PR #4 is ready to merge

DispatchReceipt declares idempotencyKey as optional, but validateReceipt now requires a string unconditionally. This makes the persisted decoder stricter than the exported InteractionJournal contract. A receipt identified by its externalOperationId is a valid typed value without an idempotency key.

L1 constructs a dispatch-acknowledged entry using InteractionLogEntry with no unsafe type assertion. The journal successfully appends it. The next ordinary append rereads that record, rejects it as corrupt because receipt.idempotencyKey is missing, and poisons the handle. A keyed receipt follows the same path successfully in L5.

This is a regression introduced by the new validator. The kernel's current invoke path supplies a key, which explains why runtime fixtures pass, but the public journal port accepts the wider declared receipt type. A valid acknowledged record must remain readable and appendable. Validate optional fields when present instead of silently narrowing the port contract.

Fix direction. Check receipt.idempotencyKey only when it is present. Keep the required receipt fields required, and cover both keyed and external-operation receipts in a typed write/read/append round trip.

L1 fails; L5 is the keyed-receipt control.

878: function validateReceipt(value: unknown, context: string): void {
879:   const record = journalRecord(value, context);
880:   journalString(record.effectId, `${context}.effectId`);
881:   journalString(record.executor, `${context}.executor`);
882:   journalString(record.idempotencyKey, `${context}.idempotencyKey`);
883:   journalString(record.dispatchedAt, `${context}.dispatchedAt`);

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/types.ts` around lines 878-883, align `validateReceipt` with the existing `DispatchReceipt` type, whose `idempotencyKey` is optional. L1 in `/tmp/circe-pr4-evidence/disk-round3.test.ts` appends a fully typed receipt without that key and then fails on the next ordinary append because the decoder rejects the earlier valid record. Validate the key only when present, without changing the public type to hide the mismatch. Preserve required receipt validation and test read/reopen/continued append with both optional-key omission and a populated key. L5 provides the keyed control. Keep the existing runtime round trips and all prior independent checks passing.

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/journal-file/src/index.ts` around lines 160-165, do not use constructor-time tailRepair absence as proof that the current append boundary is clean. Another supported handle can leave a partial write after this handle was created. Before accepting the next append, inspect the current boundary or enforce equivalent shared invalidation. Preserve prior complete records and the next acknowledged record, or fail closed before writing. K1 in `/tmp/circe-pr4-evidence/disk-round2.test.ts` reproduces the failure using sequential real-file writes and one injected write failure. Keep K4, which verifies that a later handle does not truncate another handle's successful repair, and all earlier disk checks passing.

Original finding below, preserved from round 1.

The constructor validates the file with parseEntries, but discards the location of the tolerated final fragment. handle then opens the same bytes with O_APPEND. Ignoring a broken tail while reading does not make the file safe to append to.

J1 loads an old valid record followed by an incomplete JSON fragment, then appends a new record successfully. Without a trailing newline, the new record joins the fragment and disappears on the next read. With a trailing newline, the fragment becomes an interior hole and reopening rejects the entire journal. J2 starts with a complete final JSON record missing only its newline; the next append concatenates two JSON objects and both records disappear.

These are supported recovery inputs, not concurrent-writer scenarios. The current tests stop after reading the tolerated tail. A recovery adapter must preserve the next acknowledged append too. Otherwise a successful write-ahead append can be missing when the kernel next reconstructs state.

Fix direction. Retain the last safe byte boundary and normalize the tail before accepting another append, with the repair included in the durability boundary. Alternatively fail closed until an explicit repair completes. Preserve complete records and ensure a final complete record without a newline stays separate from the next record.

J1, J2: three failing cases

93:   parseEntries(path);
94: 
95:   let descriptor: number | undefined;
96:   let directorySynced = existed;

Original finding below, preserved from round 1.

directorySynced is initialized from existsSync. That proves the name is currently visible, not that a previous creation synced its directory. A failed first append can leave a complete, file-synced journal behind before the directory sync succeeds.

J3 injects a failure only into the first parent-directory fsync. The initial append correctly throws and poisons its handle. After close and reopen, a second append returns success, but no parent-directory fsync is attempted because the path now exists. The reopened handle has forgotten the unfinished creation durability step.

File fsync does not establish durability of its directory entry. A later successful append therefore lacks the documented guarantee that the filename survives power loss. This probe establishes the missing syscall after a real-file failure sequence; it does not simulate a physical power loss.

