fix(scanner): Keep ast-grep authoritative, dedupe coverage notes

[reneleonhardt]

Follow-up to #105, closing the two open findings from the maintainer re-review on the coverage line.

What this PR does

Both findings were in the coverage line — cosmetic but user-facing:

1. The Rust note printed twice. ast-grep and rust-cargo both carried an identical Detail, and GraphCoverage.AddSource appended each source's detail to Notes with no dedup. A two-crate workspace rendered:

Coverage: partial — Rust macro-generated, string-routed, and #[path] module edges may be
unresolved; Rust macro-generated, string-routed, and #[path] module edges may be unresolved

2. ast-grep was labeled mixed carrying a Rust-specific detail. The DetectLanguage(...) == "rust" loop in scanner/astgrep.go demoted ast-grep's source status even though its extraction is not degraded — the macro/#[path]/string-routed caveat is a Rust resolution gap, which rust-cargo owns. Consequences: on a Go+Rust monorepo the Go analysis was reported degraded too, and the same sentence landed on two sources, producing the duplicate in (1).

Changes

• scanner/astgrep.go — ast-grep stays authoritative on a successful scan regardless of language; the Rust caveat is no longer attached to its source. The file graph already records rust-cargo (mixed, with the caveat) for Rust repos, so coverage remains partial where it should.
• scanner/outcome.go — GraphCoverage.AddSource records each source detail once (dedup before append), so every Notes consumer (MCP structured coverage_notes, --importers, intent, watch state) inherits the dedup.
• render/depgraph.go — renderCoverageLine renders each detail once, so a shared caveat prints a single warning in the text output even if two sources carry it.
• scanner/types.go — the default newDepsProject coverage mirrors the production shape (ast-grep authoritative + rust-cargo mixed carrying the note) instead of attaching the note to ast-grep.

Before / after

JSON sources before:

{"name": "ast-grep",       "status": "mixed",         "detail": "Rust macro-generated, ..."}
{"name": "cargo-metadata", "status": "authoritative"}
{"name": "rust-cargo",     "status": "mixed",         "detail": "Rust macro-generated, ..."}

JSON sources after — the list reads as what each tool actually contributed:

{"name": "ast-grep",       "status": "authoritative"}
{"name": "cargo-metadata", "status": "authoritative"}
{"name": "rust-cargo",     "status": "mixed",         "detail": "Rust macro-generated, ..."}

Regression tests

• TestAstGrepScanDirectoryRustStaysAuthoritative — Rust scans keep ast-grep authoritative with no Rust detail.
• TestGraphCoverageAddSourceDedupesSharedDetail — shared caveat recorded once across sources.
• TestDepgraphRendersSharedCoverageDetailOnce — a shared detail renders once in text output.
• TestNewDepsProjectRustCaveatOwnedByRustCargoSource — default coverage shape matches production.

Verification

• go build ./..., go vet ./scanner ./render ./analysis ., gofmt clean.
• Targeted scanner coverage/contract tests and render TestDepgraph* pass.

Developed with carefully directed, manually reviewed AI assistance.

Co-authored-by: GPT-5.6 Sol codex@openai.com

[Copilot]

Pull request overview

Keeps ast-grep provenance authoritative while assigning Rust resolution caveats to rust-cargo and deduplicating user-facing coverage notes.

Changes:

• Corrects Rust coverage source ownership.
• Deduplicates coverage notes in scanner and rendered output.
• Adds regression coverage and ignores runtime caches.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.gitignore	Ignores .cache/ runtime state.
scanner/astgrep.go	Keeps successful ast-grep scans authoritative.
scanner/astgrep_test.go	Tests Rust scan provenance.
scanner/contracts_test.go	Tests default Rust coverage sources.
scanner/outcome.go	Deduplicates coverage notes.
scanner/outcome_test.go	Tests shared-detail deduplication.
scanner/types.go	Assigns the Rust caveat to rust-cargo.
render/depgraph.go	Deduplicates rendered source details.
render/depgraph_test.go	Tests single rendering of shared details.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[JordanCoin]

Verified on a real two-crate Cargo workspace rather than from the description:

#106 — ast-grep is now authoritative; only rust-cargo carries the Rust caveat. Coverage still correctly reports partial, so the honesty is preserved while the attribution is fixed.

#107 — the coverage line prints the caveat once.

No regression on a Go-only repo: still complete with a single authoritative ast-grep source.

Deduping at AddSource rather than at the renderer is the right call — every consumer (MCP coverage_notes, --importers, intent, watch state) inherits it, instead of each render path needing its own fix. Full suite green, vet clean. Thanks for turning these around before I'd even finished filing them.