Function unexplained 

pub fn unexplained(
    base: &EvaluatedGeneration,
    cand: &EvaluatedGeneration,
    change: &ChangeId,
    args: &BTreeMap<String, Value>,
) -> bool

Whether the candidate differs from the running generation in ways a catalog change’s override cannot explain: services declared or removed (other than the one a service-enable names), flake inputs, or a package with known vulnerabilities that the running generation does not have.