ukit 3.4.29 → 3.4.31

package/template_project/.claude/ukit/index/lib/index-core.mjs

@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import crypto from 'node:crypto';
-import { spawnSync } from 'node:child_process';
+import { execFile, spawnSync } from 'node:child_process';
 import { withFileLock } from '../../runtime/token-utils.mjs';
 import { withAsyncLock } from '../../runtime/async-lock.mjs';
 
@@ -133,7 +133,11 @@ const CODE_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '
 const STYLE_EXTENSIONS = new Set(['.css', '.scss', '.sass', '.less']);
 const TRACKED_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.vue', '.sql', '.json', '.yaml', '.yml', '.md', '.sh']);
 const DISCOVERED_EXTENSIONS = new Set([...TRACKED_EXTENSIONS, ...STYLE_EXTENSIONS]);
-export const INDEX_SCHEMA_VERSION = 8;
+// v9: symbols.json gains global-registered ('global') and Vue 'method' rows,
+// SQL 'column' rows with parent/schema, and calls.json gains per-object SQL
+// reference records — a v8 cached artifact must not be reused for unchanged
+// files or the new extractions silently vanish.
+export const INDEX_SCHEMA_VERSION = 9;
 export const DEFAULT_INDEX_CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 // Parse-phase read/extract concurrency — deliberately tighter than the
 // discovery stat pool because parsing holds file content in memory.
@@ -2758,7 +2762,7 @@ function computeSignature(content, lineStartIndex) {
 export function extractSymbols(filePath, content) {
   const out = [];
   const lineStarts = computeLineStarts(content);
-  const addSymbol = (name, type, matchIndex = null) => {
+  const addSymbol = (name, type, matchIndex = null, extra = null) => {
     if (!name) return;
     if (matchIndex === null) {
       out.push({ name, type, filePath, line: null, signature: null });
@@ -2766,7 +2770,7 @@ export function extractSymbols(filePath, content) {
     }
     const line = lineNumberForIndex(lineStarts, matchIndex);
     const signature = computeSignature(content, lineStarts[line - 1]);
-    out.push({ name, type, filePath, line, signature });
+    out.push(extra ? { name, type, filePath, line, signature, ...extra } : { name, type, filePath, line, signature });
   };
   const addMatches = (regex, type, idx = 1) => {
     for (const match of content.matchAll(regex)) {
@@ -2786,6 +2790,24 @@ export function extractSymbols(filePath, content) {
     addMatches(new RegExp(`CREATE\\s+(?:UNIQUE\\s+)?INDEX\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlIdent}`, 'gi'), 'index');
     addMatches(new RegExp(`CREATE\\s+(?:TYPE|DOMAIN|SEQUENCE|MATERIALIZED\\s+VIEW)\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlIdent}`, 'gi'), 'type');
     addMatches(new RegExp(`ALTER\\s+TABLE\\s+(?:IF\\s+EXISTS\\s+)?${sqlIdent}`, 'gi'), 'table');
+
+    // Column-level symbols: CREATE TABLE bodies (with parent + schema kept so
+    // same-named columns in different schemas/tables stay distinct) and view
+    // output aliases (`expr AS alias`).
+    const sqlObjects = findSqlObjects(content);
+    for (const [objectIndex, sqlObject] of sqlObjects.entries()) {
+      if (sqlObject.type === 'table') {
+        for (const column of extractSqlTableColumns(content, sqlObject)) {
+          addSymbol(column.name, 'column', column.matchIndex, { parent: sqlObject.name, schema: sqlObject.schema });
+        }
+      }
+      if (sqlObject.type === 'view') {
+        const bodyEnd = objectIndex + 1 < sqlObjects.length ? sqlObjects[objectIndex + 1].matchIndex : content.length;
+        for (const alias of extractSqlViewAliases(content.slice(sqlObject.matchIndex, Math.min(bodyEnd, sqlObject.matchIndex + 20000)))) {
+          addSymbol(alias.name, 'column', sqlObject.matchIndex + alias.matchIndex, { parent: sqlObject.name, schema: sqlObject.schema });
+        }
+      }
+    }
   } else {
     addMatches(/export\s+(?:async\s+)?function\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'function');
     addMatches(/export\s+class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, 'class');
@@ -2798,6 +2820,32 @@ export function extractSymbols(filePath, content) {
     addMatches(/defineComponent\(\s*\{[\s\S]*?name\s*:\s*['"]([^'"]+)['"]/g, 'component-name');
     addMatches(/export\s+default\s*\{[\s\S]*?name\s*:\s*['"]([^'"]+)['"]/g, 'component-name');
 
+    // Global-registered frontend functions: reachable from anywhere without an
+    // import edge, so impact analysis must treat them as verified dependencies.
+    addMatches(/\b(?:window|globalThis|global)\s*\.\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*=/g, 'global');
+    addMatches(/\b(?:window|globalThis|global)\s*\[\s*['"]([^'"]+)['"]\s*\]\s*=/g, 'global');
+    addMatches(/\b(?:app|vueApp)\s*\.\s*config\s*\.\s*globalProperties\s*\.\s*(\$?[A-Za-z_$][A-Za-z0-9_$]*)\s*=/g, 'global');
+    addMatches(/\bVue\s*\.\s*prototype\s*\.\s*(\$?[A-Za-z_$][A-Za-z0-9_$]*)\s*=/g, 'global');
+    addMatches(/\b(?:app|vueApp)\s*\.\s*provide\s*\(\s*['"]([^'"]+)['"]/g, 'global');
+    addMatches(/\b(?:Vue|app|vueApp)\s*\.\s*component\s*\(\s*['"]([^'"]+)['"]/g, 'global');
+
+    // Vue options-API methods: `methods: { submit() {...}, validate: () => ... }`.
+    // Names inside the balanced `methods` block only — body-level matches keep
+    // their real file line through the absolute-index offset.
+    for (const methodsMatch of content.matchAll(/\bmethods\s*:\s*\{/g)) {
+      const methodsBody = sliceBalancedBlock(content, methodsMatch.index + methodsMatch[0].length);
+      if (!methodsBody) {
+        continue;
+      }
+      const methodsStart = methodsMatch.index + methodsMatch[0].length;
+      for (const methodMatch of methodsBody.matchAll(/(?:^|[,{\n]\s*)([A-Za-z_$][A-Za-z0-9_$]*)\s*\((?:[^()]|\([^)]*\))*\)\s*\{/g)) {
+        addSymbol(methodMatch[1], 'method', methodsStart + methodMatch.index + methodMatch[0].indexOf(methodMatch[1]));
+      }
+      for (const methodMatch of methodsBody.matchAll(/(?:^|[,{]\s*)([A-Za-z_$][A-Za-z0-9_$]*)\s*:\s*(?:async\s+)?(?:function\b|\([^)]*\)\s*=>|[A-Za-z_$][A-Za-z0-9_$]*\s*=>)/g)) {
+        addSymbol(methodMatch[1], 'method', methodsStart + methodMatch.index + methodMatch[0].indexOf(methodMatch[1]));
+      }
+    }
+
     if (/\bexport\s+default\b/.test(content)) {
       addSymbol('default', 'default-export');
     }
@@ -2813,13 +2861,126 @@ export function extractSymbols(filePath, content) {
 
