ucn 5.5.3 → 5.6.1

package/core/outgoing-check.js

@@ -0,0 +1,116 @@
+/** Validate changed calls against the project declarations they can reach. */
+'use strict';
+
+const { getCachedCalls } = require('./callers');
+const { verifyCallSites } = require('./verify');
+const { langTraits } = require('../languages');
+const { positivelyFits } = require('./call-fit');
+
+/** One reader and result cache for a check, including all changed symbols. */
+function outgoingChecker(index, judge, addedLinesByFile) {
+    const files = new Map();
+    const checked = new Map();
+    const read = file => {
+        if (!files.has(file)) files.set(file, {
+            calls: getCachedCalls(index, file) || [], lines: index._getFileLines(file),
+        });
+        return files.get(file);
+    };
+    return (definition, change, added) => {
+        const mismatches = [];
+        const unsettled = [];
+        if (!definition) return { mismatches, unsettled };
+        const data = read(definition.file);
+        const changedRanges = !added ? change?.changedCalls : null;
+        const lines = addedLinesByFile.get(definition.relativePath) || new Set();
+        const records = data.calls.filter(call => !call.isFunctionReference &&
+            call.line >= definition.startLine && call.line <= definition.endLine &&
+            (changedRanges ? changedRanges.some(range =>
+                range.start <= (call.callStart ?? call.callSite?.start) &&
+                range.end >= (call.callEnd ?? call.callSite?.end ?? call.callStart ?? call.callSite?.start))
+                : added || lines.has(call.line)));
+        if (records.length === 0) return { mismatches, unsettled };
+        const byStart = new Map(records.map(call => [call.callStart ?? call.callSite?.start, call]));
+        const callees = index.findCallees(definition, {
+            collectAccount: true, includeMethods: true, siteStarts: new Set(byStart.keys()),
+        });
+        const relative = definition.relativePath;
+        const positiveFamilies = new Set();
+        const possibleFamilies = new Set();
+        const issues = [];
+        const familyOf = (callee, site) => {
+            // The class's public constructor overloads are the call
+            // interface; an initializer edge also projects their body.
+            const owner = callee.initializerOf || (callee.type === 'class' ? callee.name : null);
+            return JSON.stringify([site.start, callee.file, owner || callee.name,
+                owner ? null : callee.className, callee.namespace, callee.enclosingType]);
+        };
+        const uncertain = (site, name, reason) => unsettled.push({ file: relative, line: site.line, column: site.column, name, reason });
+        for (const callee of callees) {
+            if (callee.functionReference) continue;
+            for (const site of callee.siteProvenance || []) {
+                const record = byStart.get(site.start);
+                if (!record) continue;
+                const family = familyOf(callee, site);
+                const key = JSON.stringify([definition.file, site.start, callee.file, callee.startLine,
+                    callee.sourceSpan?.start, callee.sourceSpan?.end, callee.name, callee.className,
+                    callee.type, callee.paramsStructured]);
+                let result = checked.get(key);
+                if (!result) {
+                    result = verifyCallSites(index, callee, [{
+                        ...record, file: definition.file, relativePath: relative,
+                        content: data.lines[site.line - 1] || '', calledAs: record.name,
+                        provenance: site.provenance,
