fix(uncertainty): withdraw the real-absence claim over untracked source

[nhuphuoc215]

_staleness proves the graph current two ways: build commit vs HEAD, and the target file's mtime vs the build timestamp. Neither can see a file git has never been told about — the commit still matches, and a file with no row in the graph has no mtime to compare.

An incremental update finds changes through git diff, so that file is absent from the index however fresh the build is. The result is that the strongest sentence this module produces lands on the case it is least true for:

agent writes new_consumer.py, doesn't `git add` it
→ references_to(Foo) → 0
→ "'Foo' is indexed and the graph is current, so this 0 is a real absence"

It then stops looking for the file it just wrote.

This adds untracked source as a third staleness signal, called from _settled() so it runs on both paths that would otherwise report the graph as current — including the early return taken when a graph has no last_updated, which is where my first attempt silently did nothing.

Two things keep it quiet. "Source" comes from the extensions already in the index rather than a fixed list, so a repo whose languages you don't parse never gets flagged; and --porcelain already honours .gitignore, so build output stays out. It is empty-result-only like every other marker here, so nothing that carries results changes. Cost is one git status on a path that already shells out for _live_git_head, ~10ms, never the hot path.

Six tests, all of which fail when the signal is removed. ruff and mypy clean, full suite 2991 passed, 9 skipped, 2 xpassed.

One thing I'd like your call on

Measured on a 1,489-file TypeScript monorepo, a single untracked consumer moved callers_of 4→3, importers_of 7→6 and references_to 12→11. All non-zero — so this marker never fires for any of them. The shape that actually bites is low, not empty, and low is worse because nobody thinks to doubt it.

Extending the note to non-empty results would cover that. It only appears while untracked source exists, which is not the steady state, so "non-empty responses are unchanged" would still hold for virtually every call — the tokens are spent only in the window where the answer is wrong. Happy to push it onto this branch if you want it.

Relation to integration/token-efficiency-hardening

Composes with _find_content_mismatches rather than overlapping it: that pass walks files already in the graph, so it catches the revert round-trip but not a file the index has never held.

[github-actions]

code-review-graph review

Overall risk: 0.65 (MEDIUM) — 14 changed function(s)/class(es), 2 affected flow(s), 5 test gap(s)

Risk-scored changes

Risk	Level	Symbol	Location	Tested
0.65	medium	code_review_graph/uncertainty.py::_settled	code_review_graph/uncertainty.py:359	no
0.65	medium	code_review_graph/uncertainty.py::_staleness	code_review_graph/uncertainty.py:374	no
0.60	medium	code_review_graph/uncertainty.py::_untracked_sources	code_review_graph/uncertainty.py:297	no
0.60	medium	code_review_graph/uncertainty.py::_untracked_note	code_review_graph/uncertainty.py:348	no
0.35	low	code_review_graph/uncertainty.py::_is_untracked_note	code_review_graph/uncertainty.py:338	no
0.35	low	code_review_graph/uncertainty.py::empty_query_confidence	code_review_graph/uncertainty.py:428	yes
0.35	low	tests/test_uncertainty.py::_empty_query	tests/test_uncertainty.py:622	yes
0.15	low	tests/test_uncertainty.py::_tracked_repo	tests/test_uncertainty.py:604	yes
0.05	low	tests/test_uncertainty.py::test_untracked_source_defeats_the_real_absence_claim	tests/test_uncertainty.py:629	(test)
0.05	low	tests/test_uncertainty.py::test_untracked_note_names_the_remedy_within_budget	tests/test_uncertainty.py:643	(test)

Affected execution flows

• empty_search_confidence — criticality 0.38, 11 node(s) across 1 file(s)
• empty_impact_confidence — criticality 0.36, 15 node(s) across 1 file(s)

Test gaps

• code_review_graph/uncertainty.py::_untracked_sources (code_review_graph/uncertainty.py:297)
• code_review_graph/uncertainty.py::_is_untracked_note (code_review_graph/uncertainty.py:338)
• code_review_graph/uncertainty.py::_untracked_note (code_review_graph/uncertainty.py:348)
• code_review_graph/uncertainty.py::_settled (code_review_graph/uncertainty.py:359)
• code_review_graph/uncertainty.py::_staleness (code_review_graph/uncertainty.py:374)

Token savings: this graph-backed report used ~6,064 fewer tokens (~55%) than reading every changed file in full (estimated, chars/4 approximation).

---

Powered by code-review-graph — local-first analysis; no code leaves the CI runner.