Duplicate semantic labels make model candidate selection ambiguous

Opaque candidate IDs prevent invention, but they do not make candidates semantically distinguishable. If two current records expose the same step, intent, or label, reject any model selection unless the server provides an independent discriminator. Apply this uniqueness check regardless of the model's self-reported reason or confidence; otherwise the model can arbitrarily choose one duplicate by changing its explanation. Fail closed or obtain additional server-owned context rather than treating a label match as identity.

Applies when: an LLM selects among bounded records that may share the same visible facts. Keywords: LLM candidate selection duplicate labels ambiguity identity confidence fail closed