+                        callerFile: definition.file, callerStartLine: definition.startLine,
+                    }]);
+                    checked.set(key, result);
+                }
+                for (const mismatch of result.mismatchDetails || []) {
+                    const counts = String(mismatch.expected || '').match(/\d+/g);
+                    const suppressed = judge.suppressed(mismatch, {
+                        kind: 'arity', name: callee.name,
+                        most: counts ? Number(counts[counts.length - 1]) : undefined,
+                        span: mismatch.span, problem: mismatch.problem, indirect: mismatch.indirect,
+                    });
+                    // JavaScript deliberately permits omitted and extra
+                    // arguments. A declared count is not runtime proof.
+                    const flexible = langTraits(index.files.get(definition.file)?.language)?.lenientCallArity === true;
+                    if ((callee.decorators || []).length) uncertain(site, callee.name, 'decorated-call-interface');
+                    else if (flexible) uncertain(site, callee.name, 'call-arity-not-enforced');
+                    else issues.push({ family, site, callee, mismatch: {
+                        ...mismatch, column: site.column, target: callee.name, ...(suppressed && { unchecked: true }),
+                    } });
+                }
+                if (result.valid > 0 || result.uncertain > 0) possibleFamilies.add(family);
+                for (const row of result.uncertainDetails || []) issues.push({ family, site, callee, reason: row.reason });
+                if (result.valid > 0) {
+                    const preserved = changedRanges?.some(range => range.stableInvocation &&
+                        range.start <= site.start && range.end >= (record.callEnd ?? record.callSite?.end ?? site.start));
+                    if (positivelyFits(index, callee, definition, record, result, preserved)) positiveFamilies.add(family);
+                    else issues.push({ family, site, callee, reason: 'argument-compatibility-unverified' });
+                }
+            }
+        }
+        // Overload declarations describe one call interface. A positively
+        // fitting alternative settles it; a merely possible alternative
+        // prevents a different signature's arity from claiming a break.
+        for (const issue of issues) {
+            if (positiveFamilies.has(issue.family)) continue;
+            if (issue.mismatch && !possibleFamilies.has(issue.family)) mismatches.push(issue.mismatch);
+            else uncertain(issue.site, issue.callee.name, issue.reason || 'overload-compatibility-unverified');
+        }
+        for (const entry of [...(callees.unverifiedCallees || []), ...(callees.initializerReviews || [])]) {
+            // External packages are outside this fit check. A candidate
+            // project declaration, however, cannot silently become READY.
+            if (!(entry.ownerCount > 0 || entry.initializerOf || index.symbols.has(entry.name))) continue;
+            for (const site of entry.siteProvenance || []) {
+                if (byStart.has(site.start)) uncertain(site, entry.name, entry.reason || 'outgoing-target-unresolved');
+            }
+        }
+        const unique = rows => [...new Map(rows.map(row => [JSON.stringify(row), row])).values()]
+            .sort((a, b) => a.line - b.line || (a.column || 0) - (b.column || 0) || ((a.name || a.target || '') < (b.name || b.target || '') ? -1 : (a.name || a.target || '') > (b.name || b.target || '') ? 1 : 0));
+        return { mismatches: unique(mismatches), unsettled: unique(unsettled) };
+    };
+}
+
+module.exports = { outgoingChecker };

