Report insufficient evidence explicitly

ober

9d283d1f30b97d371551337d423172d07bf8a46d

diff --git a/README.md b/README.md
index bff0e3b..c79d73b 100644
--- a/README.md
+++ b/README.md
@@ -86,6 +86,7 @@ Verdicts are intentionally conservative:
 - `likely-ai-assisted`
 - `mixed-uncertain`
 - `likely-human-style`
+- `insufficient-evidence`
 
 Only recorded authorship metadata is high-confidence provenance. Heuristic
 verdicts can be wrong for generated scaffolds, formatter-only changes,
diff --git a/main-binary.ss b/main-binary.ss
index 0804607..9de9542 100644
--- a/main-binary.ss
+++ b/main-binary.ss
@@ -494,7 +494,7 @@
          [note-count (note-byte-count repo rev)] [note (bounded-note-text repo rev)] [note-obj (parse-note-object note)]
          [attribution (note-attributions note-obj)]
          [metadata (metadata-hits author-name author-email subject body note)]
-         [eligible? (or (= min-lines 0) (>= (length lines) min-lines))]
+         [eligible? (and (pair? files) (pair? lines) (or (= min-lines 0) (>= (length lines) min-lines)))]
          [sim-pair (similarity-signal lines hashes)]
          [raw-signals (if eligible?
                           (list (message-signal subject body adds) (code-signal lines) (structure-signal paths adds dels lines)
@@ -503,7 +503,10 @@
                           '())]
          [signals (if metadata-only? '() (map (lambda (s) (with-config-weight current-config s)) raw-signals))]
          [score (if metadata-only? 0.0 (aggregate-score signals))]
-         [v (if heuristics-only? (verdict score '() "") (verdict score metadata note))])
+         [insufficient? (and (null? signals) (null? metadata) (string-empty? note))]
+         [v (cond [insufficient? "insufficient-evidence"]
+                  [heuristics-only? (verdict score '() "")]
+                  [else (verdict score metadata note)])])
     (list (make-finding id parent author-name author-email time subject paths adds dels (length lines) note attribution metadata signals score v
                         (warnings files lines note note-obj metadata-only? heuristics-only? min-lines file-count line-count note-count))
           (cadr sim-pair))))
diff --git a/tests/fixture-smoke.sh b/tests/fixture-smoke.sh
index 1c6d887..86fc9d7 100755
--- a/tests/fixture-smoke.sh
+++ b/tests/fixture-smoke.sh
@@ -146,6 +146,18 @@ printf '%s\n' "$malformed" | grep -q '"recorded_ai_note_present":true'
 printf '%s\n' "$malformed" | grep -q '"recorded_attribution":\[\]'
 printf '%s\n' "$malformed" | grep -q 'refs/notes/ai note is not supported JSON'
 
+git -C "$fixture" config user.name "Human Dev"
+git -C "$fixture" config user.email "human@example.test"
+printf 'vendored update\n' >> "$fixture/vendor/library.py"
+git -C "$fixture" add vendor/library.py
+GIT_AUTHOR_DATE='2026-07-29T09:02:00-06:00' \
+GIT_COMMITTER_DATE='2026-07-29T09:02:00-06:00' \
+  git -C "$fixture" commit -q -m 'update vendored library'
+insufficient=$("$root/bin/jerboa-aigit" scan "$fixture" --format json --count 1)
+printf '%s\n' "$insufficient" | grep -q '"verdict":"insufficient-evidence"'
+printf '%s\n' "$insufficient" | grep -q '"signals":\[\]'
+printf '%s\n' "$insufficient" | grep -q 'no changed text files found or commit is unavailable'
+
 if "$root/bin/jerboa-aigit" scan "$fixture/nope" >/tmp/jerboa-aigit-invalid.out 2>&1; then
   echo "invalid repository path should fail" >&2
   exit 1