   const seen = new Set();
   return out.filter((item) => {
-    const key = `${item.filePath}:${item.type}:${item.name}`;
+    const key = `${item.filePath}:${item.type}:${item.name}:${item.parent ?? ''}:${item.schema ?? ''}`;
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
   });
 }
 
+// Locates every CREATE <object> statement with its schema qualifier (or null)
+// so same-named objects in different schemas stay distinct records. Used for
+// column extraction and SQL reference segmentation.
+function findSqlObjects(content) {
+  const sqlQualifiedIdent = '(?:(["`]?[A-Za-z_][A-Za-z0-9_$]*["`]?)\\s*\\.\\s*)?["`]?([A-Za-z_][A-Za-z0-9_$]*)["`]?';
+  const patterns = [
+    ['table', `CREATE\\s+(?:OR\\s+REPLACE\\s+)?TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlQualifiedIdent}`],
+    ['view', `CREATE\\s+(?:OR\\s+REPLACE\\s+)?VIEW\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlQualifiedIdent}`],
+    ['function', `CREATE\\s+(?:OR\\s+REPLACE\\s+)?FUNCTION\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlQualifiedIdent}`],
+    ['procedure', `CREATE\\s+(?:OR\\s+REPLACE\\s+)?PROCEDURE\\s+${sqlQualifiedIdent}`],
+    ['type', `CREATE\\s+(?:TYPE|DOMAIN|SEQUENCE)\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?${sqlQualifiedIdent}`],
+  ];
+  const objects = [];
+  for (const [type, pattern] of patterns) {
+    for (const match of content.matchAll(new RegExp(pattern, 'gi'))) {
+      if (!match[2]) {
+        continue;
+      }
+      objects.push({
+        type,
+        name: match[2],
+        schema: match[1] ? match[1].replace(/["`]/g, '') : null,
+        matchIndex: match.index,
+      });
+    }
+  }
+  return objects.sort((a, b) => a.matchIndex - b.matchIndex);
+}
+
+const SQL_COLUMN_CONSTRAINT_KEYWORDS = new Set([
+  'primary', 'foreign', 'unique', 'check', 'constraint', 'key', 'index', 'exclude', 'like', 'period',
+]);
+
+// Slices a CREATE TABLE body's balanced paren list and emits one row per
+// top-level column definition (constraint rows are skipped).
+function extractSqlTableColumns(content, sqlObject) {
+  const headerPattern = new RegExp(
+    `CREATE\\s+(?:OR\\s+REPLACE\\s+)?TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(?:(?:["\`]?[A-Za-z_][A-Za-z0-9_$]*["\`]?)\\s*\\.\\s*)?["\`]?${escapeRegExp(sqlObject.name)}["\`]?`,
+    'gi',
+  );
+  headerPattern.lastIndex = sqlObject.matchIndex;
+  const headerMatch = headerPattern.exec(content);
+  if (!headerMatch) {
+    return [];
+  }
+  const openParenSearchEnd = Math.min(content.length, headerMatch.index + headerMatch[0].length + 500);
+  const openParen = content.slice(headerMatch.index + headerMatch[0].length - 1, openParenSearchEnd).indexOf('(');
+  if (openParen === -1) {
+    return [];
+  }
+  const openParenAbsolute = headerMatch.index + headerMatch[0].length - 1 + openParen;
+
+  let depth = 0;
+  let closeParen = -1;
+  for (let index = openParenAbsolute; index < content.length; index += 1) {
+    if (content[index] === '(') {
+      depth += 1;
+    } else if (content[index] === ')') {
+      depth -= 1;
+      if (depth === 0) {
+        closeParen = index;
+        break;
+      }
+    }
+  }
+  if (closeParen === -1) {
+    return [];
+  }
+
+  const body = content.slice(openParenAbsolute + 1, closeParen);
+  const columns = [];
+  let topLevelDepth = 0;
+  let segmentStart = 0;
+  const segments = [];
+  for (let index = 0; index < body.length; index += 1) {
+    const char = body[index];
+    if (char === '(') {
+      topLevelDepth += 1;
+    } else if (char === ')') {
+      topLevelDepth -= 1;
+    } else if (char === ',' && topLevelDepth === 0) {
+      segments.push(body.slice(segmentStart, index));
+      segmentStart = index + 1;
+    }
+  }
+  segments.push(body.slice(segmentStart));
+
+  let offset = openParenAbsolute + 1;
+  for (const segment of segments) {
+    const columnMatch = segment.match(/^\s*["`]?([A-Za-z_][A-Za-z0-9_$]*)["`]?/);
+    const columnName = columnMatch?.[1];
+    if (columnName && !SQL_COLUMN_CONSTRAINT_KEYWORDS.has(columnName.toLowerCase())) {
+      columns.push({ name: columnName, matchIndex: offset + columnMatch[0].indexOf(columnMatch[1]) });
+    }
+    offset += segment.length + 1;
+  }
+  return columns;
+}
+
+// Output aliases inside a CREATE VIEW body segment: `expr AS alias` where the
+// alias is followed by a column-list boundary.
+function extractSqlViewAliases(viewSegment) {
+  const aliases = [];
+  for (const match of viewSegment.matchAll(/\bAS\s+["`]?([A-Za-z_][A-Za-z0-9_$]*)["`]?\s*(?=\s*(?:,|FROM|WHERE|;|\n|$))/gi)) {
+    aliases.push({ name: match[1], matchIndex: match.index + match[0].indexOf(match[1]) });
+  }
+  return aliases;
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 function extractImports(filePath, content) {
   const out = [];
   const stripped = content
@@ -2898,7 +3059,89 @@ function sliceBalancedBlock(content, startIndex) {
   return '';
 }
 