package/core/output/analysis-ext.js

@@ -3,7 +3,8 @@
  */
 
 const { dynamicImportsNote, formatLineRanges, unverifiedReasonLabel, advisoryLine } = require('./shared');
-const { formatAccountLines, formatCalleeAccountLine, unverifiedCalleeLines, initializerReviewLines } = require('./analysis');
+const { paramFact } = require('../registry');
+const { formatAccountLines, formatSharedAccountLines, formatCalleeAccountLine, unverifiedCalleeLines, initializerReviewLines } = require('./analysis');
 
 /**
  * Format related command output - text
@@ -200,6 +201,8 @@ function formatDiffImpact(result, options = {}) {
 
     const lines = [];
     const MAX_CALLERS_PER_FN = options.all ? Infinity : 30;
+    const unverifiedLimit = options.all ? Infinity
+        : Number.isInteger(options.top) && options.top > 0 ? options.top : paramFact('top', 'unverifiedRows');
 
     lines.push(`Diff Impact Analysis (vs ${result.base})`);
     lines.push('═'.repeat(60));
@@ -262,7 +265,7 @@ function formatDiffImpact(result, options = {}) {
             // Unverified tier: visible one-liners with reasons (never silently dropped)
             const unverified = fn.unverifiedCallers || [];
             if (unverified.length > 0) {
-                const cap = options.all ? Infinity : 10;
+                const cap = unverifiedLimit;
                 lines.push(`  Unverified call sites (${unverified.length}) — call syntax, no binding/receiver evidence:`);
                 for (const u of unverified.slice(0, cap)) {
                     const caller = u.callerName ? ` [${u.callerName}]` : '';
@@ -275,11 +278,15 @@ function formatDiffImpact(result, options = {}) {
                 }
             }
 
