The scenario asks a referent decision whose options are A, B and none, but propositionsFromDecisions builds the executable include set from every candidate in the frame. Subtracting the risky choice from that larger set is only equivalent to “the other one” when the frame contains exactly the intended pair.

P6-2 adds an unrelated task C to the pipeline scope while leaving the accepted decisions unchanged: sketchy=B and operation=task.resume. The run reports RESOLVED and the pipeline invokes both A and C. C was never in the bounded referent question. The existing answer-inversion test proves the A/B case, but it does not establish that the host preserves the decision domain or singular cardinality.

For this deliberately fixed scenario, reject a scope that cannot identify a unique remaining member of the intended pair. Alternatively derive decision options and target selection from an explicitly identified domain. Do not broaden a singular request to every retrieved candidate. This needs a small contract check, not an English interpreter.

Fix direction. Bind the reference scenario to a unique, explicit A/B candidate domain and require one remaining target. Reject or clarify an incompatible scope before emitting executable propositions.

Evidence: P6-2

90:   const riskyRef = refForChoice(frame, risky);
91:   if (!riskyRef) return [];
92:   const scopeRefs = frame.candidates.map((candidate) => candidate.ref);
93:   return [
94:     {
95:       act: "request",
96:       operation: "exclude",
97:       refs: [riskyRef],
98:       polarity: "exclude",
99:       decisions: [sketchyTrace.id],
100:     },
101:     {
102:       act: "request",
103:       operation: "reference",
104:       refs: scopeRefs,
105:       polarity: "include",
106:       capability,
107:       decisions: [operationTrace.id],

taskResume advertises conditionalApply="atomic", but the demo executor ignores InvokeRequest.preconditions and immediately records every binding as invoked. The earlier authority validation cannot provide atomic execution: the world may move after that validation and before the executor applies the request.

P6-3 wraps the authority validator so it returns current for A version 1, then changes A to version 2 before returning control to the runtime. The executor still records A and returns SUCCEEDED. The retained drift test moves the world before validation, so it exercises only the earlier check and misses this boundary.

The inspector is intended to demonstrate the full contract, and its executor is the part responsible for this guarantee. Compare all frozen preconditions against the demo world immediately before recording or applying any effect, with no asynchronous gap. On mismatch, fail without touching any target. If the demo does not implement that contract, it must not advertise atomic application.

Fix direction. Check every frozen precondition in the demo executor before any application; return a stale or invalidated failure on disagreement. Keep the check and apply synchronous within the in-process world.

Evidence: P6-3

105:     invoke: async (request: InvokeRequest) => {
106:       for (const binding of request.bindings) {
107:         for (const ref of binding.refs) invoked.push(ref);
108:       }
109:       return {
110:         ok: true,
111:         status: "SUCCEEDED",

The demo reconciler returns SUCCEEDED for every receipt and keeps no operation records. A receipt proves that the runtime attempted dispatch; it does not prove that the executor applied the operation. The executor also ignores repeated idempotency keys while advertising runtime-key idempotency.

P6-8 runs the real pipeline with a dispatch wrapper that throws before calling the demo executor. The runtime correctly journals UNKNOWN, and world.invoked is empty. A fresh runtime recovers that journal and calls the demo reconciler, which changes the effect to SUCCEEDED even though no invocation occurred. P6-4 confirms the same result for a completely unknown receipt. P6-9 invokes the same request twice and records A twice.

Keep a small operation-result map in the demo world, keyed and checked by the dispatched operation identity. Known duplicate keys should return the recorded result without another application. Reconciliation must return UNKNOWN for absent or mismatched operations. No durable external executor service is needed here; after a fresh demo world loses its operation records, UNKNOWN is the truthful result.

Fix direction. Record applied operations and results in the demo executor, deduplicate known idempotency keys, and reconcile only matching recorded outcomes. Unknown receipts must remain UNKNOWN.

