fix(orb): drop unreachable bare ::1 branch in isLocalBrokerHost

[shin-core]

What & why

Closes #8334.

isLocalBrokerHost (src/orb/broker-client.ts) checks hostname === "::1", but hostname here is always a WHATWG URL's .hostname, which always brackets an IPv6 literal — new URL("http://[::1]:8787").hostname is "[::1]", never the bare "::1". So the bare-::1 arm is unreachable dead code given how the function is actually called, and test/unit/orb-broker-client.test.ts:96 only ever exercises the bracketed form.

The fix

Remove the unreachable bare "::1" comparison, leaving the three reachable forms (localhost / 127.0.0.1 / [::1]), and add a one-line comment noting why only the bracketed IPv6 form is checked (so a future reader doesn't reintroduce the bare form). This is a dead-code cleanup — no externally-observable behavior change.

Validation

• test/unit/orb-broker-client.test.ts (40 tests) pass unchanged; the bracketed-[::1] case still exercises the simplified line.
• The changed line's remaining branches are all covered (codecov/patch 100% on the diff — removing a branch only improves coverage); broker-client.ts whole-file stays at ~99% branch / 100% lines.
• Typecheck clean; branched off current main, mergeable-clean.

Per the issue: this removes a branch rather than adding one, so no new test is required to hit the patch gate — the existing bracketed-form test keeps the real behavior covered.

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.63%. Comparing base (12f2e14) to head (b22e302).
⚠️ Report is 29 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #8340       +/-   ##
===========================================
+ Coverage   59.41%   89.63%   +30.22%     
===========================================
  Files         791       98      -693     
  Lines       79329    22833    -56496     
  Branches    23963     3925    -20038     
===========================================
- Hits        47131    20467    -26664     
+ Misses      28737     2187    -26550     
+ Partials     3461      179     -3282     

Flag	Coverage Δ
shard-1	16.53% <0.00%> (?)
shard-2	99.21% <100.00%> (+51.89%)	⬆️
shard-3	16.53% <0.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/orb/broker-client.ts	99.21% <100.00%> (ø)

... and 693 files with indirect coverage changes

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-24 15:00:42 UTC}

1 file · 1 AI reviewer · no blockers · CI green · unstable

⏸️ Suggested Action - Manual Review

Review summary
This is a correct, well-scoped dead-code removal: `hostname` is always sourced from a WHATWG `URL.hostname`, which always brackets IPv6 literals, so the bare `"::1"` comparison in `isLocalBrokerHost` (src/orb/broker-client.ts:22-24) could never be true, and removing it is a pure no-op behavior-wise. The added comment correctly documents why only the bracketed form is checked, and the existing bracketed-`[::1]` test still covers the remaining logic. This mirrors the same bare/bracketed-form pattern already present in packages/loopover-miner/lib/update-check.ts's `isLocalRegistryHost`, though that function isn't touched here.

Nits — 4 non-blocking

• No new or modified test was added alongside this change; while removing a branch doesn't strictly require one for patch coverage, a quick assertion that `isLocalBrokerHost` returns false for a literal bare `::1` string would make the 'unreachable' claim self-verifying in the test suite.
• packages/loopover-miner/lib/update-check.ts's `isLocalRegistryHost` still checks the bare `::1` form (and lowercases/trims the hostname) — if that function's `hostname` input is similarly always URL-sourced, the same dead-code pattern likely exists there too, worth a follow-up issue rather than silent divergence.
• Consider filing a quick follow-up issue to check whether packages/loopover-miner/lib/update-check.ts's isLocalRegistryHost has the same unreachable bare-::1 branch, for consistency.
• Code changes lack test evidence — Add focused regression tests or explain why existing coverage is sufficient.

Flagged checks (non-blocking)

• Contributor trust — Contributor flagged for review

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8334
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 63 registered-repo PR(s), 30 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	shin-core; Gittensor profile; 63 PR(s), 0 issue(s).
Improvement	ℹ️ None detected	risk: low · value: none

Linked issue satisfaction

Addressed
The diff removes exactly the unreachable bare "::1" comparison, leaves the three reachable forms intact, and adds an explanatory comment matching the issue's requirements without altering observable behavior.

Review context

• Author: shin-core
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 63 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Triage stale or unlinked PRs.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.