-            // Conservation contract lines, indented inside the function block
-            for (const al of formatAccountLines(fn.account)) {
+            // Conservation contract lines, indented inside the function block.
+            // What holds for every symbol of the repository is said once,
+            // after the last function.
+            for (const al of formatAccountLines(fn.account, { shared: false })) {
                 lines.push(`  ${al}`);
             }
         }
+        const withAccount = result.functions.find(fn => fn.account);
+        if (withAccount) lines.push(...formatSharedAccountLines(withAccount.account));
     }
 
     // New functions
@@ -300,11 +307,12 @@ function formatDiffImpact(result, options = {}) {
             const remaining = fn.remainingCallSites || [];
             if (remaining.length > 0) {
                 lines.push(`  ⚠ still called from ${remaining.length} site(s) — name-level matches:`);
-                for (const site of remaining.slice(0, 10)) {
+                const cap = unverifiedLimit;
+                for (const site of remaining.slice(0, cap)) {
                     lines.push(`    ${site.relativePath}:${site.line}  ${site.content}`);
                 }
-                if (remaining.length > 10) {
-                    lines.push(`    ... and ${remaining.length - 10} more`);
+                if (remaining.length > cap) {
+                    lines.push(`    ... and ${remaining.length - cap} more`);
                 }
             }
         }
@@ -316,14 +324,16 @@ function formatDiffImpact(result, options = {}) {
         for (const symbol of result[key]) {
             lines.push(`  ${symbol.type} ${symbol.name} — ${symbol.relativePath}:${symbol.startLine}`);
             if (symbol.impact) {
-                lines.push(require('./analysis').formatImpact(symbol.impact, { compact: true }));
+                lines.push(require('./analysis').formatImpact(symbol.impact, { compact: true,
+                    all: options.all, top: options.top, allHint: options.allHint,
+                    evidenceBands: options.evidenceBands }));
             } else {
                 const refs = symbol.remainingReferences || [];
                 lines.push(`  Remaining name references: ${refs.length} unverified (deleted target)`);
-                for (const site of refs.slice(0, MAX_CALLERS_PER_FN)) {
+                for (const site of refs.slice(0, unverifiedLimit)) {
                     lines.push(`    ${site.file}:${site.line}: ${site.expression}`);
                 }
-                if (refs.length > MAX_CALLERS_PER_FN) lines.push(`    (+${refs.length - MAX_CALLERS_PER_FN} more)`);
+                if (refs.length > unverifiedLimit) lines.push(`    (+${refs.length - unverifiedLimit} more)`);
             }
         }
     }

package/core/output/analysis.js

@@ -5,7 +5,11 @@ const fs = require('fs');
 const path = require('path');
 const { langTraits } = require('../../languages');
 const { dynamicImportsNote, formatGitLine, unverifiedReasonLabel } = require('./shared');
+const { paramFact } = require('../registry');
 const { provenanceReplacer } = require('./provenance');
+const { matchLabelCounts, reasonList } = require('../source-universe');
+const { uncertaintyClassOf, partitionUnverified, runtimeFamilyKey } = require('../review-items');
+const { reasonSummaryLine } = require('../evidence-bands');
 
 /**
  * One short sentence (~80 chars) of a docstring, suitable for inline display
@@ -93,12 +97,43 @@ function formatAmbiguityCandidates(lines, ambiguity) {
     }
 }
 
