JSON Pointer resolution requires a deterministic rule for duplicate object member names

JSON Pointer reference token evaluation against an object with duplicate member names has no specified selection behavior. The JSON specification treats unique object names as a SHOULD rather than a MUST, so a conforming processor may accept documents where the same name appears multiple times. The JSON Pointer specification defines an error for a missing member but does not state whether evaluation must select the first match, the last match, or fail when several members share the token.

Because JSON Patch operations are defined in terms of JSON Pointer, the same ambiguity propagates into add, replace, remove, and test. The observable behavior can also depend on the host object model: dictionary-backed models may collapse duplicates to one value, while ordered pair-preserving models retain both entries. This creates a correctness risk where two processors accept the same bytes yet resolve a pointer to different values or produce different patch outcomes.

The missing constraint is whether a JSON Pointer implementation should require normalized documents with unique names, resolve to a deterministic member, or introduce a new error for ambiguous references. Should JSON Patch libraries reject or canonicalize duplicate names before applying operations? Which behavior should a configuration mandate for untrusted input?