@@ -992,7 +992,10 @@ ${c.bold('Examples:')}
       '--integrations-file <path>',
       `Path to integrations env file (default: ${DEFAULT_INTEGRATIONS_FILE} next to .deepnote file)`
     )
-    .option('--governance', 'Also run the governance checks: SQL correctness and hardcoded credentials')
+    .option(
+      '--governance',
+      'Also run the governance checks: SQL correctness, hardcoded credentials and dependency pinning'
+    )
     .addHelpText('after', () => {
       const c = getChalk()
       return `
@@ -1054,7 +1057,7 @@ ${c.bold('Examples:')}
   ${c.dim('# Use a custom integrations file')}
   $ deepnote lint my-project.deepnote --integrations-file prod-integrations.yaml
 
-  ${c.dim('# Add the governance checks (SQL correctness, hardcoded credentials)')}
+  ${c.dim('# Add the governance checks (SQL correctness, credentials, dependency pinning)')}
   $ deepnote lint my-project.deepnote --governance
 
   ${c.dim('# Use in CI pipeline')}
 
@@ -1289,6 +1289,45 @@ describe('auditWorkspace — dependencies', () => {
     )
   })
 
+  it('measures drift reach over the projects that disagree, not every live consumer', () => {
+    // A live project declaring pandas without a version consumes it but is not party to the
+    // dispute, and a workspace-wide live count is not the reach of this finding either. Both come
+    // from one list now: the projects that pin a version and disagree.
+    const audit = auditWorkspace(
+      workspace([
+        depProject('p1', 'Alpha', { packages: { pandas: '2.0.1' } }),
+        depProject('p2', 'Beta', { packages: { pandas: '1.5.3' } }),
+        depProject('p3', 'Bare', { requirements: ['pandas'] }),
+        depProject('p4', 'Elsewhere', { packages: { numpy: '1.26.0' } }),
+      ]),
+      { now: NOW }
+    )
+
+    const drift = issuesOf(audit, 'dependency-drift')
+    expect(drift).toHaveLength(2)
+    expect(drift[0].details?.projectIds).toEqual(['p1', 'p2'])
+    expect(drift[0].details?.projectCount).toBe(2)
+  })
+
+  it('does not count an abandoned holder as live reach', () => {
+    // Drift only files against maintained projects today, which is what kept a workspace-wide
+    // live count from showing up as a wrong number. Reach is measured among the holders either
+    // way, so it stays right if that filter ever loosens.
+    const audit = auditWorkspace(
+      workspace([
+        ...['a', 'b', 'c'].map(id => depProject(id, id, { packages: { pandas: '2.0.1' } })),
+        depProject('d', 'd', { packages: { pandas: '1.5.3' } }),
+        // Five live projects elsewhere, which are not this finding's reach.
+        ...['x1', 'x2', 'x3', 'x4', 'x5'].map(id => depProject(id, id, { packages: { numpy: '1.26.0' } })),
+      ]),
+      { now: NOW }
+    )
+
+    const drift = issuesOf(audit, 'dependency-drift')[0]
+    expect(drift.details?.projectCount).toBe(4)
+    expect((drift.details?.projectIds as string[]).sort()).toEqual(['a', 'b', 'c', 'd'])
+  })
+
   it('ranks a bare name above a bounded range', () => {
     const audit = auditWorkspace(
       workspace([
 
@@ -784,8 +784,11 @@ export function auditWorkspace(workspace: LoadedWorkspace, options: AuditOptions
       continue
     }
     // Filed against each project that pins a version, because there is no one project at fault —
-    // the finding is that they disagree.
-    for (const consumer of usage.projects.filter(entry => entry.live && entry.version !== undefined)) {
+    // the finding is that they disagree. Those projects are also the finding's holders: a live
+    // consumer that declares the package without a version is not part of the disagreement, and
+    // nothing outside the list is part of its reach.
+    const holders = usage.projects.filter(entry => entry.live && entry.version !== undefined)
+    for (const consumer of holders) {
       issues.push({
         severity: SEVERITY['dependency-drift'],
         code: 'dependency-drift',
@@ -801,7 +804,8 @@ export function auditWorkspace(workspace: LoadedWorkspace, options: AuditOptions
           versions: usage.maintainedVersions,
           allVersions: usage.versions,
           version: consumer.version,
-          projectCount: usage.projects.filter(entry => entry.live).length,
+          projectIds: holders.map(entry => entry.projectId),
+          projectCount: holders.length,
         },
       })
     }
@@ -1119,12 +1123,9 @@ function scoreIssue(issue: PendingAuditIssue, context: ScoreIssueContext): Sever
       // A bare name will install anything; a range at least bounds what can arrive.
       return scoreFinding(issue.code, { age, signal: issue.details?.pin === 'ranged' ? 0.6 : undefined })
 
-    case 'dependency-drift': {
+    case 'dependency-drift':
       // Its reach is the projects that disagree, weighted by how many of them are still live.
-      const projectCount = typeof issue.details?.projectCount === 'number' ? issue.details.projectCount : 1
-      const live = [...context.projectAges.values()].filter(projectAge => projectAge.liveness === 'live').length
-      return scoreFinding(issue.code, { age, reach: { live: Math.min(live, projectCount), total: projectCount } })
-    }
+      return scoreFinding(issue.code, { age, reach: holderReach(issue.details, context.projectAges) })
 
     case 'ingress-integration-orphan':
       // No live consumer by definition — that is the finding. Its reach is the projects still
 
@@ -2,8 +2,9 @@
  * Project-scoped governance checks.
  *
  * These answer "what is wrong inside this project" from the project file alone: queries that are
- * silently wrong, and credentials written into blocks. They run under `deepnote lint --governance`,
- * so they are per-file, deterministic, and need neither the network nor a Python interpreter.
+ * silently wrong, credentials written into blocks, and dependencies that will not install the same
+ * twice. They run under `deepnote lint --governance`, so they are per-file, deterministic, and need
+ * neither the network nor a Python interpreter.
  *
  * The scope split is deliberate and load-bearing. The questions governance also wants answered —
  * is this metric defined two different ways, how many *live* projects read this table, whose
Original file line number	Diff line number	Diff line change
`@@ -2,8 +2,9 @@`
`2`	`2`	`* Project-scoped governance checks.`
`3`	`3`	`*`
`4`	`4`	`* These answer "what is wrong inside this project" from the project file alone: queries that are`
`5`		- * silently wrong, and credentials written into blocks. They run under `deepnote lint --governance`,
`6`		`- * so they are per-file, deterministic, and need neither the network nor a Python interpreter.`
	`5`	`+ * silently wrong, credentials written into blocks, and dependencies that will not install the same`
	`6`	+ * twice. They run under `deepnote lint --governance`, so they are per-file, deterministic, and need
	`7`	`+ * neither the network nor a Python interpreter.`
`7`	`8`	`*`
`8`	`9`	`* The scope split is deliberate and load-bearing. The questions governance also wants answered —`
`9`	`10`	`* is this metric defined two different ways, how many live projects read this table, whose`