+// SQL keywords that appear before `(` in procedural/plain SQL but are not
+// object references (SELECT count(, IF(, CAST(...) — plus common column type
+// names, since `VARCHAR(20)` in a table body is a type, not a call.
+const SQL_CALL_KEYWORDS = new Set([
+  'select', 'from', 'where', 'and', 'or', 'not', 'case', 'when', 'then', 'else',
+  'end', 'join', 'inner', 'left', 'right', 'outer', 'full', 'cross', 'on',
+  'group', 'order', 'by', 'having', 'limit', 'offset', 'union', 'all',
+  'distinct', 'as', 'insert', 'into', 'values', 'update', 'set', 'delete',
+  'create', 'table', 'view', 'function', 'procedure', 'index', 'alter', 'drop',
+  'if', 'exists', 'begin', 'commit', 'rollback', 'return', 'declare', 'exec',
+  'execute', 'call', 'with', 'cast', 'coalesce', 'nullif', 'extract', 'primary',
+  'foreign', 'references', 'key', 'constraint', 'default', 'unique', 'check',
+  'asc', 'desc', 'is', 'in', 'like', 'between', 'null', 'true', 'false',
+  'interval', 'date', 'using', 'natural', 'returns', 'language', 'temporary',
+  'varchar', 'char', 'nvarchar', 'nchar', 'int', 'integer', 'bigint', 'smallint',
+  'tinyint', 'text', 'boolean', 'bool', 'datetime', 'timestamp', 'timestamptz',
+  'decimal', 'numeric', 'float', 'double', 'real', 'json', 'jsonb', 'uuid',
+  'serial', 'bigserial', 'blob', 'bytea', 'bit', 'money', 'xml', 'enum',
+  'count', 'sum', 'avg', 'min', 'max', 'round', 'upper', 'lower', 'trim',
+  'length', 'concat', 'substring', 'replace', 'abs', 'ceil', 'floor', 'now',
+  'current_timestamp', 'current_date', 'year', 'month', 'day', 'hour', 'minute',
+  'second', 'convert', 'try_cast', 'iif', 'stuff', 'format', 'getdate',
+]);
+
+// SQL reference extraction: one calls-record per created object whose segment
+// (its statement through the next CREATE) lists the SQL objects it touches —
+// FROM/JOIN targets, EXEC targets, and `name(` function calls. This is the
+// dependency edge impact analysis uses to surface dependent views/functions.
+function extractSqlFunctionCalls(filePath, content) {
+  const objects = findSqlObjects(content);
+  if (objects.length === 0) {
+    return [];
+  }
+  const stripped = content
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/--[^\n]*/g, '');
+
+  const records = [];
+  for (const [objectIndex, sqlObject] of objects.entries()) {
+    const bodyEnd = objectIndex + 1 < objects.length ? objects[objectIndex + 1].matchIndex : content.length;
+    const segment = stripped.slice(sqlObject.matchIndex, Math.min(bodyEnd, sqlObject.matchIndex + 20000));
+
+    const calls = [];
+    const addCall = (rawName) => {
+      if (!rawName) {
+        return;
+      }
+      const bareName = rawName.split('.').pop().replace(/["`]/g, '');
+      if (!bareName || bareName.toLowerCase() === sqlObject.name.toLowerCase()) {
+        return;
+      }
+      if (SQL_CALL_KEYWORDS.has(bareName.toLowerCase())) {
+        return;
+      }
+      if (!calls.includes(bareName)) {
+        calls.push(bareName);
+      }
+    };
+
+    for (const match of segment.matchAll(/\b(?:FROM|JOIN)\s+["`]?([A-Za-z_][A-Za-z0-9_$]*(?:\s*\.\s*["`]?[A-Za-z_][A-Za-z0-9_$]*)?)/gi)) {
+      addCall(match[1]);
+    }
+    for (const match of segment.matchAll(/\bEXEC(?:UTE)?\s+(?:@\w+\s*=\s*)?["`]?([A-Za-z_][A-Za-z0-9_$]*)/gi)) {
+      addCall(match[1]);
+    }
+    for (const match of segment.matchAll(/\b([A-Za-z_][A-Za-z0-9_$]*)\s*\(/g)) {
+      addCall(match[1]);
+    }
+
+    records.push({
+      filePath,
+      symbol: sqlObject.name,
+      exported: true,
+      calls,
+    });
+  }
+  return records;
+}
+
 function extractFunctionCalls(filePath, content) {
+  if (filePath.endsWith('.sql')) {
+    return extractSqlFunctionCalls(filePath, content);
+  }
   return extractFunctionBlocks(content).map((block) => {
     const calls = [];
     for (const match of block.body.matchAll(/(?:\b|\.)([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g)) {
@@ -3165,20 +3408,59 @@ function scoreDirectFileMatch({ queryDescriptor, filePath, searchDescriptor }) {
       reasons.push(`symbol_compact:${symbolDescriptor.name}`);
     }
 
