FUI9007: Governance record was dropped as a duplicate

## What it means

Two records in your resolved governance policy compile to the same underlying policy fact — the same rule, scoped to the same thing — so the engine can only enforce one of them. It keeps the first and drops the second, and this diagnostic names both: the settings it is enforcing and the settings it discarded.

Most duplicates never reach this point. When a preset and your config both bind the same policy, your record **displaces** the preset's — later records win, and a scale binding displaces only the properties it actually rebinds. FUI9007 fires for what displacement cannot resolve: two records reaching the policy from different channels, such as a Cloud-served policy that already carries the record your config restates.

The diagnostic is verdict-neutral: it warns on stderr and never fails a run on its own. Turn it into a gate with `govern.ci.failOnInert`.

## How to resolve it

Author one record per policy. If both records exist for a reason — different severities for different parts of the repo — scope them apart with `exclude` instead of stacking them:

```ts govern: { styles: [ { kind: "style.rawColors.forbid", except: ["transparent"], prefer: "token", severity: "error", exclude: [{ glob: "src/legacy/**", reason: "migration in DS-611" }], }, ], } ```

If the duplicate comes from a Cloud-served policy, delete the local record and let the served one govern — or change the served policy. Two authorities describing one rule is the condition this diagnostic exists to end.

## Verify the change

Run `npx @usefragments/cli check` and confirm no `FUI9007` warning remains, then confirm the enforced setting is the one you meant: `check --format json` reports each finding's evidence, including the policy fact that produced it. To keep the state clean, set `govern.ci.failOnInert: true` so an inert or colliding config fails `--ci`.