fix(depgraph): disclose partial impact and dynamic dependents

Merged
TH
7d ago
+202-26

Summary

Make depgraph impact output explicit about its limits: separate value-dependent reachability from value-plus-dynamic dependents, and label command/live-owner lists as lower bounds because injected calls are not modeled. Gate selection remains value-only.

4 tooling files changed. No new call graph or ownership inventory. Closes #4049; part of #4045.

Validation

Head: 26301bb2fad57cbd73ee9817895f5b1a80357f00.

  • All 47 graph/CLI tests passed, including real text/JSON count agreement and bounded dynamic-list output. Independent Sonnet recheck found no required findings.
  • Exact-head affected validation passed every stage before provider integration, including full unit, layering, build and package. Provider integration: 221 passed /1 failed on the existing simulator recording timeout. Receipt: .tmp/validation/run-EZdtMu/receipt.json, exactCommit: true.
  • The identical default-worker pnpm run test:integration:provider on unchanged base 144bd59890 reproduced the same sole failure and counts. Fresh install/build and disposable-checkout cleanup verified.

Draft: base-blocked by #4060; its fix is in unmerged #4065. Current-head CI integration/coverage remains authoritative. This tooling-only change needs no device proof.