+    let symbolContributed = false;
+
     for (const token of queryDescriptor.tokens) {
       if (symbolDescriptor.descriptor.tokens.has(token)) {
         score += 3;
+        symbolContributed = true;
         reasons.push(`symbol_token:${symbolDescriptor.name}:${token}`);
       } else if (symbolDescriptor.descriptor.rawLower.includes(token)) {
         score += 1;
+        symbolContributed = true;
         reasons.push(`symbol_contains:${symbolDescriptor.name}`);
       }
     }
+
+    // Fuzzy floor for misspelt or compacted symbol queries ('custmer_code' →
+    // 'customer_code'): subsequence or bounded edit-distance match on the
+    // already-precomputed compacts. Only fires when the symbol earned nothing
+    // from the stronger tiers above.
+    if (!symbolContributed && queryDescriptor.compact.length >= 6) {
+      if (symbolFuzzyMatches(queryDescriptor.compact, symbolDescriptor.descriptor.compact)) {
+        score += 3;
+        reasons.push(`symbol_fuzzy:${symbolDescriptor.name}`);
+      }
+    }
   }
 
   return { score, reasons: [...new Set(reasons)], filePath };
 }
 
+// Fuzzy predicate shared by scoreDirectFileMatch and resolveSymbolCandidates:
+// ordered containment (either direction, on tokens or compacts) or a bounded
+// Damerau distance. Cheap length gates run first so the common non-fuzzy case
+// never builds a distance matrix.
+function symbolFuzzyMatches(queryCompact, symbolCompact) {
+  if (!queryCompact || !symbolCompact) {
+    return false;
+  }
+  if (Math.abs(queryCompact.length - symbolCompact.length) > 2) {
+    return false;
+  }
+  if (isCompactCharSubsequence(queryCompact, symbolCompact) || isCompactCharSubsequence(symbolCompact, queryCompact)) {
+    return true;
+  }
+  if (
+    queryCompact.length >= FUZZY_EDIT_DISTANCE_MIN_LENGTH
+    && symbolCompact.length >= FUZZY_EDIT_DISTANCE_MIN_LENGTH
+    && boundedDamerauDistance(queryCompact, symbolCompact, 2) <= 2
+  ) {
+    return true;
+  }
+  return false;
+}
+
 function groupBy(items, keyFn) {
   const map = new Map();
   for (const item of items) {
@@ -3189,6 +3471,372 @@ function groupBy(items, keyFn) {
   return map;
 }
 