+/**
+ * The account lines that hold for every symbol of the repository: paths
+ * nothing could be read from, so no name can be cleared against them. One
+ * line, with the reasons; the paths are listed in `repo` health.
+ */
+function formatSharedAccountLines(account) {
+    const opaque = account && account.opaque;
+    if (!opaque || opaque.count === 0) return [];
+    const sample = (opaque.sample || []).map(entry => `${entry.path} (${entry.reason})`);
+    const more = opaque.count - sample.length;
+    return [`WARNING: ${opaque.count} path${opaque.count === 1 ? '' : 's'} could not be searched ` +
+        `(${reasonList(opaque.reasons)}), so no name is cleared against ${opaque.count === 1 ? 'it' : 'them'}: ` +
+        `${sample.join(', ')}${more > 0 ? `, +${more} more` : ''}. See repo --sections=health.`];
+}
+
 /**
  * Render the conservation contract lines: ACCOUNT and CONTRACT (always),
- * WARNING (unparsed files containing the symbol), FILTERED (display-filter
+ * WARNING (what weakens the claim for THIS symbol), FILTERED (display-filter
  * hides). Returns [] when no account is present (e.g. class-type context).
+ *
+ * CONTRACT is a state, not a sentence. What the states never mean is the
+ * same for every answer and is stated where it is read once (the tool
+ * description, the usage guide, `repo` health): a complete text partition
+ * is not semantic completeness, and a zero is not deletion proof.
+ *   text-complete                      every literal-name line of project
+ *                                      source was classified;
+ *   text-complete, zero observed       ... and none is a use;
+ *   text-complete over indexed source  ... except lines in source UCN reads
+ *                                      but does not analyze, listed below;
+ *   degraded                           some line or path could not be
+ *                                      classified at all; see WARNING.
+ *
+ * `shared: false` leaves out the lines that hold for every symbol of the
+ * repository (paths nothing could be read from): a caller that prints many
+ * accounts prints those once, through formatSharedAccountLines.
  */
-function formatAccountLines(account) {
+function formatAccountLines(account, { shared = true } = {}) {
     if (!account) return [];
     const lines = [];
     const nc = account.nonCall || { imports: 0, definitions: 0, references: 0, unclassifiedText: 0, total: 0 };
@@ -107,7 +142,7 @@ function formatAccountLines(account) {
         `${account.confirmed} confirmed, ${account.unverified} unverified, ` +
         `${nc.total} non-call (${nc.imports} import, ${nc.definitions} definition, ${nc.references} reference, ${nc.unclassifiedText} other-text), ` +
         `${account.excluded ? account.excluded.total : 0} other-target, ` +
-        `${account.unsupported && account.unsupported.lines > 0 ? `${account.unsupported.lines} unsupported-language, ` : ''}` +
+        `${account.unsupported && account.unsupported.lines > 0 ? `${account.unsupported.lines} unanalyzed, ` : ''}` +
         `${account.unaccounted} unaccounted`;
     if (account.beyondText && account.beyondText.count > 0) {
         line += ` (+${account.beyondText.count} beyond-text caller${account.beyondText.count === 1 ? '' : 's'})`;
@@ -115,31 +150,31 @@ function formatAccountLines(account) {
     lines.push(line);
     const contract = account.contract || {};
     const unsupported = account.unsupported ||
-        { fileCount: 0, lines: 0, files: [], languages: {}, sites: [], sitesTruncated: false };
+        { fileCount: 0, lines: 0, files: [], languages: {}, reasons: {}, sites: [], sitesTruncated: false };
+    const opaqueCount = account.opaque ? account.opaque.count : 0;
     const textComplete = contract.textComplete !== undefined
         ? contract.textComplete
         : Boolean(account.conserved) && !(account.unparsed && account.unparsed.fileCount > 0) &&
             unsupported.lines === 0 &&
-            !(account.unreadableFiles && account.unreadableFiles.length > 0);
-    // When the ONLY gap is unsupported-language occurrences, say exactly that
-    // instead of the generic DEGRADED sentence: the partition over supported
-    // languages is still conserved, and the gap is enumerated below.
-    const unsupportedOnly = !textComplete && unsupported.lines > 0 &&
+            !(account.unreadableFiles && account.unreadableFiles.length > 0) &&
+            opaqueCount === 0;
