fix(gate): dedupe the duplicate-only hold's warnings and repair #9206's engine fixture fallout

[JSONbored]

Summary

Two related fixes to #9206/#9129's duplicate-only hold path.

1. The held finding was listed twice. The hold branch moves escalated blockers into warnings so the panel still shows them — but gateWarnings is every warning-severity finding, and duplicate_pr_risk is authored severity: "warning", so it was already there. Appending the blocker unfiltered rendered the identical finding twice. Verified against the built engine before the fix:

warnings codes: [ 'repo_unregistered', 'duplicate_pr_risk', 'duplicate_pr_risk' ]

The failure path directly below has always applied !blockers.includes(finding); the hold path now applies the same exclusion. Fixed in both twins (src/rules/advisory.ts + packages/loopover-engine/src/advisory/gate-advisory.ts) to keep the live-gate-parity contract green.

2. The engine workspace's suite has been red on main since #9206 — 7 failures, which #9206's own golden-fixture update did not cover:

• The rival-PR fixture (openPr(...)) carried no changedFiles, so under orb(gate): any contributor can force-close a rival's PR by citing the same issue number — breaker-exempt, default-on, and it has already closed 2 PRs #9129's new corroboration rule it downgraded to the always-advisory duplicate_pr_risk_unconfirmed — the "genuinely blocked" scenarios silently stopped being blocked and the miner loop handed off instead of continuing/abandoning. The fixture now names the same file the attempt itself touches, exercising the changed-file-overlap arm of hasDuplicateOverlapCorroboration rather than weakening the assertion.
• One assertion still pinned conclusion: "failure" where orb(gate): any contributor can force-close a rival's PR by citing the same issue number — breaker-exempt, default-on, and it has already closed 2 PRs #9129 deliberately produces neutral — the same semantic change the host's golden corpus already recorded when it renamed duplicate-block-mode-fails → duplicate-block-mode-holds.

Closes #9218

Validation

• npm run test --workspace @loopover/engine — 737/737 pass (was 730/737 on main)
• npm run test:live-gate-parity — 14/14
• npm run test:engine-parity — 14/14
• npx vitest run test/unit/{gate-check-policy,rule-gate-eval,gate-golden-corpus,content-lane-wire,agent-actions}.test.ts — 548/548
• New regression test asserts both arms of the added filter: the held finding appears exactly once, and an unrelated warning alongside it is still carried exactly once.

Safety

• No secrets, wallets, hotkeys, trust scores, or reward values.
• No public-surface text change beyond removing a duplicated line from the held panel.
• Behavior change is confined to the hold branch's warning list; blockers, conclusions, and the failure path are untouched.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	2c666db	Commit Preview URL Branch Preview URL	Jul 27 2026, 07:23 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[github-actions]

Logic backtest

Replayed 0 historical case(s) for linked_issue_scope_mismatch through the base (05ae04e) and head (2c666db) versions of its detection logic (corpus checksum 4f53cda18c2b).

Backtest comparison: linked_issue_scope_mismatch

Verdict: unchanged — no comparable axis moved.

Advisory only — this check never blocks merge (#8105).

[codecov]

❌ 4 Tests Failed:

Tests completed	Failed	Passed	Skipped
22591	4	22587	21

View the top 3 failed test(s) by shortest run time

test/integration/orb-relay.test.ts > POST /v1/orb/relay/pull > REGRESSION (#4995): a DB error inside validateOrbRelayEnrollment's own lookup ALSO returns a clean 503 broker_error, not a framework 500 (the earlier of the two DB-touching calls in this handler)

Stack Traces | 0.0116s run time

AssertionError: expected 500 to be 503 // Object.is equality

- Expected
+ Received

- 503
+ 500

 ❯ test/integration/orb-relay.test.ts:1160:24

test/integration/orb-onboarding.test.ts > Central Orb installation registry routes (/v1/internal/orb/installations) > tolerates a list query that omits results (rows.results ?? [])

Stack Traces | 0.0217s run time

SyntaxError: Unexpected token 'I', "Internal S"... is not valid JSON
 ❯ test/integration/orb-onboarding.test.ts:57:14

test/integration/orb-ingest.test.ts > Orb instance registry routes (/v1/internal/orb/instances) > tolerates a list query that omits results (rows.results ?? [])

Stack Traces | 0.0278s run time

SyntaxError: Unexpected token 'I', "Internal S"... is not valid JSON
 ❯ test/integration/orb-ingest.test.ts:427:14

test/integration/orb-relay.test.ts > POST /v1/orb/relay/register > REGRESSION (#4995): a DB error inside validateOrbRelayEnrollment's own lookup ALSO returns a clean 503 broker_error, not a framework 500 (the earlier of the two DB-touching calls in this handler)

Stack Traces | 0.0793s run time

AssertionError: expected 500 to be 503 // Object.is equality

- Expected
+ Received

- 503
+ 500

 ❯ test/integration/orb-relay.test.ts:155:24

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}