fix(signals): deduplicate collision clusters, label buckets

[dale053]

Summary

• Fix requiredInstallPermissions in settings-preview.ts to derive read-only base permissions from REQUIRED_INSTALLATION_PERMISSIONS instead of hardcoded strings, so the preview can't silently drift from the canonical constant (regression from issue [Bug]: Repo settings-preview reports pull_requests: read and never flags a missing pull_requests permission, contradicting the app's own REQUIRED_INSTALLATION_PERMISSIONS (which mandates pull_requests: write) #419/fix(settings): require and surface pull_requests:write in the install preview for PR comment/label output #420 pattern).
• Fix label double-counting in refreshContributorActivity: allPullRequests, mergedPullRequests, and openPullRequests are overlapping views of the same PR set — deduplicate nodes by URL before extracting labels so a label on one PR isn't counted three times (regression from issue [Bug]: Contributor profile dominantLabels double-counts labels by folding repoStats dominant labels into the same-activity raw labels, inconsistent with every sibling aggregation — biasing labelFit scoring #417/fix(signals): dedupe overlapping label sources in contributor dominantLabels #418 pattern).
• Fix scopedOverlapCount in the gate check path of processors.ts: replace Math.max(prSpecificCount, preflight.collisions.length) with the same Map-deduped union that buildPublicPrIntelligenceComment uses, so the readiness score matches the rendered panel details (regression from issue [Bug]: Public PR panel "Duplicate risk" count uses Math.max of two cluster sources instead of their union, so the posted comment's count disagrees with the related-work items it lists #424/fix(signals): count scoped related-work as the union of PR-specific and preflight clusters #425 pattern).
• Add three regression tests (one per fix) to backfill.test.ts, settings-preview.test.ts, and signals-coverage.test.ts.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• UI checks not applicable — no UI changes in this PR.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (not applicable)
• API/OpenAPI/MCP behavior is updated and tested where needed. (not applicable)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (not applicable)
• Visible UI changes include screenshots or a short recording. (not applicable)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (not applicable)

Notes

• Closes Track public-surface truth projection and panel consistency regressions #440.
• The Math.max → union change in processors.ts is a pure correctness fix; the readiness score total is unaffected when the two sets are disjoint (the common case), and is now correct when they overlap.
• The permission surface fix filters only read-valued entries from REQUIRED_INSTALLATION_PERMISSIONS as the base, keeping issues: write conditional on whether output is actually enabled — preserving the existing behavior while ensuring future additions to the constant are automatically reflected.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#446 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[JSONbored]

Thanks for picking this up. The direction matches #440, but I found two blockers before this should merge:

1. package-lock.json has broad optional dependency metadata churn even though the PR does not change dependencies. Please drop that file from the PR unless there is a concrete package-manager reason tied to this fix.
2. The scoped-overlap regression test does not exercise the production path changed in processors.ts, and the final assertion can pass even if the processor goes back to Math.max(...). Please either extract the scoped-overlap union helper and test that directly, or add a focused processor-level/public-surface test that fails if scopedOverlapCount is computed from Math.max(prSpecificCount, preflight.collisions.length) again.

The label dedupe and permission-constant direction look reasonable once those two issues are fixed.

[JSONbored]

@dale053 the direction is still useful, and the unrelated lockfile churn is gone from the current diff.

A few notes:

• The label dedupe and permission-constant changes are reasonable.
• The production code now computes the scoped-overlap union instead of Math.max(...).
• The remaining substantive blocker is still regression coverage for that production path. The new test exercises rendered comment behavior and can pass without proving maybePublishPrPublicSurface feeds the deduped scoped-overlap count through the live webhook processor path.
• The PR title also still contains a literal ellipsis, so it does not meet the Conventional Commit title rule.

Required changes:

• Test the extracted scoped-overlap union helper directly, or add a focused processor/public-surface test that fails if the code returns to Math.max(...).
• Retitle the PR to fix(signals): deduplicate collision clusters and permission buckets.

Validation expected:

• Rerun the focused backfill, settings-preview, and signals/public-surface tests plus standard validation.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[JSONbored]

@dale053 the source diff is focused and the production-path overlap coverage is much better than the earlier version.

A few notes:

• I tried GitHub's update-branch rebase before reviewing because the PR is behind current main, and GitHub reported a rebase conflict.
• I am not going to resolve that conflict from the maintainer side.
• After a clean rebase, this is likely reviewable again without changing the product direction.

Required changes:

- Rebase onto current main and resolve the conflict locally.
- Preserve the backfill label dedupe regression, scoped-overlap union coverage, and settings-preview permission regression coverage.
- Re-run the focused signals/backfill/settings-preview tests and full validation.

Validation expected:

- git diff --check
- focused backfill/signals/settings-preview tests
- full validate

[JSONbored]

@dale053 this now looks good to land.

A few notes:

• The unrelated lockfile churn is gone.
• The scoped-overlap union is now in the production queue path rather than only comment rendering.
• Regression coverage now exercises the dedupe behavior that was previously missing.

Fix failing CI.

[dale053]

Hi,@JSONbored!
Could you please review this PR?

[JSONbored]

@dale053 this is good to land.

A few notes:

• The label dedupe now handles overlapping PR buckets before deriving dominant labels.
• The scoped-overlap count now uses the same union logic in the production queue path and rendered panel path.
• The settings preview now derives read permissions from the canonical install-permission constant.
• The regression tests cover the three drift cases called out in #440.

No code changes requested.