Reject duplicate file features

Author: olwang

README.md

@@ -124,6 +124,8 @@ features: local
 
 The MVP implements only `local`. Future feature names such as `native`, `unsafe`, `async`, `device`, `ffi`, and `reflection` are reserved for capabilities that change review risk or require checker/runtime support. Ordinary libraries like JSON, File, Image, HTTP, Map, and Regex are not features.
 
+Each feature may appear only once. Unknown or repeated feature names are diagnostics so capability boundaries are not silently normalized.
+
 ### Reviewable at the boundary
 
 Function calls use named arguments and visible effects.

RSScript_v0.5_Spec.md

@@ -624,6 +624,8 @@ A file without a `features:` declaration is managed-only:
 
 This lowers entry friction for ordinary scripts.
 
+Each feature may appear at most once in a `features:` declaration. Duplicate feature names are diagnostics rather than silently ignored, because the header is a review capability boundary.
+
 ---
 
 ## 8.2 Default Managed File

src/analyzer.rs

@@ -67,6 +67,7 @@ impl Analyzer<'_> {
     fn run(&mut self) {
         self.check_single_feature_declaration();
         self.check_unknown_file_features();
+        self.check_duplicate_file_features();
         self.check_removed_profile_declarations();
         self.check_unsupported_syntax();
         self.check_duplicate_declarations();
@@ -123,6 +124,27 @@ impl Analyzer<'_> {
         }
     }
 
+    fn check_duplicate_file_features(&mut self) {
+        for feature in &self.syntax_program.duplicate_features {
+            self.diagnostics.push(
+                Diagnostic::error(
+                    code::DUPLICATE_FILE_FEATURE,
+                    format!("Duplicate file feature `{}`.", feature.name),
+                    feature.span.clone(),
+                    "duplicate feature",
+                )
+                .with_cause(
+                    "File features are capability declarations; repeating one makes the review boundary noisier without changing semantics.",
+                )
+                .with_fix(
+                    "remove_duplicate_feature",
+                    format!("Remove the repeated `{}` feature.", feature.name),
+                    "machine-applicable",
+                ),
+            );
+        }
+    }
+
     fn check_removed_profile_declarations(&mut self) {
         for span in &self.syntax_program.profile_spans {
             self.diagnostics.push(

src/diagnostic.rs

@@ -17,6 +17,7 @@ pub mod code {
     pub const INVALID_NOALLOC_ALLOCATION: &str = "RS0014";
     pub const UNSUPPORTED_SYNTAX: &str = "RS0015";
     pub const UNKNOWN_FILE_FEATURE: &str = "RS0016";
+    pub const DUPLICATE_FILE_FEATURE: &str = "RS0017";
     pub const FEATURE_VIOLATION: &str = "RS0101";
     pub const UNNAMED_ARGUMENT: &str = "RS0201";
     pub const MISSING_DATA_EFFECT: &str = "RS0202";
@@ -296,6 +297,11 @@ static DIAGNOSTIC_EXPLANATIONS: &[DiagnosticExplanation] = &[
         title: "unknown file feature",
         explanation: "A `features:` header may only list review-relevant capabilities known to this compiler version. Unknown feature names are rejected so typos do not silently change review risk.",
     },
+    DiagnosticExplanation {
+        code: code::DUPLICATE_FILE_FEATURE,
+        title: "duplicate file feature",
+        explanation: "Each review-relevant capability may appear at most once in a `features:` header. Duplicate entries are rejected instead of silently folded away.",
+    },
     DiagnosticExplanation {
         code: code::FEATURE_VIOLATION,
         title: "feature violation",

src/syntax/ast.rs

@@ -17,10 +17,17 @@ pub struct UnknownFileFeature {
     pub span: Span,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DuplicateFileFeature {
+    pub name: String,
+    pub span: Span,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Program {
     pub features: Vec<FileFeature>,
     pub unknown_features: Vec<UnknownFileFeature>,
+    pub duplicate_features: Vec<DuplicateFileFeature>,
     pub feature_spans: Vec<Span>,
     pub profile_spans: Vec<Span>,
     pub items: Vec<Item>,

