A duplicate key is a parse error — one duplicate-key refusal contract for pkgs/id's checked JSON gates

Design-architect pass 61 (2026-11-06), audit at origin/main 6046e1d7b.
Full design doc: files/designs/code-duplicate-json-keys.md in the
keep-the-four-repos-healthy goal workspace.

Problem

pkgs/id's checked JSON gates parse first and validate second, and
every parse they use — serde_json::Value, BTreeMap, map-shaped
derived decodes — collapses duplicate object keys last-wins. The
checks therefore run on a collapsed document that is not the document
as written: a forbidden value placed first, hidden behind a benign
duplicate, passes the version gate, the size cap, the count cap, the
control-character refusal and the canonical-form check.

Six filings in three days are one defect: #6473 (parse_records —
oversized value and the MAX_RECORDS count both checked post-collapse),
#6474 (world_fixture::decode — check_keys/check_window see only
the surviving world/fixture/sequence; the header records
object collapses twice), #6491 (parse_surface — even the kind
dispatch is last-wins), #6499 (parse_wants — version, subscription
cap, entry id/cap all read from the collapsed map), #6501 (session
frames — landed via PR #6508), #6504 (Registry::load —
validate_persisted checks the collapsed registry). Decode shapes
even disagree in-tree: #6504's struct decode collapsed a duplicate
world that #6501's sibling derived paths refused. Outside the crate
the stance is already refusal: #6384 (deploy.py) and #6390 (atlas-eval),
both closed.

The contract

A duplicate key is a parse error. A checked JSON gate in pkgs/id
never validates, counts, stores or forwards a collapsed document.

1. Refusal, naming the key — in the gate's own error vocabulary,
   with the surface's context (fixture line, publications file).
2. Every depth — not only levels with checked fields: what a gate
   forwards/stores/compares onward is the collapsed Value, so a
   deeper duplicate is the same ambiguity one step later; and no
   serializer can emit a duplicate key, so no legitimate producer is
   affected. This pin supersedes id(world_caps): parse_wants collapses duplicate JSON keys before its checks — a forbidden version, cap, id, or list size hidden behind a duplicate is accepted #6499's checked-positions-only
   scoping for args interiors (its required refusals are subsumed).
3. One mechanism — promote fix(id): refuse duplicate JSON keys in world_session first/joined frames (#6501) #6508's landed
   parse_json_without_duplicate_keys (world_session/mod.rs:880:
   every-depth refusal, duplicate JSON object key "k") into one
   shared home in id-core and route every phase through it;
   struct-first gates parse through it and convert. Serde's derived
   duplicate-field behaviour is never the defence (fields-only,
   inconsistent, absent on Value/BTreeMap paths).
4. Checks see the written document — no check's own logic changes;
   duplicate-free documents parse identically.

Phases (adopt the origins — no parallels)

• Phase 1 — records and fixtures: id(world): parse_records silently collapses duplicate JSON keys — an oversized value hidden behind a duplicate passes MAX_RECORD_VALUE_BYTES, and the record-count cap is checked after collapse #6473 + id(world_fixture): decode accepts duplicate JSON fields in header and event lines — check_keys and the window check only ever see the collapsed last value #6474.
• Phase 2 — guest documents in id-core: id(world_presentation): parse_surface collapses duplicate JSON keys before its checks — a forbidden version, width, lines, or rows hidden behind a duplicate is accepted #6491 + id(world_caps): parse_wants collapses duplicate JSON keys before its checks — a forbidden version, cap, id, or list size hidden behind a duplicate is accepted #6499
  (independent of Phase 1; the helper promotion lands with whichever
  of Phases 1–2 goes first).
• Phase 3 — the persisted registry: id(publications): Registry::load collapses duplicate JSON keys before validate_persisted — an empty world, non-canonical path, or duplicate placement hidden behind a duplicate key is silently restored at boot #6504 (independent).
• Phase 4 — closing inventory + contract statement (new issue,
  gated on Phases 1–3): every serde_json parse site in pkgs/id +
  crates/ dispositioned gate/not-a-gate with reasons; required
  dispositions for signed-object JSON, self-produced files, and
  non-JSON decoders (see the design doc's open questions).

#6501 is cited as the landed embodiment, not a phase. Open questions
stay in the design doc.

🤖 Filed by the repo design architect (fleet) — origins verified with
laptop probes by their filers; audit and pins are this pass's, against
origin/main 6046e1d7b.

Acceptance criteria

• One duplicate-key refusal contract is specified for every checked JSON gate in pkgs/id: duplicates are refused at parse time, before any validation runs — no gate ever validates a collapsed (last-wins) document.
• Every parse site named in the audit (id(world): parse_records silently collapses duplicate JSON keys — an oversized value hidden behind a duplicate passes MAX_RECORD_VALUE_BYTES, and the record-count cap is checked after collapse #6473, id(world_fixture): decode accepts duplicate JSON fields in header and event lines — check_keys and the window check only ever see the collapsed last value #6474, id(world_presentation): parse_surface collapses duplicate JSON keys before its checks — a forbidden version, width, lines, or rows hidden behind a duplicate is accepted #6491, id(world_caps): parse_wants collapses duplicate JSON keys before its checks — a forbidden version, cap, id, or list size hidden behind a duplicate is accepted #6499, id(publications): Registry::load collapses duplicate JSON keys before validate_persisted — an empty world, non-canonical path, or duplicate placement hidden behind a duplicate key is silently restored at boot #6504, and the already-landed id(world_session): first-frame and joined-frame parsers collapse duplicate JSON keys before their checks — a hidden first type/world/capability value is never seen, and the sibling session paths reject the same bytes #6501 shape) is inventoried and dispositioned under the contract, with the implementation phases attached to this epic as native sub-issues (the Phase 4 of #6520 — closing JSON-parse inventory: disposition every serde_json parse site in pkgs/id against the duplicate-key refusal contract #6521 pattern).
• The contract names its oracle: for each gate, a duplicate-key input carrying a forbidden first value is refused, with regression coverage at the parse seam.