+    // When the ONLY gap is occurrences in unanalyzed source, say exactly
+    // that: the partition over indexed source is still conserved, and the
+    // gap is enumerated below.
+    const unanalyzedOnly = !textComplete && unsupported.lines > 0 &&
         Boolean(account.conserved) &&
         !(account.unparsed && account.unparsed.fileCount > 0) &&
-        !(account.unreadableFiles && account.unreadableFiles.length > 0);
-    if (unsupportedOnly) {
-        const langs = Object.keys(unsupported.languages).join(', ');
-        lines.push(`CONTRACT: literal-name text partition complete over SUPPORTED languages only — ` +
-            `${unsupported.lines} line${unsupported.lines === 1 ? '' : 's'} in unsupported-language file${unsupported.fileCount === 1 ? '' : 's'}` +
-            `${langs ? ` (${langs})` : ''} NOT analyzed (see WARNING; verify with grep/ripgrep). ` +
-            'Semantic completeness is not claimed.');
+        !(account.unreadableFiles && account.unreadableFiles.length > 0) &&
+        opaqueCount === 0;
+    if (unanalyzedOnly) {
+        lines.push('CONTRACT: text-complete over indexed source; ' +
+            `${unsupported.lines} line${unsupported.lines === 1 ? '' : 's'} in unanalyzed source (see WARNING)`);
     } else if (!textComplete) {
-        lines.push('CONTRACT: literal-name text partition is DEGRADED; review WARNING and unaccounted lines before acting. Semantic completeness is not claimed.');
+        lines.push('CONTRACT: degraded; see WARNING');
     } else if (contract.observedTextZero) {
-        lines.push('CONTRACT: observed-text zero only; every literal-name line was classified, but aliases, indirect calls, generated code, and runtime dispatch may exist. Not safe-delete proof.');
+        lines.push('CONTRACT: text-complete, zero observed; not deletion proof');
     } else {
-        lines.push('CONTRACT: literal-name text partition complete; semantic completeness is not claimed (aliases, indirect calls, generated code, and runtime dispatch may exist).');
+        lines.push('CONTRACT: text-complete');
     }
     if (account.unparsed && account.unparsed.fileCount > 0) {
         lines.push(`WARNING: ${account.unparsed.fileCount} unparsed file${account.unparsed.fileCount === 1 ? '' : 's'} ` +
@@ -156,12 +191,11 @@ function formatAccountLines(account) {
             `${rec.lines > shown.length ? `, ... and ${rec.lines - shown.length} more` : ''}`);
     }
     if (unsupported.lines > 0) {
-        const langParts = Object.entries(unsupported.languages)
-            .map(([lang, count]) => `${lang}: ${count}`).join(', ');
+        const kinds = matchLabelCounts(unsupported);
         lines.push(`WARNING: ${unsupported.lines} line${unsupported.lines === 1 ? '' : 's'} in ` +
-            `${unsupported.fileCount} unsupported-language file${unsupported.fileCount === 1 ? '' : 's'} ` +
+            `${unsupported.fileCount} unanalyzed file${unsupported.fileCount === 1 ? '' : 's'} ` +
             `contain${unsupported.lines === 1 ? 's' : ''} "${account.symbol}"` +
-            `${langParts ? ` (${langParts})` : ''} — NOT analyzed; verify with grep/ripgrep:`);
+            `${kinds ? ` (${kinds})` : ''} — NOT analyzed; verify with grep/ripgrep:`);
         const shown = unsupported.sites.slice(0, 5);
         for (const site of shown) {
             lines.push(`  ${site.file}:${site.line}  ${site.text}`);
@@ -173,14 +207,7 @@ function formatAccountLines(account) {
     if (account.unreadableFiles && account.unreadableFiles.length > 0) {
         lines.push(`WARNING: ${account.unreadableFiles.length} unreadable file(s) skipped: ${account.unreadableFiles.join(', ')}`);
     }
-    if (account.skippedSources && account.skippedSources.length > 0) {
-        const shown = account.skippedSources.slice(0, 5)
-            .map(issue => `${issue.relativePath} (${issue.reason})`);
-        lines.push(`WARNING: ${account.skippedSources.length} source discovery gap(s) make this index partial: ${shown.join(', ')}`);
-        if (account.skippedSources.length > shown.length) {
-            lines.push(`  ... and ${account.skippedSources.length - shown.length} more; run repo --sections=health for the full reason set.`);
-        }
-    }
+    if (shared) lines.push(...formatSharedAccountLines(account));
     if (account.filtered && account.filtered.total > 0) {
         const parts = [];
         const f = account.filtered.byFlag || {};
@@ -192,6 +219,15 @@ function formatAccountLines(account) {
     return lines;
 }
 
