fix(cli): meta.json gains the language dimension — a second scan at the same sha preserves the first's record (#664)

[gadievron]

What

The sha-level meta.json now lives at <run-dir>/<language>/meta.json (one per language per SHA), so a second scan at the same SHA with a different language preserves the first scan's terminal record. Closes #664.

How

• The keying contract: the scan's writer and finalizer key on the run's effective language (-l flag, else the project pin) — the same string meta.Language stamps. scan -l go on a python-pinned project writes and finalizes go/meta.json; python's record is untouched.
• The adoption guard: resolveScanMode adopts init's pending decision only when its language matches the run's (or is legacy).
• The walk union: LatestScanMeta treats per-language and legacy sha-level records as a union of candidates. A failed/running per-language record no longer shadows a legacy success at the same SHA (the upgrader's last known-good scan). A legacy copy is dropped only when a per-language success of the same owning language exists (the migrated form of the same run).
• The init write site (init.go): the meta write is extracted into writeInitScanMeta, which derives its language from project.Language (never a separate argument — an adjacent same-type arg pair is a silent swap surface). This was the fix-linkage gate's own finding: the inline write site had no test that fails when its key is wrong.
• Path validation: the language is validated as a single safe path element before it becomes one.

Review cycle

Two adversarial dispatch rounds (recorded in the run's receipts) plus a blind re-derivation lane and a deep-code re-derivation lane (run as separate consultations; their findings — the legacy shadow, the wrong-record write, the keying invariant — drove the change-set). A delta round then caught gaps in the change-set itself. A final artifacts-only audit re-ran the mutations and re-derived the collision checks; every mutation it ran was caught by a named guard.

Testing

go build ./..., go vet, and go test ./internal/config/ ./cmd/ ./internal/git/ — 205 test results, 0 failed (full-output execution receipt). Eight behavioral guards, each mutation-verified (the fix's logic mutated with the API kept → the named test fails; revert-based linkage does not apply here because the fix IS a signature change — reverting any single hunk breaks the test files' compilation against the old API, which is recorded as compile-failure companions in the linkage receipt): two-languages-same-SHA, init→scan adoption round-trip, the override writing its own record, the adoption guard, init's write site, legacy-not-shadowed (cross-language and same-language), migrated-legacy dedup, path traversal rejection.

Coordination

• fix(cli): init --pr stamps the checked-out SHA, not the pre-checkout HEAD (#669) #672 (init --pr SHA): file overlap in cmd/init.go; git merge-tree --write-tree → clean; composes semantically (their selectMode move still feeds our helper the final project).
• fix(cli): scan/diff --pr stamp the PR number in the diff manifest (#668) #675 (PR-number stamp): file overlap in cmd/mode.go + cmd/scan.go (different regions); merge-tree → clean.
• No overlap with feat(cost): provider-aware cache accounting — the prerequisite for any prompt-caching control (#626) #661/fix(verify): the three live #652 follow-ups — web_app digest fixture, stdout attacker_model, degenerate descriptor (#653) #670/chore: untrack the generate-context step report (a run artifact, not source) (#666) #671/fix(cli): --pr fetches into a unique ref and restores the checkout (#665) #674/chore(deps): update dependency openai to v3.18.0 #677/chore(deps): update dependency marked to v18.0.14 #678.

Known out-of-scope (pre-existing, flagged for the maintainer)

• Artifact-dir routing still follows the pinned language (ctx.ScanDir), so scan -l go on a python pin lands artifacts under python/ while the meta lands under go/ — adjacent to this issue's artifact-separation note, predates this PR.
• init -l does not validate against languages.Supported(); config.ScanDir's language path is likewise unvalidated (the meta path is validated here).
• A language-mismatched scan (no mode flags) now re-decides its mode instead of adopting init's pending decision — the base/scope are language-agnostic git facts, so if the maintainer prefers adoption-across-languages, the guard can be relaxed consciously.
• No end-to-end runInit→runScan test exists (os.Exit + cobra + git); the init wiring is covered by the swap-free helper signature + review.

[gadievron]

Status: ON HOLD — do not merge.

The adversarial review (2026-09-22) found defects in this PR that need rewriting before it can merge. The specific finding is in the review record. The PR is being rewritten; the current branch and all evidence are preserved.

Agent: ISSUES-TO-PR ses_f3e7372a5ffe3b2I6lP4Wm3w2d

[gadievron]

Rewrote the branch (the previous head broke test compilation on all 3 OSes and left the production readers on the legacy path — the init→scan handoff was silently broken).

What the rewrite adds:

• All 16 test call sites migrated to the new SaveScanMeta/LoadScanMeta/FinalizeScanMeta signatures; go build, go vet, go test green (95 tests, 0 failed).
• The production readers (resolveStepDiffOpts, resolveScanMode) and the writer/finalizer now all key on ctx.Project.Language — the same key end to end. An adversarial review round found the first rewrite keyed the writer on the flag-overridable scanLanguage while the readers keyed on the project's pinned language: a scan -l go on a python-pinned project would leave the meta stuck running and the completed run unrecorded (verified by executed repro on both trees). Fixed in 8d230e5.
• Four behavioral tests: two-languages-same-SHA (the issue's core case), the init→scan round-trip (the read/write contract), finalize flips running→success, and the legacy fallback (upgrade story).

Known follow-up (named, not fixed here): once any per-language meta exists at a sha, LatestScanMeta's foundPerLang skip drops the legacy sha-level record from the candidate walk — a pre-#664 success can be shadowed by a first post-upgrade failed scan at the same sha. Happy to address it in this PR or a follow-up, maintainer's call.

[gadievron]

The adversarial cycle is complete: three lanes + two delta rounds, every finding fixed with mutation-verified fix-linkage, 145/0 on the suite. The three conscious scope choices are listed in the body's 'Known out-of-scope' — maintainer's call on each.

[gadievron]

The final artifacts-only audit's receipt findings are fixed: the test count corrected (205, full-output receipt — the earlier 145 was an output-truncation artifact), the init.go change now documented in the body, the collision section rewritten with real file lists + merge-tree receipts (#672/#675 file-overlap, both merge-clean), and the lane-claim wording matched to what the receipts record. The audit row is dispatch-bound (a real subagent session, verifiable). Ready for review.