Preserve ids carried under attributes, closing a document-ID collision

[gvonnessi]

Closes the collision half of #125. An id carried under a block's attributes was being relabeled by §4.3.1 item 5, applying alpha-equivalence to third-party vocabulary data where an id is content rather than a label.

The defect

Measured on main:

A: attributes.semantic.citation = [{id:"smith2020",…},{id:"jones2019",…}]
B: attributes.semantic.citation = [{id:"OTHER-KEY",…},{id:"DIFFERENT",…}]

computeDocumentId(A) == computeDocumentId(B)
  == sha256:869299f2c3d550ca698e09ad7db9ac0152e5a23dae32370742ae48aa8546ce5c

Two bibliographies whose citation keys differ entirely hashed identically, so a signature over one verified the other. Whether it fired turned on type versus @type, leaving well-formed JSON-LD accidentally immune and CSL-JSON exposed. Item 5 already exempts a semantic:bibliography entry's id for exactly this reason; the same data under attributes was not.

PRESERVED, not excluded

The distinction is the whole fix. Excluding takes the id out of the namespace but leaves rewriteIds mapping it onto a generated name — trading a loud failure for a silent one. That approach was implemented and reverted on the #128 branch. A preserved id stays in the map's INPUT and out of the map, so renameId returns it verbatim, reusing the mechanism semantic:term and semantic:footnote already use.

The duplicate cases still REJECT, and that is correct: the premise that nothing can reference material under attributes is false as implemented — a link mark's href resolves against such an id, so a duplicate there leaves a reference with two candidate referents.

§4.3.1 item 5 is amended to license this, since it previously called the two type-keyed exceptions "the only namespace members whose ids are left as authored". Shipping the behaviour without the amendment is the defect #126 was filed about; this branch did it, and the review caught it.

What this does NOT fix

The collision class remains open, and the entry says so. The same harm is reachable through any extension data array not literally named entries — a vendor:refs block with a citation array still gives one document ID for two entirely different key sets. Item 5 already states the broader rule; the reference implements it as a one-element denylist. Membership also still turns on type versus @type. Both are definedId keying membership on element shape where item 5 says position, and both are #132.

Review

Two cycles: adversarial-implementer, then correctness. Every finding closed or filed.

The correctness cycle's clean result is the important one. A 30,000-document differential fuzz against main, coverage floor measured (6,718 documents carrying a preserved id, 3,277 carrying both preserved and relabeled):

• new collision classes: 0
• documents main rejects that HEAD accepts: 0
• renaming a preserved id changed the document ID every time
• index consumption contiguous and order-independent across all three preserved kinds

That is the axis this file has failed on twice, and it is clean.

What the cycles found, all fixed here:

• The b<number> prohibition, extended to position-preserved ids, rejected b1/b2 — the CrossRef/JATS reference convention, so ordinary CSL bibliographies. 1,590 of 30,000 documents, the only new rejection class on the branch. Worse, it was asymmetric: the identical data in an entries array was accepted. Now scoped to the type-keyed exception, and the two positions behave identically — which is what the erratum's prose already claimed.
• The published vector did not discriminate: its id sat in an array, which item 5 already leaves as authored for a different reason, so an implementation that never applied the attributes rule reproduced the expected bytes. It now uses a singular sub-object, which nothing else reaches.
• The erratum's membership sentence read as covering every id under attributes; the reference only covers what definedId admits. Narrowed.
• "a link href resolves into it and is rewritten" was false — it stays verbatim, correctly, since a preserved id takes no canonical name.
• The fixture was named reject- while expecting INTEGRITY-ERROR. Renamed to match the two existing collision fixtures.
• The raw walk's preserved output was asserted by nothing: two barrier mutations survived all 30 gates. The differential now compares it, with two cases added to reach it — every pre-existing attributes row REJECTs, and the comparison skips those.

Verification

30/30 gates, plus the CI steps that are not npm scripts (npm audit --audit-level=high → 0 vulnerabilities, generate:template into a fresh dir). check:conformance: 380/380 (216 vectors + 164 fixtures), 0 failed, 0 advisory, 0 skipped. suiteVersion 0.2.4 → 0.2.5.

The vector and fixture kill different mutants: relabeling returning is caught only by the vector; the reverted exclude-from-namespace design is caught only by the fixture, and by nothing in the suite before now — which is how that design reached a branch.