orb(observability): hold reason is misattributed — 100% of 'precision circuit breaker' holds are actually adjudication holdouts

[JSONbored]

Every agent.action.hold that reports "auto-action held by precision circuit breaker" is actually the ε=20% close-audit adjudication holdout (#8831). The precision circuit breaker has never engaged. The ledger names the wrong cause.

The bug

agentHoldAuditDetail (src/queue/processors.ts ~2277-2280) infers the breaker purely from "a terminal action was planned but is not in the final plan":

const plannedTerminalAction = args.planned.some(a => a.actionClass === "merge" || a.actionClass === "close");
const finalTerminalAction  = args.breakerOnPlan.some(a => a.actionClass === "merge" || a.actionClass === "close");
if (plannedTerminalAction && !finalTerminalAction)
  return "auto-action held by precision circuit breaker";   // <-- assumes the breaker did it

But the call site at ~3391 passes breakerOnPlan: holdoutOnPlan — i.e. the plan after maybeApplyCloseAuditHoldout (~3266), not after applyPrecisionBreakers (~3237). So when the holdout removes the close, this first branch matches and attributes it to the breaker. Being the first branch, it also shadows every more-specific reason below it.

Empirical proof (live ledger, edge-nl-01, since 2026-07-20)

• agent.action.hold with "precision circuit breaker": 6
• decision_audit_holdout events: 6
• They pair 1:1 on the same PRs, within 20 milliseconds each: fix(db): drop the stale migration-90 grandfather entry (its second file was renumbered to 0092) #9010, fix(engine): remove the dead AMS_POLICY_SPEC_FILENAMES discovery constant #9004, fix(engine): warn on out-of-range self-plagiarism similarityThreshold #8939, fix(miner): self-review-context never supplies recent-merged-PR history, contradicting its own "same fidelity" claim #8956, feat(api): surface computeRuleGateEval's per-(project, ruleCode) rows #8929, fix(engine): classify 'ci' change-kind only by real CI path segments, not any .yml/.yaml (#8873) #8921.
• system_flags contains no engaged breaker at all — the only related row is closehold:JSONbored/gittensory = 0 (off, and on the pre-rename repo name). holdonly:* does not exist.

So the correlation is 100% and the claimed cause is provably absent.

Why this matters

A wrong reason is worse than no reason: an operator investigating a stalled PR chases a circuit breaker that was never engaged, while the real cause (this PR was deliberately sampled for human adjudication) is one line above in the ledger and gets ignored. It also corrupts any analysis of breaker behavior — the breaker looks active when it has never fired.

Fix

1. Pass the genuinely post-breaker plan for the breaker comparison, and check the holdout separately — or better, have each transform (breaker, holdout) report why it removed an action instead of the audit function guessing from set difference.
2. Add a distinct reason string for the holdout: "auto-action held for close-audit adjudication (ε-holdout)".
3. Order the branches so a specific, known cause always beats the inferred one.

This is a concrete instance of the invariant in #9003: a decision reason must be recorded by the code that made the decision, never reconstructed by comparing before/after states.

Acceptance

• A holdout-held PR reports the holdout as its reason; a breaker-held PR reports the breaker; a ledger query can distinguish them.

Refs #9003, #8831.

[linear-code]

JSO-6249