Fix direction. Establish parent-directory durability on the first durable append of a newly opened journal even when its path already exists, or use a protocol that proves creation durability. An existence check alone cannot carry that proof across handles.

J3: one failing case

90:   const existed = existsSync(path);
91:   // Validate before opening: a directory, device or FIFO at this path must not
92:   // become a blocking or redirecting append target.
93:   parseEntries(path);
94: 
95:   let descriptor: number | undefined;
96:   let directorySynced = existed;

File fsync does not guarantee directory-entry persistence; the parent directory needs its own sync. Linux fsync(2).

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/types.ts` around lines 977-984, validate the EntitySnapshot members inside persisted discourse views. The current `journalRecord(entity, ...)` only proves the member is an object, so `{}` crosses the journal boundary and a later proposal crashes in `latestSnapshots` while reading its missing ref. Reuse `validateEntityRef` and the owned authority-token checks for ref and version, validate the snapshot container fields, and leave application attribute values opaque. M1 and M2 in `/tmp/circe-pr4-evidence/disk-round4.test.ts` reproduce acceptance and the downstream crash. Keep M3 passing: a populated valid view must restore evidence, execute once, and replay after restart without another invocation. Preserve all 119 prior independent checks; do not add a special case for an empty object.

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/types.ts` around lines 812-817, 903-925, finish the owned nested-data checks behind `decodeJournalEntry`. Array shape alone does not validate the scopes, views and referents that restoration dereferences, and a SlotBinding needs expectations and origins that a FrozenSlotBinding does not. L2 and L3 in `/tmp/circe-pr4-evidence/disk-round3.test.ts` cover null discourse members and a binding missing expectations. Use distinct validators for the two binding types and validate collection members with the corresponding owned structure validators, including result arrays where applicable. Preserve line-numbered corruption errors and keep application payloads opaque. Keep all 112 earlier probes and the valid snapshot control passing; avoid per-example rejection rules.

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/types.ts` around lines 785-881, complete `decodeJournalEntry` for the owned nested data consumed by recovery. Checking that transaction, intent or result is a non-null object does not establish the InteractionLogEntry type. Reject missing or wrongly typed required nested fields with the journal loader's line-numbered corruption context; keep arbitrary application payloads opaque. K2 and K3 in `/tmp/circe-pr4-evidence/disk-round2.test.ts` cover a transaction without effects, an empty intent, an empty command result and the resulting recovery crash. Reuse compact validators for owned structures instead of adding per-example exceptions or a second divergent schema. Keep valid runtime journal round trips and the original rejection cases passing.

Original finding below, preserved from round 1.

The catch that tolerates a torn final JSON fragment also catches the loader's own record-shape errors. A complete final null, number or unrelated object is silently discarded. Separately, an object with any string kind is cast to InteractionLogEntry without checking the required data for that entry.

J4 writes a valid record followed by each of null, 42 and an unrelated object, all newline-terminated. All three open successfully instead of reporting corruption. J5 places an effect-frozen object with no effect in the interior of the file; it is also accepted. For the matching interaction, the core recovery reader accesses entry.effect.id directly at journal-recovery.ts:172.

This contradicts the adapter's stated refusal of non-entry lines and moves malformed persisted data past the typed journal boundary. These probes deliberately corrupt files; they do not claim the current runtime normally emits those records. Keep syntax truncation tolerance distinct from record validation, and report a useful line-numbered corruption error.

Fix direction. Catch JSON syntax errors separately from entry decoding. Reject complete invalid records at any position and validate required fields of recognized entry kinds before exposing InteractionLogEntry values. Share a small decoder at the journal boundary if appropriate; avoid maintaining a second divergent journal schema.

J4, J5: four failing cases

64:     try {
65:       const parsed: unknown = JSON.parse(trimmed);
66:       if (
67:         typeof parsed !== "object" ||
68:         parsed === null ||
69:         Array.isArray(parsed) ||
70:         typeof (parsed as { kind?: unknown }).kind !== "string"
71:       ) {
72:         throw new Error("entry is not an object with a string kind");
73:       }
74:       entries.push(parsed as InteractionLogEntry);
75:     } catch (error) {
76:       // A crash mid-append can tear the final line (with or without its
77:       // newline). A damaged interior line is a hole and must be refused.
78:       if (index === lastNonEmpty) continue;