Plan path-scoped duplicate identity fix

workplans/RAIL-FAB-WP-0012-baseline-rollout-and-conflict-review.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Baseline Rollout And Conflict Review"
 domain: railiance
 repo: railiance-fabric
-status: ready
+status: finished
 owner: codex
 topic_slug: railiance
 planning_priority: high
@@ -64,7 +64,7 @@ local Fabric registry service was not listening on `127.0.0.1:8765`.
 
 ```task
 id: RAIL-FAB-WP-0012-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "53880e37-6800-47db-8c35-4278eb241da4"
 ```
@@ -84,7 +84,7 @@ Acceptance notes:
 
 ```task
 id: RAIL-FAB-WP-0012-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "1b945a9e-6193-4e34-8e3b-9b2d5a6aa828"
 ```
@@ -106,7 +106,7 @@ Acceptance notes:
 
 ```task
 id: RAIL-FAB-WP-0012-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "52e18533-df3f-4478-84bd-f8fa688d83e3"
 ```
@@ -124,11 +124,34 @@ Acceptance notes:
   scanner identity, improve repo declarations, or create follow-up workplan.
 - Do not project accepted graph changes until this review is complete.
 
+Review result:
+
+- Latest `repo-scoping` discovery snapshot: `4`, commit
+  `fd7f25866a94897acfdefaafc83a9d8336c1081b`, generated
+  `2026-05-20T21:21:22Z`.
+- Conflicted candidates are all `Lockfile` nodes with labels `uv.lock` or
+  `package-lock.json` under distinct `var/checkouts/...` paths:
+  `llm-connect-ce2118b9dc59/uv.lock`,
+  `markitect-main-1e0f80026926/package-lock.json`,
+  `ops-bridge-9733411215b8/uv.lock`,
+  `ops-warden-eac790a4872c/uv.lock`,
+  `railiance-cluster-95d336518aae/uv.lock`,
+  `vergabe-teilnahme-336b6f081ec8/package-lock.json`, and
+  `vergabe-teilnahme-336b6f081ec8/uv.lock`.
+- Classification: duplicate-detection noise for path-scoped lockfile entities.
+  The scanner is treating same kind plus same normalized label as enough to
+  raise `possible_duplicate_node`, even when source paths clearly distinguish
+  separate lockfiles.
+- Recommended action: refine duplicate detection for path-scoped nodes before
+  broad rollout or acceptance projection. Lockfiles should require matching
+  source anchor/path identity, not label alone, before being treated as possible
+  duplicates.
+
 ### T04 - Acceptance Policy Trial
 
 ```task
 id: RAIL-FAB-WP-0012-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "7ceaa12a-8044-4fa1-82c3-d202a815e494"
 ```
@@ -146,11 +169,24 @@ Acceptance notes:
   conflict/review work.
 - Record any blocked acceptance reasons.
 
+Trial result:
+
+- `llm-connect` discovery snapshot `2` is clean but contains only
+  `candidate` review-state discoveries, so no candidates were projected.
+- `railiance-fabric` discovery snapshot `3` is clean, has accepted
+  repo-declaration candidates, and was projected into accepted graph snapshot
+  `24` with 49 nodes and 63 edges.
+- Projection appended a new graph snapshot with commit
+  `discovery:9ad2750965f0100adcee2473b31ede6f7098205c`; it did not mutate the
+  earlier repo-owned graph snapshots.
+- `registry rescan-status --review-only` still shows only `repo-scoping`
+  snapshot `4` as review-required.
+
 ### T05 - Rollout Readiness Decision
 
 ```task
 id: RAIL-FAB-WP-0012-T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "4a73225c-18ce-4ba6-89b9-cdc8c76ca5d9"
 ```
@@ -167,6 +203,16 @@ Acceptance notes:
 - If ready, propose the command and guardrails for all-local-repo baseline
   ingestion.
 
