fix(scanner): Sort importers so identical scans give identical answers

[JordanCoin]

Prerequisite for #172's "exact importer list" exit criterion, and for the golden test being written elsewhere. Relates to #153.

What was wrong

Importers are appended while iterating analyses, and nothing fixes that order. Twelve consecutive runs of the same binary over the same unmodified fixture, on main:

app/sidebar.tsx,app/header.tsx,app/layout.tsx,app/footer.tsx,app/page.tsx
app/page.tsx,app/header.tsx,app/sidebar.tsx,app/footer.tsx,app/layout.tsx
app/page.tsx,app/header.tsx,app/layout.tsx,app/footer.tsx,app/sidebar.tsx
… twelve runs, twelve orderings

So --importers output shifted between identical runs, a diff of codemap output showed changes that weren't changes, and no caller could assert an exact list. After: 12/12 identical.

Scope: importers only, deliberately

The first version of this sorted Imports too, and that broke TestCueImportFiltersPackageSelector — which turned out to be encoding a real contract, not an incidental order. The CUE resolver returns a selected package before the package it falls back to, and that sequence is meaningful.

So I measured which half was actually unstable, rather than sorting both and adjusting the test to match:

Imports   of app/user.ts, 10 runs   ->  10/10 identical
Importers of lib/a.ts,    10 runs   ->  6 distinct orderings

Imports is appended per file in resolution order, which is already stable, and DepsProject sorts its own copy for JSON output regardless — so --deps --json is unchanged by this PR. Only the reverse map needed fixing, and only it is touched.

Tests

testdata/deterministic-edges/ — four files importing one shared module, named so that alphabetical order differs from every plausible discovery order. TestFileGraphEdgeOrderIsDeterministic builds the graph eight times and requires identical output, then requires the result be sorted rather than merely stable, since a caller asserting an exact list needs to know which order it gets.

Against unsorted code it fails with:

run 1 importers = map[lib/shared.ts:[app/charlie.ts app/bravo.ts app/alpha.ts app/delta.ts]],
want the same order as run 0 map[lib/shared.ts:[app/charlie.ts app/alpha.ts app/delta.ts app/bravo.ts]]

TestSortEdgesHandlesNilGraph covers the nil receiver.

Also on this branch

• Cache invalidation. Sorting the builder does not reach a repo whose watch daemon already wrote a state.json: ValidateCachedGraph accepts any cache whose builder revision matches, and the revision had not changed. graphBuilderRevision is bumped to filegraph-v2 so pre-sort state files fail provenance and are rebuilt.
• HubFiles() ordering. It ranged over the Importers map and returned the slice unsorted; cmd/hooks.go and watch/publication.go pass it through and the hook renderer truncates at maxHubs, so which hubs a hook printed still varied. Now ordered by non-test importer count descending, then path.
• Ported test for 09d3f4c. That commit ported @reneleonhardt's cargo-metadata deadline fix from perf: Bound repository analysis hot paths #171 without its test; TestCargoMetadataDeadlinePreservesFallbackTopology is now ported from perf: Bound repository analysis hot paths #171 as well and no-ops once that PR merges.

Release note

--importers and the file graph now return importers in sorted order. Identical scans of an unchanged repository produce identical output; previously the order varied between runs. Import lists and --deps --json are unaffected.

Verification

go vet ./... clean, gofmt clean, go test ./... at the main baseline (only the three known root-environment permission failures). Determinism confirmed end-to-end with a built binary at 12/12 identical on the fixture that previously gave twelve orderings.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PEUvjGsJemDFSV8nbxvxBo

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.