+/**
+ * Rows an unverified list prints: every one with `all`, `top` when it was
+ * given, ten otherwise. The header always states the full count.
+ */
+function unverifiedRowCap(options) {
+    if (options?.all) return Infinity;
+    return Number.isInteger(options?.top) && options.top > 0 ? options.top : paramFact('top', 'unverifiedRows');
+}
+
 /**
  * Single-node CALLEE ACCOUNT line (context/smart — the per-def callee
  * contract from #223). Matches the tree rollup's arithmetic phrasing.
@@ -328,9 +364,7 @@ function formatContextJson(context) {
                     ...(c.dispatchVia && { dispatchVia: c.dispatchVia }),
                     ...(c.dispatchCandidates != null && { dispatchCandidates: c.dispatchCandidates }),
                     ...(c.externalContract && { externalContract: true }),
-                    uncertaintyClass: c.uncertaintyClass ||
-                        (c.reason === 'possible-dispatch' && c.dispatchVia
-                            ? 'runtime-dispatch' : 'actionable-ambiguity'),
+                    uncertaintyClass: uncertaintyClassOf(c),
                     ...(c.dispatchFamily && { dispatchFamily: c.dispatchFamily }),
                 })),
                 ...(context.ambiguityCandidates && {
@@ -391,9 +425,7 @@ function formatContextJson(context) {
                 ...(c.dispatchVia && { dispatchVia: c.dispatchVia }),
                 ...(c.dispatchCandidates != null && { dispatchCandidates: c.dispatchCandidates }),
                 ...(c.externalContract && { externalContract: true }),
-                uncertaintyClass: c.uncertaintyClass ||
-                    (c.reason === 'possible-dispatch' && c.dispatchVia
-                        ? 'runtime-dispatch' : 'actionable-ambiguity'),
+                uncertaintyClass: uncertaintyClassOf(c),
                 ...(c.dispatchFamily && { dispatchFamily: c.dispatchFamily }),
             })),
             ...(context.ambiguityCandidates && {
@@ -506,7 +538,9 @@ function formatContext(ctx, options = {}) {
         if (typeUnverified.length > 0) {
             lines.push(`\nCALLERS — UNVERIFIED (${typeUnverified.length}) — call or callable-reference syntax, no binding/receiver evidence:`);
             formatAmbiguityCandidates(lines, ctx.ambiguityCandidates);
-            const cap = 10;
+            const typeReasons = reasonSummaryLine(typeUnverified, options.evidenceBands);
+            if (typeReasons) lines.push(typeReasons);
+            const cap = unverifiedRowCap(ctx.meta);
             let shown = 0;
             for (const u of typeUnverified) {
                 if (shown >= cap) break;
@@ -628,20 +662,15 @@ function formatContext(ctx, options = {}) {
     // This separates unavoidable language semantics from ambiguity the agent
     // can investigate.
     const unverified = ctx.unverifiedCallers || [];
-    const runtimeDispatch = unverified.filter(u =>
-        u.uncertaintyClass === 'runtime-dispatch' ||
-        (u.reason === 'possible-dispatch' && u.dispatchVia));
-    const compileTimeDispatch = unverified.filter(u =>
-        u.uncertaintyClass === 'compile-time-dispatch');
-    const actionableUnverified = unverified.filter(u =>
-        u.uncertaintyClass !== 'compile-time-dispatch' &&
-        !(u.uncertaintyClass === 'runtime-dispatch' ||
-          (u.reason === 'possible-dispatch' && u.dispatchVia)));
+    // One classification for the text, the JSON and the review counts
+    // (core/review-items.js).
+    const {
+        runtime: runtimeDispatch, compileTime: compileTimeDispatch, actionable: actionableUnverified,
+    } = partitionUnverified(unverified);
     if (runtimeDispatch.length > 0) {
         const groups = new Map();
         for (const site of runtimeDispatch) {
-            const key = `${site.dispatchVia}\0${site.dispatchCandidates ?? ''}\0` +
-                `${site.externalContract ? 'external' : 'project'}`;
+            const key = runtimeFamilyKey(site);
             if (!groups.has(key)) groups.set(key, []);
             groups.get(key).push(site);
         }
@@ -732,11 +761,13 @@ function formatContext(ctx, options = {}) {
     }
 