+Decision:
+
+- Broad all-local-repo rollout is deferred until duplicate detection respects
+  path-scoped node identity for lockfile-style evidence.
+- The operational loop itself is usable: registry service bootstrap, baseline
+  ingest, unchanged skip, review-only status, and safe projection for clean
+  accepted declarations all worked locally.
+- Follow-up: `RAIL-FAB-WP-0013` owns the path-scoped duplicate identity
+  refinement and should be completed before the next broad rollout attempt.
+
 ## Open Questions
 
 - Are `repo-scoping` conflicts caused by stale cache baselines from before the

workplans/RAIL-FAB-WP-0013-path-scoped-duplicate-identity.md

@@ -0,0 +1,104 @@
+---
+id: RAIL-FAB-WP-0013
+type: workplan
+title: "Path Scoped Duplicate Identity"
+domain: railiance
+repo: railiance-fabric
+status: active
+owner: codex
+topic_slug: railiance
+planning_priority: high
+planning_order: 13
+created: "2026-05-20"
+updated: "2026-05-20"
+state_hub_workstream_id: "bf80900b-606c-442c-aa15-d6272d73a8d6"
+---
+
+# RAIL-FAB-WP-0013 - Path Scoped Duplicate Identity
+
+## Goal
+
+Refine discovery reconciliation so path-scoped nodes, starting with `Lockfile`
+candidates, are not marked as duplicate entities solely because they share the
+same display label.
+
+This unblocks broad local-repo rollout by making rescan review output point to
+real identity concerns instead of expected repeated files such as `uv.lock` and
+`package-lock.json` across different checkouts.
+
+## Background
+
+`RAIL-FAB-WP-0012` ingested a controlled three-repo baseline into the local
+Fabric registry. The only review-required repo was `repo-scoping`; all seven
+conflicted candidates were `Lockfile` nodes with labels `uv.lock` or
+`package-lock.json` under distinct `var/checkouts/...` paths.
+
+The current duplicate detector compares node kind plus normalized label/alias.
+That is useful for semantic declaration nodes, but too broad for file-backed
+path-scoped evidence.
+
+## Design Principles
+
+- Keep semantic duplicate detection intact for declaration-like nodes.
+- For path-scoped node kinds, require matching source path identity before
+  treating same-label nodes as possible duplicates.
+- Preserve conservative behavior when source path evidence is missing.
+- Add a regression test that mirrors the `repo-scoping` false-positive shape.
+- Rerun the controlled baseline before recommending broad rollout.
+
+## Tasks
+
+### T01 - Add Path-Scoped Reconciliation Coverage
+
+```task
+id: RAIL-FAB-WP-0013-T01
+status: todo
+priority: high
+state_hub_task_id: "8d9cb1c2-77f7-45da-b942-a8d68454477a"
+```
+
+Add tests proving that same-label `Lockfile` nodes at different source paths do
+not raise `possible_duplicate_node`, while same-label semantic nodes still do.
+
+### T02 - Implement Path-Aware Duplicate Detection
+
+```task
+id: RAIL-FAB-WP-0013-T02
+status: todo
+priority: high
+state_hub_task_id: "7d4d439d-4f7f-4bdd-bc5f-b02524a10684"
+```
+
+Update reconciliation duplicate detection so path-scoped node kinds compare
+source anchors before emitting duplicate conflicts.
+
+### T03 - Verify Controlled Rescan
+
+```task
+id: RAIL-FAB-WP-0013-T03
+status: todo
+priority: high
+state_hub_task_id: "0d6cad1d-16f8-4ac7-b8d3-b62a2f8e4549"
+```
+
+Rerun the three-repo controlled rescan against the local registry and confirm
+that `repo-scoping` no longer reports the seven lockfile duplicate conflicts.
+
+### T04 - Rollout Recommendation
+
+```task
+id: RAIL-FAB-WP-0013-T04
+status: todo
+priority: medium
+state_hub_task_id: "4be31147-b060-4b47-9589-8d3d8024879d"
+```
+
+Record whether broad all-local-repo baseline ingestion is ready after the
+identity refinement, or whether another targeted blocker remains.
+
+## Close Criteria
+
+- Unit tests cover path-scoped duplicate identity.
+- Reconciliation keeps semantic duplicate warnings intact.
+- Controlled rescan no longer flags distinct lockfiles as duplicates.
+- State Hub and this workplan capture the updated rollout recommendation.