[tobiasraabe]

Summary

• validate task-signature uniqueness after collection hooks and during collection modification
• defend DAG construction against duplicate task identities
• report every collision group with task names, callables, and source locations
• add regression tests for programmatic tasks, diagnostics, and direct DAG construction

Root cause

The DAG stores tasks by signature and silently replaces node data when the same signature is inserted twice. Programmatic PTask objects and plugin-modified task lists could therefore collect two tasks but execute only one while the build exited successfully.

Impact

Duplicate task identities now fail collection before execution. DAG construction also enforces the invariant defensively, so alternate callers cannot silently discard tasks.

Validation

• uv run --group test pytest --snapshot-warn-unused: 936 passed, 39 skipped, 4 xfailed
• uv run --group typing --group test --isolated ty check --python-platform linux: passed
• changed-file ty check: passed on Windows
• project-locked uv run ruff check .: passed
• project-locked ruff format --check for changed files: passed
• all non-Ruff pre-commit hooks: passed

The repository's just recipes cannot locate their configured shell on this Windows checkout. In addition, the pre-commit Ruff 0.16 hook reports new baseline rules across untouched main, while the project lock currently provides Ruff 0.15.16. The PR was checked with the project-locked Ruff version and does not alter lint configuration.