Address copilot pass 6 on #4

Three real findings:

1. entryMatchesId only did exact string equality, missing the
   relative-IRI case (line 639). JSON-LD profiles often write VM
   ids as `"#lws-key-1"` which resolve against the document URL.
   Without absolutization, fragment-collision detection would walk
   PAST an existing relative entry as if free, then merge would
   create a duplicate. Now resolves both sides against baseUrl
   before comparing. Verified across absolute/relative/object-
   wrapped forms.

2. authentication de-dupe had the same blind spot (line 631) —
   could push an absolute IRI even when an equivalent "#fragment"
   already existed. Now absolutizes both sides via the same helper.

3. PATCH-failure path left the test UI in a stale "ready to test"
   state if a prior run had succeeded (line 500). Could mislead a
   user into hitting Test with a kid the server may not have. Now
   clears lastVmKid, hides testSection, resets testResult in the
   catch block.

Author: melvincarvalho

doctor.js

@@ -497,7 +497,15 @@ patchButton.addEventListener('click', async () => {
   } catch (err) {
     patchResult.className = 'patch-result error';
     patchResult.textContent = `Failed: ${err.message || err}`;
+    // Reset everything that depended on the patch having succeeded.
+    // Otherwise a UI that already showed the test section from a
+    // prior successful run would still claim "ready to test" with a
+    // stale kid against a now-uncertain server state.
     memPrivKey = null;
+    lastVmKid = null;
+    testSection.hidden = true;
+    testResult.textContent = '';
+    testResult.className = 'test-result';
   }
 });
 
@@ -576,7 +584,7 @@ function chooseFragmentAndBuildVm({ privKey, profile, webId, controller }) {
 
   for (let n = 1; n <= 99; n++) {
     const candidateId = `${docUrl}#lws-key-${n}`;
-    const existing = vms.find((v) => entryMatchesId(v, candidateId));
+    const existing = vms.find((v) => entryMatchesId(v, candidateId, docUrl));
     if (!existing) {
       const result = buildEs256kVerificationMethod({
         privKey, webId, controller, fragment: `lws-key-${n}`,
@@ -615,30 +623,50 @@ function chooseFragmentAndBuildVm({ privKey, profile, webId, controller }) {
  */
 function mergeVerificationMethod(profile, vm) {
   const out = { ...profile };
+  const baseUrl = stripHashLocal(vm.id);
   const vms = Array.isArray(out.verificationMethod) ? [...out.verificationMethod]
             : out.verificationMethod ? [out.verificationMethod]
             : [];
-  const idx = vms.findIndex((v) => entryMatchesId(v, vm.id));
+  const idx = vms.findIndex((v) => entryMatchesId(v, vm.id, baseUrl));
   if (idx >= 0) vms[idx] = vm;
   else vms.push(vm);
   out.verificationMethod = vms;
 
   const auth = Array.isArray(out.authentication) ? [...out.authentication]
              : out.authentication ? [out.authentication]
              : [];
-  if (!auth.some((a) => (typeof a === 'string' ? a : a?.['@id'] || a?.id) === vm.id)) {
-    auth.push(vm.id);
-  }
+  // De-dupe against the absolutized form so a pre-existing relative
+  // entry like "#lws-key-1" is recognized as the same as the absolute
+  // URI we're about to push.
+  const exists = auth.some((a) => {
+    const raw = typeof a === 'string' ? a : (a?.['@id'] || a?.id);
+    if (typeof raw !== 'string') return false;
+    return absolutizeLocal(raw, baseUrl) === vm.id;
+  });
+  if (!exists) auth.push(vm.id);
   out.authentication = auth;
   return out;
 }
 
-function entryMatchesId(entry, id) {
-  if (typeof entry === 'string') return entry === id;
-  if (entry && typeof entry === 'object') return (entry.id || entry['@id']) === id;
+function entryMatchesId(entry, id, baseUrl) {
+  // Handle relative IRIs the way JSON-LD does: resolve against the
+  // document URL before comparing. This lets us recognize existing
+  // entries written as "#lws-key-1" as equivalent to the absolute
+  // form we generate.
+  const resolve = (s) => (typeof s === 'string' ? absolutizeLocal(s, baseUrl) : s);
+  if (typeof entry === 'string') return resolve(entry) === resolve(id);
+  if (entry && typeof entry === 'object') {
+    const raw = entry.id || entry['@id'];
+    return typeof raw === 'string' && resolve(raw) === resolve(id);
+  }
   return false;
 }
 
+function absolutizeLocal(u, base) {
+  if (!u) return u;
+  try { return new URL(u, base).toString(); } catch { return u; }
+}
+
 function sameJwk(a, b) {
   // Compare the public-key material, not auxiliary fields like `kid`,
   // `alg`, or `use`. Two VMs are "the same key" iff x and y match.