bug: --include-untracked lets an untracked JSON file steal the routed-test attribution from the source file the test imports

[aryamthecodebreaker]

Summary

In --working-tree --include-untracked mode, an untracked non-source file (e.g. a plain data.json) steals the Impact Graph's routed-test attribution. The test file is still correctly discovered, but it is claimed to be the routed test for the JSON file rather than for the source file it actually imports. Agents reading the map are told the test covers a data blob.

No FixMap-generated artifacts are needed — any untracked JSON does it.

Environment

• fixmap 0.9.0 (npm global)
• Windows (win32), Node v24.13.0

Repro

git init demo && cd demo
Set-Content package.json '{"name":"demo","scripts":{"test":"node --test"}}'
New-Item src, test | Out-Null
Set-Content src/pay.js 'export function pay(amount){ return amount*2; }'
Set-Content test/pay.test.js 'import "../src/pay.js";'
git add -A; git commit -m init

# edit the source, add an unrelated untracked json
Set-Content src/pay.js 'export function pay(amount){ return amount*3; }'
Set-Content data.json '{"note":"plain data"}'

fixmap plan --working-tree --include-untracked

Actual

## Impact Graph

- `test/pay.test.js` (high confidence, impact 13): this file imports src/pay.js; routed test for data.json via npm run test

The same line says the file imports src/pay.js, then attributes the route to data.json.

Expected

- `test/pay.test.js` (high confidence, impact 13): this file imports src/pay.js; routed test for src/pay.js via npm run test

Control cases

• Same state without data.json: attribution is correct (routed test for src/pay.js). Verified.
• Same state with an untracked saved-report.json (a FixMap report) instead: identical wrong attribution (routed test for saved-report.json). Verified.

So the trigger is simply a non-source file entering the changed set ahead of the source file in ranked order; the routed-test line then attaches to the wrong changed path.

Likely cause

The routed-test annotation seems to pick whichever changed/context entry currently sits adjacent in the ranked list, instead of naming the imported source file (src/pay.js) that justified routing the test in the first place. The import relationship is already computed correctly (stated in the same sentence), so the attribution target just needs to come from that relationship rather than from rank position.