[kreneskyp]

FR-018 still treats duplicate record fields and malformed optional wrappers as if both could be successful source/context inputs to public CG generation. The owning checker rejects duplicate declarations before context creation, and its emitter derives the canonical optional wrapper from admitted Presence. This spec-only amendment makes those stages explicit without dropping their precise defenses.

Only FR-018 and TC-029 change:

• A duplicate-field source control keeps root compile_admitted’s Package/CompileRefusal payload with public code() == Code::AmbiguousDeclaration and cause() == None for Assembly, with no successful context or CG invocation. Separate private CG declaration checks retain exact DuplicateMember name/cause and sibling isolation.
• The genuine public List/Tree shape, original keys, Optional presence and recursive behavior remain required. The four malformed optional-wrapper controls retain exact private MalformedComposite/no-symbol/no-required-field-reinterpretation/healthy-sibling assertions. Additional malformed source/wire controls retain their actual owning intake refusal; no common unmeasured diagnostic or fake source spelling is prescribed.
• AC-8’s emitted check_type/invariant/no-charge clause is unchanged. No other declaration/recursion case is reclassified, and genuine contexts, early mismatch rules, ABI, values/domains and proof obligations are unchanged. These specification obligations remain planned until implementation and qualification.

Owning source grounding in the inspected QSL composite-facade implementation:

• qsl-semantics/src/check/assemble.rs:2062–2075 performs TypeEnvironment admission; :2109 maps Refused to InvalidTypeDeclaration; :499–500 maps DuplicateMember to AmbiguousDeclaration. Public qsl-replay/src/spine.rs:220–238 forwards the Assembly code, while :255–272 explicitly returns None for its public cause; the internal assembly cause is not a promised public accessor result.
• qsl-replay/src/admitted.rs:404–427 creates context only after successful recompile; :474–506 retains checked record/tuple keys, form and names. It supplies no unchecked malformed context.
• qsl-semantics/src/check/lowering.rs:742–760 emits the canonical single optional wrapper from admitted Presence, separating that valid representation from synthetic internal wrapper mutations.
• Existing CG private parser assertions remain exact. Prior PRs Align bound negatives with the owning IR admission stage #489 and Scope admitted equality context and preserve direct Integer roots #490 deliberately preserved AC-8/AC-26; this corrects that residual allocation rather than claiming the earlier changes already settled it.

Validation: installed Quire validation passes both documents, diff whitespace checks pass, and bounded advisor reports AC-8/AC-26 Test as catalogued with no mismatch or inconclusive result. Programmatic comparison confirms AC-8’s oracle clause and unrelated AC-9/14/16/24/27/42 rows unchanged. No product/dependency/lock edits, Cargo, formatter, build, native, proof or aggregate jobs ran. This PR does not close IR-17 or IR-705.

Review fix: the initial draft incorrectly required an internal assembly cause through the public facade. The same-PR correction now requires only the actual public AmbiguousDeclaration code and None cause, retaining the precise private DuplicateMember defense and all source-before-context behavior. No new owner API or internal dependency is introduced. The gap report remains 314 obligations (311 baseline, two IR-621, one planned IR-17 AC-8), with recorded owners; this documentation fix deletes no test and claims no green implementation result.