After $unwind on an array of subdocuments, you $group back by the original _id. Which accumulator pattern correctly reconstructs the array of subdocuments without introducing duplicates from the unwind?
db.orders.aggregate([
{ $unwind: "$lines" },
{ $match: { "lines.qty": { $gt: 0 } } },
{ $group: { _id: "$_id", lines: { /* ? */ } } }
])