     // Actionable ambiguity: call syntax without enough identity evidence.
-    // Always visible and capped at 10 one-liners unless --all.
+    // Always visible; ten one-liners unless --top or --all says otherwise.
     if (actionableUnverified.length > 0) {
         lines.push(`${compact ? '' : '\n'}CALLERS — UNVERIFIED (${actionableUnverified.length}) — call or callable-reference syntax, no binding/receiver evidence:`);
         formatAmbiguityCandidates(lines, ctx.ambiguityCandidates);
-        const cap = (ctx.meta && ctx.meta.all) ? Infinity : 10;
+        const reasons = reasonSummaryLine(actionableUnverified, options.evidenceBands);
+        if (reasons) lines.push(reasons);
+        const cap = unverifiedRowCap(ctx.meta);
         let shown = 0;
         for (const u of actionableUnverified) {
             if (shown >= cap) break;
@@ -862,6 +893,8 @@ function formatImpact(impact, options = {}) {
     }
 
     const compact = !!options.compact;
+    const allHint = options.allHint || 'use --all';
+    const unverifiedCap = unverifiedRowCap(options);
     const lines = [];
 
     // Header
@@ -970,14 +1003,14 @@ function formatImpact(impact, options = {}) {
             const reason = impact.propertyAccesses ? 'matching attribute syntax, receiver identity unresolved'
                 : 'matching value syntax, binding identity unresolved';
             lines.push(`${compact ? '' : '\n'}UNVERIFIED ${label} ACCESS CANDIDATES (${access.unverifiedSites.length}) — ${reason}:`);
-            for (const site of access.unverifiedSites.slice(0, 10)) {
+            for (const site of access.unverifiedSites.slice(0, unverifiedCap)) {
                 const caller = site.callerName ? ` [${site.callerName}]` : '';
                 const expr = site.expression ? `: ${site.expression.replace(/\s+/g, ' ').slice(0, 100)}` : '';
                 const why = impact.valueAccesses && site.reason ? ` (${site.reason})` : '';
                 lines.push(`  ${site.file}:${site.line}${caller} [${site.accessKind || 'access'}${Number.isInteger(site.column) ? `, column ${site.column + 1}` : ''}]${expr}${why}`);
             }
-            if (access.unverifiedSites.length > 10) {
-                lines.push(`  (+${access.unverifiedSites.length - 10} more unverified)`);
+            if (access.unverifiedSites.length > unverifiedCap) {
+                lines.push(`  (+${access.unverifiedSites.length - unverifiedCap} more unverified — ${allHint})`);
             }
         }
         const valueAccount = impact.valueAccesses?.account;
@@ -999,21 +1032,23 @@ function formatImpact(impact, options = {}) {
         }
         if (refs.unverifiedSites.length > 0) {
             lines.push(`${compact ? '' : '\n'}UNVERIFIED TYPE REFERENCE CANDIDATES (${refs.unverifiedSites.length}) — the name, the type lookup cannot decide what it names:`);
-            for (const site of refs.unverifiedSites.slice(0, 10)) {
+            for (const site of refs.unverifiedSites.slice(0, unverifiedCap)) {
                 const expr = site.expression ? `: ${site.expression.replace(/\s+/g, ' ').slice(0, 100)}` : '';
                 lines.push(`  ${site.file}:${site.line} [${position(site)}]${expr} (${site.reason})`);
             }
-            if (refs.unverifiedSites.length > 10) {
-                lines.push(`  (+${refs.unverifiedSites.length - 10} more unverified)`);
+            if (refs.unverifiedSites.length > unverifiedCap) {
+                lines.push(`  (+${refs.unverifiedSites.length - unverifiedCap} more unverified — ${allHint})`);
             }
         }
         if (refs.account) lines.push(formatTypeAccount(impact.function, refs));
     }
 
-    // Unverified tier: visible, capped at 10 one-liners
+    // Unverified tier: visible; ten one-liners unless --top or --all says otherwise
     if (impactUnverified.length > 0) {
         lines.push(`${compact ? '' : '\n'}UNVERIFIED CALL SITES (${impactUnverified.length}) — call or callable-reference syntax, no binding/receiver evidence:`);
-        const cap = 10;
+        const reasons = reasonSummaryLine(impactUnverified, options.evidenceBands);
+        if (reasons) lines.push(reasons);
+        const cap = unverifiedCap;
         for (const site of impactUnverified.slice(0, cap)) {
             const caller = site.callerName ? ` [${site.callerName}]` : '';
             const reason = site.reason ? ` (${unverifiedReasonLabel(site)})` : '';
@@ -1021,7 +1056,7 @@ function formatImpact(impact, options = {}) {
             lines.push(`  ${site.file}:${site.line}${caller}${expr}${reason}`);
         }
         if (impactUnverified.length > cap) {
-            lines.push(`  (+${impactUnverified.length - cap} more unverified)`);
+            lines.push(`  (+${impactUnverified.length - cap} more unverified — ${allHint})`);
         }
     }
 
@@ -1171,6 +1206,8 @@ function formatAbout(about, options = {}) {
     if (aboutUnverified && aboutUnverified.total > 0) {
         lines.push('');
         lines.push(`CALLERS — UNVERIFIED (${aboutUnverified.total}) — call or callable-reference syntax, no binding/receiver evidence:`);
+        const reasons = reasonSummaryLine(aboutUnverified.reasons || aboutUnverified.top, options.evidenceBands);
+        if (reasons) lines.push(reasons);
         for (const u of aboutUnverified.top) {
             const caller = u.callerName ? ` [${u.callerName}]` : '';
             const reason = u.reason ? ` (${unverifiedReasonLabel(u)})` : '';
@@ -1325,6 +1362,7 @@ module.exports = {
     // Shared with output/tracing.js: the tree commands render the same
     // root-hop ACCOUNT/WARNING/FILTERED lines as context/impact.
     formatAccountLines,
+    formatSharedAccountLines,
     // Shared with output/analysis-ext.js (smart): single-node callee contract.
     formatCalleeAccountLine,
     unverifiedCalleeLines,