The Flux CD org, as a dependency graph.

Reading the two columns.Direct dependents counts distinct active sibling repositories at or above Riftmap's 0.8 confidence floor — the same bar impact mode applies, and the one every figure in the nine-org scan is computed on. All declared references holds that scope and drops only the floor, so the gap between the columns isolates exactly one thing: how much of this org's coupling is declared outright versus inferred. Across the org the floor discards 25 of 118 repo-to-repo pairs. Multiple manifests pointing at the same repository count once. The graph above additionally draws archived repositories, so a node there can show more arrows than either column reports.

What the floor throws away here. A repository can look larger in the graph than it reads in this table, and these are the ones where that gap is worth naming: fluxcd/flux2 loses 11 (bare git URL) . What those references have in common is that they had to be inferred rather than read: a bare git URL sitting in a shell script or a README is a text signal rather than a declared dependency, and a bare image name has to be guessed back to the repository that publishes it. Riftmap scores both below the floor and never counts them. That is a deliberate choice about what the word "dependency" is allowed to mean, and it costs this org its highest raw numbers.

Check it rather than trust it. Both columns are recomputable from the scan itself: every parsed reference as CSV — including the ones below the floor, each flagged — and the repository list with its archived flags and scan timestamps. Same export the nine-org scan publishes, per org.