fix(engine): consolidate duplicate-winner.ts byte-identical copies

[galuis116]

Summary

• packages/gittensory-engine/src/duplicate-winner.ts and packages/gittensory-engine/src/signals/duplicate-winner.ts were accidental byte-identical forks living inside the same package (not a src/-vs-engine extraction pair — both copies were already inside gittensory-engine).
• The package's index.ts barrel exports from the top-level copy, but advisory/gate-advisory.ts imports the signals/ copy instead — low-risk only because the two files happened to stay identical.
• Turns signals/duplicate-winner.ts into a thin re-export of ../duplicate-winner.js, matching the existing extraction-shim pattern used elsewhere in this codebase (e.g. src/signals/duplicate-winner.ts's own re-export of the engine module). No behavior change — advisory/gate-advisory.ts's existing import keeps resolving to the exact same functions.

Fixes #4251

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally — this change is entirely inside packages/gittensory-engine/, which is not measured by codecov/patch (Codecov only measures src/**, collected by vitest); root vitest coverage is unaffected/unchanged.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Also ran the package's own gate: npm run test --workspace @jsonbored/gittensory-engine (281/281 passing, including a new dedicated test/duplicate-winner-signals-shim.test.ts proving the shim re-exports the exact same function references as the top-level module, plus a runtime check that isDuplicateClusterWinnerByClaim still behaves correctly through the signals/ import path that advisory/gate-advisory.ts uses). Ran the full root npm run test:ci end-to-end (green).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A, no auth/session/CORS surface touched.
• API/OpenAPI/MCP behavior is updated and tested where needed. — no public API/OpenAPI/MCP surface change; internal package-local re-export only.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — N/A, no UI surface touched.
• Visible UI changes include a UI Evidence section below — N/A, no visible/UI change.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — this PR only consolidates an internal duplicate file inside packages/gittensory-engine; there is no visible UI change.

Notes

• Deliberately kept as a re-export (not deleted outright) so advisory/gate-advisory.ts's existing ../signals/duplicate-winner.js import keeps resolving without a call-site change, per the issue's deliverables.
• ./signals/duplicate-winner is not part of the package's public exports map (only ./signals/test-evidence is), so there is no published subpath to update.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-09 17:16:22 UTC}

2 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This collapses packages/gittensory-engine/src/signals/duplicate-winner.ts into a thin re-export of the sibling ../duplicate-winner.ts, eliminating an accidental byte-identical fork within the same package. The re-exported symbols (isDuplicateClusterWinner, isDuplicateClusterWinnerByClaim, resolveDuplicateClusterWinnerNumber, DuplicateClaimMember) match exactly what advisory/gate-advisory.ts already imports from this path, so the existing import keeps resolving to the same functions with no behavior change. The added shim test correctly asserts reference-equality between the two module exports plus one live-behavior check through the shim path, which is real coverage for a re-export (not a fabricated scenario) since it verifies the actual import chain advisory/gate-advisory.ts depends on.

Nits — 4 non-blocking

• packages/gittensory-engine/src/signals/duplicate-winner.ts:1 keeps only a shortened doc comment pointing to the top-level module — consider also linking the PR/issue number for the top-level module's doc so a future reader following the pointer doesn't have to search for '#dup-winner' context.
• The new test file duplicate-winner-signals-shim.test.ts duplicates some setup shape from duplicate-winner.test.ts (winner/laterSibling fixtures) — minor, could share a fixture builder if this pattern grows.
• Consider verifying (outside this diff) that no other module in the package imports the now-shimmed signals/duplicate-winner.ts expecting to tree-shake away the re-export — unlikely to matter for a Worker/Node bundle but worth a quick grep.
• The shim's re-exported type via `export { ..., type DuplicateClaimMember }` is fine under current TS settings (typecheck passed in CI) — no action needed, just flagging it as the reason this isn't a plain value re-export.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4251
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 1860 registered-repo PR(s), 1212 merged, 47 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	galuis116; Gittensor profile; 1860 PR(s), 47 issue(s).
Gate result	✅ Passing	No configured blocker found.

Linked issue satisfaction

Addressed
The PR replaces packages/gittensory-engine/src/signals/duplicate-winner.ts with a thin `export * from "../duplicate-winner.js"` re-export as requested, and adds a test verifying the shim's exports are identical to the top-level module and that gate-advisory.ts's import path still behaves correctly, with no changes to the top-level module or its API.

Review context

• Author: galuis116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: JavaScript, Python, Dart, TypeScript, HTML, MDX, Rust, C++
• Official Gittensor activity: 1860 PR(s), 47 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.