+// ── Symbol-level resolution ──
+// Ranks symbol rows against a (possibly misspelt or phrase-form) query:
+// exact > normalized (case/underscore/hyphen/camel-insensitive) > ordered
+// token/compact subsequence > bounded edit distance. Fuzzy-only results never
+// auto-substitute: they carry confidence 'fuzzy' and needsConfirmation, and any
+// tie inside `scoreMargin` marks the whole leading band ambiguous.
+export function resolveSymbolCandidates(query, symbols, { limit = 8, scoreMargin = 5 } = {}) {
+  const normalizedQuery = String(query ?? '').trim();
+  if (!normalizedQuery || !Array.isArray(symbols)) {
+    return [];
+  }
+
+  const baseTokens = normalizeIdentifierTokens(normalizedQuery);
+  if (baseTokens.length === 0) {
+    return [];
+  }
+  const baseCompact = baseTokens.join('');
+  const variants = expandIdentifierQueryVariants(normalizedQuery);
+
+  const rows = [];
+  const seen = new Set();
+  for (const symbol of symbols) {
+    if (!symbol || typeof symbol?.name !== 'string') {
+      continue;
+    }
+    const symbolTokens = normalizeIdentifierTokens(symbol.name);
+    if (symbolTokens.length === 0) {
+      continue;
+    }
+    const dedupeKey = `${symbol.name}\u0000${symbol.filePath ?? ''}\u0000${symbol.parent ?? ''}\u0000${symbol.schema ?? ''}`;
+    if (seen.has(dedupeKey)) {
+      continue;
+    }
+    seen.add(dedupeKey);
+
+    const match = scoreSymbolCandidate({
+      query: normalizedQuery,
+      baseTokens,
+      baseCompact,
+      variants,
+      symbol,
+      symbolTokens,
+      symbolCompact: symbolTokens.join(''),
+    });
+    if (match) {
+      rows.push(match);
+    }
+  }
+
+  rows.sort((a, b) => b.score - a.score || a.name.localeCompare(b.name) || String(a.filePath ?? '').localeCompare(String(b.filePath ?? '')));
+
+  const top = rows.slice(0, Math.max(limit, 0));
+  const topScore = top[0]?.score ?? 0;
+  const ambiguousBand = top.filter((candidate) => topScore - candidate.score <= scoreMargin);
+  const ambiguous = ambiguousBand.length > 1;
+
+  return top.map((candidate) => ({
+    ...candidate,
+    needsConfirmation: candidate.confidence === 'fuzzy' || ambiguous,
+  }));
+}
+
+function scoreSymbolCandidate({ query, baseTokens, baseCompact, variants, symbol, symbolTokens, symbolCompact }) {
+  const row = {
+    name: symbol.name,
+    filePath: symbol.filePath ?? null,
+    line: Number.isFinite(symbol.line) ? symbol.line : null,
+    kind: symbol.type ?? 'symbol',
+    parent: symbol.parent ?? null,
+    schema: symbol.schema ?? null,
+  };
+
+  if (symbol.name === query) {
+    return { ...row, score: 100, reason: 'exact', confidence: 'exact' };
+  }
+  if (symbolCompact === baseCompact) {
+    return { ...row, score: 90, reason: 'normalized', confidence: 'high' };
+  }
+
+  let best = null;
+  for (const variantTokens of variants) {
+    const variantCompact = variantTokens.join('');
+    if (isOrderedTokenSubsequence(variantTokens, symbolTokens)) {
+      const candidate = { score: 70, reason: 'token-subsequence' };
+      if (!best || candidate.score > best.score) {
+        best = candidate;
+      }
+    }
+    if (isCompactCharSubsequence(variantCompact, symbolCompact)) {
+      const candidate = { score: 65, reason: 'compact-subsequence' };
+      if (!best || candidate.score > best.score) {
+        best = candidate;
+      }
+    }
+    if (
+      variantCompact.length >= FUZZY_EDIT_DISTANCE_MIN_LENGTH
+      && symbolCompact.length >= FUZZY_EDIT_DISTANCE_MIN_LENGTH
+    ) {
+      const distance = boundedDamerauDistance(variantCompact, symbolCompact, 2);
+      if (distance <= 2) {
+        const candidate = { score: 60 - distance * 10, reason: `edit-distance:${distance}` };
+        if (!best || candidate.score > best.score) {
+          best = candidate;
+        }
+      }
+    }
+  }
+
+  if (!best) {
+    return null;
+  }
+  return { ...row, ...best, confidence: 'fuzzy' };
+}
+
+// Loads symbols.json (schema-gated, poisoned rows dropped) and resolves the
+// query against every indexed symbol row, including SQL columns and
+// global-registered frontend functions.
+export async function querySymbolCandidates({ rootDir = process.cwd(), query, limit = 8, scoreMargin = 5 } = {}) {
+  const normalizedQuery = String(query ?? '').trim();
+  if (!normalizedQuery) {
+    return [];
+  }
+
+  const absoluteRoot = path.resolve(rootDir);
+  const symbolsArtifact = await readArtifact(absoluteRoot, INDEX_ARTIFACTS.symbols);
+  const safeSymbolsArtifact = safeSchemaArtifact(symbolsArtifact);
+  return resolveSymbolCandidates(normalizedQuery, safeItems(safeSymbolsArtifact), { limit, scoreMargin });
+}
+
+// ── Fallback source search (index unavailable) ──
+// Bounded ripgrep-first text search so query-index / impact-context can answer
+// from source when the index is missing or its rebuild fails. `rg` runs via
+// child_process when present; otherwise (or on rg failure) a bounded node
+// directory walk honors the same ignore-dir set as the index builder. Rows are
+// { filePath, line } and require EVERY query token to appear in the file.
+export const FALLBACK_SEARCH_IGNORE_DIRS = [
+  'node_modules', '.git', '.cache', '.next', '.nuxt', '.output', '.vercel',
+  '.turbo', '.yarn', 'dist', 'build', 'out', 'coverage', 'tmp', 'temp',
+  'vendor', '.venv', 'venv',
+];
+const FALLBACK_SEARCH_IGNORE_DIR_SET = new Set(FALLBACK_SEARCH_IGNORE_DIRS);
+const FALLBACK_SEARCH_EXTENSIONS = new Set([
+  '.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.vue', '.sql', '.json',
+  '.md', '.yaml', '.yml', '.sh', '.css', '.scss', '.sass', '.less', '.html',
+]);
+const FALLBACK_SEARCH_DEFAULTS = {
+  maxFiles: 2000,
+  maxFileBytes: 512 * 1024,
+  rgTimeoutMs: 5000,
+  // Traversal bounds: maxFiles caps MATCHED candidates only, so the walk also needs a cap on
+  // everything it merely visits (huge SQL/data trees, generated dirs not in the ignore set).
+  maxEntries: 20000,
+  maxDepth: 12,
+  maxVerify: 400,
+  walkBudgetMs: 3000,
+};
+
+export async function boundedSourceSearch({
+  rootDir = process.cwd(),
+  query,
+  limit = 8,
+  maxFiles = FALLBACK_SEARCH_DEFAULTS.maxFiles,
+  maxFileBytes = FALLBACK_SEARCH_DEFAULTS.maxFileBytes,
+  engine = 'auto',
+  maxEntries = FALLBACK_SEARCH_DEFAULTS.maxEntries,
+  maxDepth = FALLBACK_SEARCH_DEFAULTS.maxDepth,
+  maxVerify = FALLBACK_SEARCH_DEFAULTS.maxVerify,
+  walkBudgetMs = FALLBACK_SEARCH_DEFAULTS.walkBudgetMs,
+} = {}) {
+  const normalizedQuery = String(query ?? '').trim();
+  if (!normalizedQuery) {
+    return [];
+  }
+  const truncation = new Set();
+  const foldedQuery = buildSearchDescriptor(normalizedQuery).rawLower;
+  const tokens = [...new Set(normalizeIdentifierTokens(foldedQuery))];
+  if (tokens.length === 0) {
+    return [];
+  }
+
+  const absoluteRoot = path.resolve(rootDir);
+  let candidatePaths = null;
+  if (engine === 'auto') {
+    candidatePaths = await ripgrepCandidatePaths({ absoluteRoot, tokens, maxFileBytes });
+  }
+  if (candidatePaths === null) {
+    candidatePaths = await walkCandidatePaths({
+      absoluteRoot, maxFiles, maxFileBytes, maxEntries, maxDepth, walkBudgetMs, truncation,
+    });
+  }
+
+  const rows = [];
+  let verified = 0;
+  for (const relativePath of candidatePaths) {
+    if (verified >= maxVerify) {
+      truncation.add('verify-cap');
+      break;
+    }
+    verified += 1;
+    const verification = await readMatchingLine(absoluteRoot, relativePath, tokens, maxFileBytes);
+    if (!verification) {
+      continue;
+    }
+    rows.push({ filePath: relativePath, line: verification.line, reason: 'fallback-search' });
+    if (rows.length >= Math.max(limit, 0)) {
+      break;
+    }
+  }
+  // A partial scan must never read as exhaustive: callers that care read `rows.truncated`
+  // (non-enumerable, so array equality and JSON output are unchanged).
+  Object.defineProperty(rows, 'truncated', { value: [...truncation], enumerable: false });
+  return rows;
+}
+
+function execFileRipgrep(args, timeoutMs) {
+  return new Promise((resolve) => {
+    execFile('rg', args, { timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024 }, (error, stdout) => {
+      if (error) {
+        // rg exit code 1 = "no matches" (a valid empty answer; error.code is the
+        // number 1). A spawn failure (code 'ENOENT'), a timeout, or exit ≥2
+        // means rg is unusable and the walk must take over.
+        resolve(error.code === 1 ? [] : null);
+        return;
+      }
+      resolve(String(stdout ?? ''));
+    });
+  });
+}
+
+async function ripgrepCandidatePaths({ absoluteRoot, tokens, maxFileBytes }) {
+  const stdout = await execFileRipgrep(
+    [
+      '-i', '--no-heading', '--line-number', '--max-count', '3',
+      '--max-filesize', String(Math.round(maxFileBytes / 1024)) + 'K',
+      ...FALLBACK_SEARCH_IGNORE_DIRS.flatMap((dir) => ['--glob', `!${dir}/**`]),
+      '--glob', '!**/*.min.*',
+      ...tokens.flatMap((token) => ['-e', token]),
+      absoluteRoot,
+    ],
+    FALLBACK_SEARCH_DEFAULTS.rgTimeoutMs,
+  );
+  if (stdout === null) {
+    return null;
+  }
+
+  const paths = [];
+  const seen = new Set();
+  for (const line of stdout.split('\n')) {
+    const separator = line.indexOf(':');
+    if (separator <= 0) {
+      continue;
+    }
+    const matchedPath = line.slice(0, separator);
+    if (!matchedPath || seen.has(matchedPath)) {
+      continue;
+    }
+    seen.add(matchedPath);
+    const relativePath = path.relative(absoluteRoot, matchedPath).replace(/\\/g, '/');
+    if (relativePath && !relativePath.startsWith('..')) {
+      paths.push(relativePath);
+    }
+  }
+  return paths;
+}
+
+// Depth-first walk collecting candidate text files (size- and count-bounded).
+// Token verification happens once in boundedSourceSearch, so the walk only
+// filters by ignore-set, extension, and size.
+async function walkCandidatePaths({
+  absoluteRoot, maxFiles, maxFileBytes, maxEntries, maxDepth, walkBudgetMs, truncation = new Set(),
+}) {
+  const results = [];
+  let visited = 0;
+  const deadline = Date.now() + walkBudgetMs;
+  const exhausted = () => {
+    if (results.length >= maxFiles) { truncation.add('max-files'); return true; }
+    if (visited >= maxEntries) { truncation.add('max-entries'); return true; }
+    if (Date.now() > deadline) { truncation.add('time-budget'); return true; }
+    return false;
+  };
+
+  const walk = async (dir, depth) => {
+    if (exhausted()) {
+      return;
+    }
+    if (depth > maxDepth) {
+      truncation.add('max-depth');
+      return;
+    }
+    let entries;
+    try {
+      entries = await fs.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      if (exhausted()) {
+        return;
+      }
+      visited += 1;
+      if (entry.isSymbolicLink()) {
+        continue; // never follow links out of the tree (cycles, escapes)
+      }
+      const entryPath = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (FALLBACK_SEARCH_IGNORE_DIR_SET.has(entry.name) || entry.name.startsWith('.')) {
+          continue;
+        }
+        await walk(entryPath, depth + 1);
+        continue;
+      }
+      if (!entry.isFile() || !FALLBACK_SEARCH_EXTENSIONS.has(path.extname(entry.name).toLowerCase())) {
+        continue;
+      }
+      try {
+        const stat = await fs.stat(entryPath);
+        if (stat.size > maxFileBytes) {
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      results.push(path.relative(absoluteRoot, entryPath).replace(/\\/g, '/'));
+    }
+  };
+
+  await walk(absoluteRoot, 0);
+  return results;
+}
+
+async function readMatchingLine(absoluteRoot, relativePath, tokens, maxFileBytes) {
+  if (!relativePath) {
+    return null;
+  }
+  let content;
+  try {
+    content = await fs.readFile(path.join(absoluteRoot, relativePath), 'utf8');
+  } catch {
+    return null;
+  }
+  if (content.length > maxFileBytes) {
+    return null;
+  }
+  const foldedContent = buildSearchDescriptor(content.slice(0, 64 * 1024)).rawLower;
+  if (!tokens.every((token) => foldedContent.includes(token))) {
+    return null;
+  }
+  const rawLines = content.split('\n');
+  const foldedLines = foldedContent.split('\n');
+  for (const [index, rawLine] of rawLines.entries()) {
+    const foldedLine = foldedLines[index] ?? '';
+    if (tokens.every((token) => foldedLine.includes(token))) {
+      return { line: index + 1 };
+    }
+  }
+  // All tokens present in the file but never on one line — still a hit; point
+  // at the first line containing any token.
+  for (const [index, rawLine] of rawLines.entries()) {
+    const foldedLine = foldedLines[index] ?? '';
+    if (tokens.some((token) => foldedLine.includes(token))) {
+      return { line: index + 1 };
+    }
+  }
+  return { line: null };
+}
+
 function haveStableTrackedFileIdentities(previousRecords, nextRecords) {
   if (previousRecords.length !== nextRecords.length) {
     return false;
@@ -3320,6 +3968,132 @@ export function buildSearchDescriptor(value, { expandVietnameseAliases = false }
   };
 }
 
