fix/dup-repair

Redundant !active check after actives.length !== 1 guard

scripts/lib/repair-dup-contracts-core.ts

When `actives.length !== 1` passes, `actives[0]` is guaranteed to be defined, making `!active` always false. Safe to drop — the length check is the real invariant. Harmless but slightly misleading.

REACTIVATE_NO_EVIDENCE evidence-check inversion: now correctly guards the no-evidence premise

scripts/repair-dup-contracts.ts

Old code ran the FLIP-side 'evidence changed' guard for REACTIVATE_NO_EVIDENCE too (wrong: it would have aborted when evidence IS on the holder, which is exactly where it should be). New code correctly checks `holderNewest || deposedNewest` (any evidence = premise violated, re-census). This was a latent bug — confirmed clean.

twinBillCount: numeric coercion from raw DB row could suppress log

scripts/repair-dup-contracts.ts

PostgreSQL count may be serialized as a string by some adapters. The `as unknown as Array<{n: number}>` cast doesn't validate at runtime, so `twinBillCount` could be the string '3'. The `> 0` check still passes (coerced), but logging is the only purpose — the DELETE proceeds correctly regardless. Use `Number(...)` to make the coercion explicit.

twinBills dual-path cast lacks explanatory comment

scripts/repair-dup-contracts.ts

`(twinBills.rows ?? twinBills)` is a Drizzle/pg-driver shape uncertainty that appears multiple times in the script. A one-line comment (`// pg-js returns rows array directly; pooler wraps it`) prevents a future reader from deleting the `?? twinBills` fallback as dead code.

Dry-run demote label: else-arm silently covers future verdicts

scripts/repair-dup-contracts.ts

`p.verdict === 'FLIP_KEEP_HISTORY' ? 'terminate' : 'soft-delete + purge bills'` currently covers FLIP_DELETE_TWIN + REACTIVATE_NO_EVIDENCE in the else arm — correct today. A new verdict added later would silently display 'soft-delete + purge bills' regardless. An explicit map or exhaustive switch would break loudly at the right time.

New two-active test only asserts verdict, not reason

scripts/__tests__/repair-dup-contracts-core.test.ts

The SKIP_MANUAL test for two active rows checks only `plan.verdict` — the `reason` field is the sole human-readable signal in dry-run output. Add `expect(plan.reason).toMatch(/1-active.*N-terminated/)` so a swapped reason string doesn't go undetected.

Active-only group (no terminated row) not tested

scripts/__tests__/repair-dup-contracts-core.test.ts

The guard `terminated.length === 0` fires for a group with one active + zero terminated rows. No test covers this arm independently (existing 'no active row' test hits `actives.length !== 1` first). Low risk for this one-shot script, but easy to add.

LIMIT integer validation untested

scripts/repair-dup-contracts.ts

The tightening from `Number.isFinite` to `Number.isInteger` (rejects `--limit 1.5`) is correct but untested. Extracting the guard to `parseLimit(raw)` would make it trivially unit-testable.

twinBillCount SELECT adds a round-trip that DELETE rowCount could replace

scripts/repair-dup-contracts.ts

The count query exists only to drive a console.log. The subsequent DELETE's `rowCount` field (available on Drizzle execute results) would give the same number without the extra round-trip. Minor for a one-shot script.

entity_relationships source_type join fix: correct dedup scope tightening

scripts/repair-dup-contracts.ts

Adding `AND e2.source_type = er.source_type` prevents over-deletion if two entity_relationships rows share (org_id, source_id, target_type, target_id) but differ in source_type. This was a silent incorrect-delete risk for orgs with multiple relationship source types.