fix(signals): sample collision pairwise PRs linked-first with deterministic updatedAt rank

[galuis116]

Summary

• buildCollisionReport's pairwise open-PR sampling used a plain openPullRequests.slice(0, MAX_COLLISION_PAIRWISE_PULL_REQUESTS) (cap 120): whichever 120 PRs happened to be first in the caller's array, with no preference for linked-issue PRs and no recency ordering. Once a repo's open-PR queue passes 120, two genuinely overlapping/duplicate PRs positioned later in the array were silently excluded from pairwise comparison and never clustered as a collision.
• This adds boundedCollisionPullRequests, mirroring the existing boundedCollisionIssues helper: linked-issue PRs are kept first, then the remaining budget is filled by most-recently-updated, so overlapping PRs are no longer dropped by input-order luck.
• No issue is linked: this repo's own .gittensory.yml sets issueDiscoveryPolicy: discouraged and linkedIssuePolicy: preferred (not required). This is a small, self-contained, self-evident fix confined to one file plus its regression test.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires >=99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• The full npm run test:ci chain on this Windows dev machine stops at test:coverage because of pre-existing, environment-only failures unrelated to this diff (CRLF vs LF mismatch from a Windows core.autocrlf checkout in gittensory-focus-manifest.test.ts, missing claude/codex CLI binaries on PATH in selfhost-ai.test.ts, and a libuv/Windows subprocess assertion in the gittensory-mcp CLI tests). None of the 17 pre-existing failures touch src/signals/** or the changed test file; the targeted suites for this change (signals-v2.test.ts, signals.test.ts, signals-coverage.test.ts) pass cleanly and tsc --noEmit is clean. I did not reach test:workers/build:mcp/ui:* locally because the &&-chained test:ci script stops at the first failing step; this PR does not touch workers, MCP packaging, or apps/gittensory-ui/**, so those steps are unaffected by the diff.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

If any required check was skipped, explain why: this PR has no auth/CORS/session surface and no UI change, so those boxes are not applicable.

Notes

• Added a regression test (test/unit/signals-v2.test.ts) that reproduces the bug: with more than 120 open PRs and two title-overlapping PRs positioned after the naive cap, the collision cluster was missing before this fix and is produced after it. I confirmed this by reverting the source change locally and observing the new test fail.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.80%. Comparing base (94f30db) to head (2500d02).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2365      +/-   ##
==========================================
+ Coverage   95.79%   95.80%   +0.01%     
==========================================
  Files         224      224              
  Lines       24947    24970      +23     
  Branches     9068     9075       +7     
==========================================
+ Hits        23897    23922      +25     
  Misses        428      428              
+ Partials      622      620       -2     

Files with missing lines	Coverage Δ
src/signals/engine.ts	97.36% <100.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-01 20:22:29 UTC}

2 files · 1 AI reviewer · no blockers · readiness 66/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
The change replaces input-order truncation of open PR pairwise collision sampling with a deterministic bounded selection that prefers PRs with linked issues, then newer updates, then lower PR numbers. The regression tests exercise both the unlinked-newest case and the case where linked PRs alone exceed the cap, which covers the important behavior added here. The visible diff is coherent and the production path in buildCollisionReport now uses the new bounded helper.

Nits — 3 non-blocking

• nit: src/signals/engine.ts:5191 wraps the new helper in `v8 ignore` even though the added tests exercise the large-queue behavior, which weakens future patch-coverage signal for this production selection logic.
• src/signals/engine.ts:5191: remove the `v8 ignore` block around `boundedCollisionPullRequests` or narrow it to any truly unreachable branch, since this helper now has targeted regression coverage.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:S; no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 1808 registered-repo PR(s), 1194 merged, 140 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	galuis116; Gittensor profile; 1808 PR(s), 140 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: galuis116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 1808 PR(s), 140 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Explain no-issue PR.
• Await review-lane availability.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review