+// ── Fuzzy identifier resolution ──
+// Shared by resolveSymbolCandidates and scoreDirectFileMatch's symbol_fuzzy
+// tier: camelCase/snake_case/kebab-case identifiers normalize to the same
+// folded token sequence, ordered subsequences bridge compacted queries
+// ('checknull' ⊂ check_if_is_null), and a bounded Damerau distance catches
+// misspellings ('custmer_code' → 'customer_code').
+
+export function normalizeIdentifierTokens(value) {
+  return tokenizeFoldedText(foldTextForSearch(addCamelBoundaries(value)));
+}
+
+// Query variants for phrase-level matching: the folded text as-is, then the
+// Vietnamese phrase aliases rewritten in place ('kiem tra null' → 'check null'),
+// then token-level aliases. Each variant is an ordered, deduped token list.
+export function expandIdentifierQueryVariants(value) {
+  const folded = foldTextForSearch(value);
+  const variants = [tokenizeFoldedText(folded)];
+
+  for (const entry of VIETNAMESE_PHRASE_ALIASES) {
+    entry.regex.lastIndex = 0;
+    if (!entry.regex.test(folded)) {
+      continue;
+    }
+    for (const expansion of entry.expansions) {
+      entry.regex.lastIndex = 0;
+      variants.push(tokenizeFoldedText(folded.replace(entry.regex, expansion)));
+    }
+  }
+
+  variants.push(variants[0].map((token) => VIETNAMESE_TOKEN_ALIASES.get(token)?.[0] ?? token));
+
+  const seen = new Set();
+  return variants
+    .map((tokens) => [...new Set(tokens)])
+    .filter((tokens) => tokens.length > 0)
+    .filter((tokens) => {
+      const key = tokens.join('\u0000');
+      if (seen.has(key)) {
+        return false;
+      }
+      seen.add(key);
+      return true;
+    })
+    .slice(0, 8);
+}
+
+// `queryTokens` fits inside `symbolTokens` in order ('check null' ⊆ check,if,null).
+export function isOrderedTokenSubsequence(queryTokens, symbolTokens) {
+  if (queryTokens.length === 0 || queryTokens.length > symbolTokens.length) {
+    return false;
+  }
+  let cursor = 0;
+  for (const token of symbolTokens) {
+    if (token === queryTokens[cursor]) {
+      cursor += 1;
+      if (cursor === queryTokens.length) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+// Character-level ordered containment on compacted forms ('checknull' ⊂ 'checkifnull').
+export function isCompactCharSubsequence(queryCompact, symbolCompact) {
+  if (!queryCompact || queryCompact.length > symbolCompact.length) {
+    return false;
+  }
+  let cursor = 0;
+  for (const char of symbolCompact) {
+    if (char === queryCompact[cursor]) {
+      cursor += 1;
+      if (cursor === queryCompact.length) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+// Damerau-Levenshtein (with transpositions), bounded: anything farther than
+// `maxDistance` short-circuits to maxDistance + 1 so callers can treat the
+// result as "beyond threshold" without walking the full matrix.
+export function boundedDamerauDistance(a, b, maxDistance = 2) {
+  const left = String(a ?? '');
+  const right = String(b ?? '');
+  if (left === right) {
+    return 0;
+  }
+  if (Math.abs(left.length - right.length) > maxDistance) {
+    return maxDistance + 1;
+  }
+
+  let prevPrev = null;
+  let prev = Array.from({ length: right.length + 1 }, (_, j) => j);
+  for (let i = 1; i <= left.length; i += 1) {
+    const current = [i];
+    let rowMin = i;
+    for (let j = 1; j <= right.length; j += 1) {
+      const substitutionCost = left[i - 1] === right[j - 1] ? 0 : 1;
+      let value = Math.min(
+        prev[j] + 1,
+        current[j - 1] + 1,
+        prev[j - 1] + substitutionCost,
+      );
+      if (i > 1 && j > 1 && left[i - 1] === right[j - 2] && left[i - 2] === right[j - 1]) {
+        value = Math.min(value, prevPrev[j - 2] + 1);
+      }
+      current[j] = value;
+      if (value < rowMin) {
+        rowMin = value;
+      }
+    }
+    if (rowMin > maxDistance) {
+      return maxDistance + 1;
+    }
+    prevPrev = prev;
+    prev = current;
+  }
+  return prev[right.length];
+}
+
+// Minimum length both compacts must reach before edit-distance fuzzy matching
+// applies — short identifiers (< 6) produce too many false neighbors.
+export const FUZZY_EDIT_DISTANCE_MIN_LENGTH = 6;
+
 function addCamelBoundaries(value) {
   return String(value || '')
     .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
@@ -4432,10 +5206,11 @@ export async function resolveImpactContext({
   const normalizedChangedFiles = uniqueImpact(changedFiles.map(normalizeImpactPath));
   const normalizedChangedSymbols = uniqueImpact(changedSymbols.map((symbol) => String(symbol ?? '').trim()));
 