src/syntax/parser.rs

@@ -1,8 +1,11 @@
+use std::collections::HashSet;
+
 use crate::lexer::{Token, TokenKind, lex};
 use crate::syntax::ast::{
-    BinaryOp, Block, CallArg, Callee, DataEffect, EffectDecl, Expr, FieldDecl, FileFeature,
-    FunctionDecl, GenericBound, GenericParam, IfStmt, Item, LetKind, LetStmt, LoopStmt, Param,
-    Program, ReturnStmt, Stmt, TypeDecl, TypeKind, TypeRef, UnknownFileFeature, WithStmt,
+    BinaryOp, Block, CallArg, Callee, DataEffect, DuplicateFileFeature, EffectDecl, Expr,
+    FieldDecl, FileFeature, FunctionDecl, GenericBound, GenericParam, IfStmt, Item, LetKind,
+    LetStmt, LoopStmt, Param, Program, ReturnStmt, Stmt, TypeDecl, TypeKind, TypeRef,
+    UnknownFileFeature, WithStmt,
 };
 
 pub fn parse_source(file: &str, source: &str) -> Program {
@@ -22,12 +25,14 @@ struct Parser<'a> {
 struct ParsedFeatures {
     features: Vec<FileFeature>,
     unknown_features: Vec<UnknownFileFeature>,
+    duplicate_features: Vec<DuplicateFileFeature>,
 }
 
 impl Parser<'_> {
     fn parse_program(&mut self) -> Program {
         let mut features = Vec::new();
         let mut unknown_features = Vec::new();
+        let mut duplicate_features = Vec::new();
         let mut feature_spans = Vec::new();
         let mut profile_spans = Vec::new();
         let mut items = Vec::new();
@@ -38,6 +43,7 @@ impl Parser<'_> {
                 let parsed = self.parse_features();
                 features.extend(parsed.features);
                 unknown_features.extend(parsed.unknown_features);
+                duplicate_features.extend(parsed.duplicate_features);
             } else if self.at_ident("profile") && self.peek_symbol(1, ":") {
                 profile_spans.push(self.tokens[self.index].span.clone());
                 self.index += 1;
@@ -58,6 +64,7 @@ impl Parser<'_> {
         Program {
             features,
             unknown_features,
+            duplicate_features,
             feature_spans,
             profile_spans,
             items,
@@ -69,13 +76,24 @@ impl Parser<'_> {
         let end = declaration_line_end(self.tokens, self.index);
         let mut features = Vec::new();
         let mut unknown_features = Vec::new();
+        let mut duplicate_features = Vec::new();
+        let mut seen_features = HashSet::new();
         while self.index < end {
             if self.at_symbol(",") {
                 self.index += 1;
                 continue;
             }
             let token = self.tokens.get(self.index);
             if let Some(feature) = parse_file_feature(token) {
+                let name = file_feature_name(feature).to_string();
+                if !seen_features.insert(feature)
+                    && let Some(token) = token
+                {
+                    duplicate_features.push(DuplicateFileFeature {
+                        name,
+                        span: token.span.clone(),
+                    });
+                }
                 features.push(feature);
             } else if let Some(token) = token
                 && !matches!(token.kind, TokenKind::Eof)
@@ -90,6 +108,7 @@ impl Parser<'_> {
         ParsedFeatures {
             features,
             unknown_features,
+            duplicate_features,
         }
     }
 
@@ -1110,6 +1129,18 @@ fn parse_file_feature(token: Option<&Token>) -> Option<FileFeature> {
     }
 }
 
+fn file_feature_name(feature: FileFeature) -> &'static str {
+    match feature {
+        FileFeature::Local => "local",
+        FileFeature::Native => "native",
+        FileFeature::Unsafe => "unsafe",
+        FileFeature::Async => "async",
+        FileFeature::Device => "device",
+        FileFeature::Ffi => "ffi",
+        FileFeature::Reflection => "reflection",
+    }
+}
+
 fn statement_end(tokens: &[Token], start: usize, limit: usize) -> usize {
     let line = tokens[start].span.line;
     let mut depth = 0usize;

tests/checker.rs

@@ -1664,6 +1664,28 @@ fn main() -> Unit {
     );
 }
 
+#[test]
+fn checker_rejects_duplicate_file_features() {
+    let source = r#"
+features: local, local
+
+fn main() -> Unit {
+    return Unit
+}
+"#;
+    let program = parse_source("features.rss", source);
+
+    assert_eq!(program.features.len(), 2);
+    assert_eq!(program.duplicate_features.len(), 1);
+    assert_eq!(program.duplicate_features[0].name, "local");
+    let diagnostics = analyze_source("features.rss", source);
+    assert!(
+        diagnostics
+            .iter()
+            .any(|diagnostic| diagnostic.code == "RS0017")
+    );
+}
+
 #[test]
 fn review_map_marks_public_rssi_signatures_review_required() {
     let source = r#"

tests/fixtures/fail/duplicate-file-feature.rss

@@ -0,0 +1,6 @@
+// expect: RS0017
+features: local, local
+
+fn main() -> Unit {
+    return Unit
+}