-  const [callsArtifact, importsArtifact, filesArtifact, relatedArtifacts] = await Promise.all([
+  const [callsArtifact, importsArtifact, filesArtifact, symbolsArtifact, relatedArtifacts] = await Promise.all([
     readArtifact(absoluteRoot, INDEX_ARTIFACTS.calls),
     readArtifact(absoluteRoot, INDEX_ARTIFACTS.imports),
     readArtifact(absoluteRoot, INDEX_ARTIFACTS.files),
+    readArtifact(absoluteRoot, INDEX_ARTIFACTS.symbols),
     loadRelatedTestArtifacts({ rootDir: absoluteRoot }),
   ]);
 
@@ -4463,12 +5238,27 @@ export async function resolveImpactContext({
     ...normalizedChangedSymbols,
     ...changedRecords.map((record) => record.symbol),
   ]);
+  // Global-registered symbols (window.X / app.config.globalProperties.$X /
+  // app.component(...)) are reachable without imports, so a bare-name call is
+  // already proof for them.
+  const changedGlobalSymbols = new Set(
+    safeItems(symbolsArtifact)
+      .filter((item) => item.type === 'global' && changedFileSet.has(normalizeImpactPath(item.filePath)))
+      .map((item) => item.name),
+  );
+  const candidateCallers = [];
   if (callerTargets.size > 0) {
     for (const record of callItems) {
       const matchedSymbol = (record.calls ?? []).find((name) => callerTargets.has(name));
       if (!matchedSymbol) continue;
       if (changedFileSet.has(normalizeImpactPath(record.filePath))) continue;
-      callers.push({ filePath: record.filePath, symbol: record.symbol, reason: `calls ${matchedSymbol}` });
+
+      candidateCallers.push({
+        filePath: record.filePath,
+        symbol: record.symbol,
+        reason: `calls ${matchedSymbol}`,
+        matchedSymbol,
+      });
     }
   }
 
@@ -4500,45 +5290,121 @@ export async function resolveImpactContext({
       dependencies.push(matched);
     }
   }
+
+  // Callers only count with proof: an import edge into a changed file
+  // (directly / re-export / alias), an explicit SQL reference record, or a
+  // global-registered changed symbol. Name-only matches are reported as
+  // unverifiedImpact instead of pretending exhaustive caller knowledge.
+  const importerSet = new Set(importers);
+  const isVerifiedCaller = (entry) => importerSet.has(entry.filePath)
+    || String(entry.filePath ?? '').toLowerCase().endsWith('.sql')
+    || changedGlobalSymbols.has(entry.matchedSymbol);
+  // Output rows keep the historical { filePath, symbol, reason } shape.
+  const toCallerRow = ({ filePath, symbol, reason }) => ({ filePath, symbol, reason });
+  const verifiedCallers = candidateCallers.filter(isVerifiedCaller).map(toCallerRow);
+  const unverifiedImpact = uniqueImpact(
+    candidateCallers
+      .filter((entry) => !isVerifiedCaller(entry))
+      .map((entry) => entry.filePath),
+  );
+
   const candidateFiles = uniqueImpact([
     ...normalizedChangedFiles,
     ...importers,
-    ...callers.map((item) => item.filePath),
+    ...verifiedCallers.map((item) => item.filePath),
     ...mirrorCounterparts.map((item) => item.filePath),
   ]);
-  const relatedTests = inferRelatedTestsFromArtifacts({
+  const relatedTestsFromArtifacts = inferRelatedTestsFromArtifacts({
     candidateFiles,
     analogsMap: relatedArtifacts.analogsMap,
     relationsMap: relatedArtifacts.relationsMap,
     limit: budget.maxTests,
   }).map((entry) => entry.filePath);
+  // Importer test files are related tests by definition: they import the
+  // changed file and live under a test directory.
+  const importerTestFiles = importers.filter((filePath) => isLikelyTestFile(filePath));
+  const relatedTests = uniqueImpact([...importerTestFiles, ...relatedTestsFromArtifacts]);
+
   const recommendedTestFiles = uniqueImpact([
     ...relatedTests,
     ...risk.riskLabels.flatMap((label) => IMPACT_RISK_TEST_RECOMMENDATIONS[label] ?? []),
   ]);
 
+  // Stale-entry guard: a renamed/deleted file must not surface as impact.
+  // Only the capped output lists are stat-checked, so the cost stays bounded.
+  const dedupedCallers = dedupeImpactCallers(verifiedCallers);
+  const existingCallers = await filterExistingImpactCallers(absoluteRoot, dedupedCallers);
+  const existingImporters = await filterExistingImpactPaths(absoluteRoot, uniqueImpact(importers));
+  const existingRelatedTests = await filterExistingImpactPaths(absoluteRoot, relatedTests);
+  const existingUnverifiedImpact = await filterExistingImpactPaths(absoluteRoot, unverifiedImpact);
+
+  const calleeList = uniqueImpact(callees.map((item) => JSON.stringify(item))).map((value) => JSON.parse(value));
+  const callerList = existingCallers.slice(0, budget.maxCallers);
+  const importerList = existingImporters.slice(0, budget.maxImporters);
+  const relatedTestList = existingRelatedTests.slice(0, budget.maxTests);
+  const unverifiedList = existingUnverifiedImpact.slice(0, budget.maxCallers);
+
   return {
     changedFiles: normalizedChangedFiles,
     changedSymbols: normalizedChangedSymbols,
     riskLabels: risk.riskLabels,
     requiresImpactCheck: risk.requiresImpactCheck,
-    callees: uniqueImpact(callees.map((item) => JSON.stringify(item))).map((value) => JSON.parse(value)).slice(0, budget.maxCallees),
-    callers: uniqueImpact(callers.map((item) => JSON.stringify(item))).map((value) => JSON.parse(value)).slice(0, budget.maxCallers),
-    importers: uniqueImpact(importers).slice(0, budget.maxImporters),
+    callees: calleeList.slice(0, budget.maxCallees),
+    callers: callerList,
+    importers: importerList,
     dependencies: uniqueImpact(dependencies).slice(0, budget.maxImporters),
     mirrorCounterparts,
-    relatedTests,
+    relatedTests: relatedTestList,
     recommendedTestFiles,
+    unverifiedImpact: unverifiedList,
+    truncated: {
+      callers: Math.max(existingCallers.length - callerList.length, 0),
+      importers: Math.max(existingImporters.length - importerList.length, 0),
+      callees: Math.max(calleeList.length - budget.maxCallees, 0),
+      relatedTests: Math.max(existingRelatedTests.length - relatedTestList.length, 0),
+      unverifiedImpact: Math.max(existingUnverifiedImpact.length - unverifiedList.length, 0),
+    },
     explanations: {
       callees: changedRecords.map((record) => `${record.filePath}:${record.symbol}`),
-      callers: callers.map((entry) => `${entry.filePath}:${entry.symbol}`),
+      callers: callerList.map((entry) => `${entry.filePath}:${entry.symbol}`),
       importers,
       relatedTests,
       mirrorCounterparts: mirrorCounterparts.map((entry) => `${entry.source} -> ${entry.filePath}`),
+      unverifiedImpact: unverifiedList,
     },
   };
 }
 
+function dedupeImpactCallers(callers = []) {
+  const byKey = new Map();
+  for (const caller of callers) {
+    const key = `${caller.filePath}\u0000${caller.symbol}`;
+    if (!byKey.has(key)) {
+      byKey.set(key, caller);
+    }
+  }
+  return [...byKey.values()];
+}
+
+async function impactPathExists(rootDir, relativePath) {
+  try {
+    await fs.access(path.join(rootDir, relativePath));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function filterExistingImpactPaths(rootDir, values = []) {
+  const checks = await Promise.all(values.map(async (value) => ({ value, exists: await impactPathExists(rootDir, value) })));
+  return checks.filter((check) => check.exists).map((check) => check.value);
+}
+
+async function filterExistingImpactCallers(rootDir, callers = []) {
+  const checks = await Promise.all(callers.map(async (entry) => ({ entry, exists: await impactPathExists(rootDir, entry.filePath) })));
+  return checks.filter((check) => check.exists).map((check) => check.entry);
+}
+
 export function formatImpactConfidenceSummary(impact = {}) {
   const lines = ['Impact checked:'];
   if ((impact.changedFiles ?? []).length > 0) lines.push(`- Changed: ${(impact.changedFiles ?? []).slice(0, 3).join(', ')}`);
@@ -4557,6 +5423,9 @@ export function formatImpactConfidenceSummary(impact = {}) {
   const mirrors = (impact.mirrorCounterparts ?? []).map((item) => item?.filePath).filter(Boolean).slice(0, 3);
   if (mirrors.length > 0) lines.push(`- Mirrors: ${mirrors.join(', ')}`);
 
+  const unverified = (impact.unverifiedImpact ?? []).slice(0, 3);
+  if (unverified.length > 0) lines.push(`- Unverified impact (name-only): ${unverified.join(', ')}`);
+
   const relatedTests = (impact.relatedTests ?? []).slice(0, 4);
   if (relatedTests.length > 0) lines.push(`- Related tests: ${relatedTests.join(', ')}`);