Evidence: P6-4, P6-8; P6-9 idempotency control

109:       return {
110:         ok: true,
111:         status: "SUCCEEDED",
112:         receipt: {
113:           effectId: request.effectId,
114:           executor: "demo-executor",
115:           idempotencyKey: request.idempotencyKey,
116:           dispatchedAt: new Date(0).toISOString(),
117:         },
118:       };
119:     },
120:     reconcile: async () => ({ status: "SUCCEEDED" as const }),

The authority stores entities under entityRefKey, then splits that escaped key on pipes and treats each component as the original string. entityRefKey escapes colons, pipes and percent signs. Splitting identifies component boundaries but does not undo those escapes.

P6-1 observes the valid ID A:pipe|percent%. The returned ID is A%3Apipe%7Cpercent%25, a different entity. When observation ingestion keys it again, it is escaped a second time. The originally requested reference no longer matches its evidence, causing valid targets to disappear or lack usable version evidence.

Use the existing decodeIdentityComponent helper for all four components, or retain the original EntityRef alongside the demo entity. This is an identity fix; the simple A/B fixtures currently hide it.

Fix direction. Decode all split components with the core identity helper, or store original refs instead of reconstructing them from keys.

Evidence: P6-1

66:           const [authorityId = "demo-tasks", namespace = "tasks", type = "task", id = key] =
67:             key.split("|");
68:           return {
69:             ref: { authority: authorityId, namespace, type, id },
70:             version: { authority: authorityId, token: entity.version, observedAt: new Date(0).toISOString() },

The input helper creates a FileJournal but returns it through the narrower InteractionJournal field. Tests pass it inline to the pipeline and then remove the temporary directory in finally without closing the writable handle. The pipeline correctly treats its injected journal as caller-owned, so it cannot clean up the lost reference for these tests.

The independent cleanup probe imports and runs all six retained inspector tests, then inspects /proc/self/fd. Four descriptors still point to deleted circe-inspector journal files. Linux permits the deletion and the tests pass, but repeated runs leak descriptors and hold the unlinked files until process exit. Read-only recovery handles are lazy and do not account for these four leaks.

Retain each FileJournal in the test fixture and close it in finally before rmSync. Apply the same explicit ownership pattern to any handle that can append. The CLI closes its writable journal already; this finding concerns the test fixture.

Fix direction. Have the fixture retain and expose the FileJournal or a cleanup callback; close writable journals before removing temporary directories in every finally block.

Evidence: fd-cleanup.test.ts afterAll assertion

29: function input(
30:   journalPath: string,
31:   world: ReturnType<typeof createDemoWorld>,
32:   answers: { sketchy: string; operation: string },
33:   overrides: Partial<InteractionPipelineInput> = {},
34: ): InteractionPipelineInput {
35:   return {
36:     interactionId: "interaction:inspector",
37:     observationId: "event:inspector",
38:     utterance: "Leave the sketchy auth one alone and continue the other one.",
39:     now,
40:     refs: [refA, refB],
41:     capabilities,
42:     workflow: difficultUtteranceWorkflow,
43:     backend: createScriptedBackend(answers),
44:     policy: ACCEPTANCE_POLICY_V1,
45:     propositions: propositionsFromDecisions,
46:     journal: createFileJournal(journalPath),
47:     authorities: world.authorities,
48:     executors: world.executors,
49:     ...overrides,

The only substantive shared perception change in this PR adds collectRefKeys, but nothing calls it outside its own recursive body. The active argument exclusion and evidence paths already use argumentRefsOf. This new traversal contributes no protection to the inspector pipeline.

Keeping an unused second implementation makes the security-sensitive argument handling harder to assess and suggests a check is active when it is not. The new helper also lacks the safeguards of the existing argument validation path. It is dead code, so that difference is not currently an execution defect.

Delete the unused helper and the stray blank line added in compileSemanticTurn. The inspector PR can then leave this shared compiler file unchanged. This cleanup is nonblocking, but it directly reduces unnecessary code in an already reviewed boundary.

Fix direction. Remove collectRefKeys and its incidental whitespace change; retain the existing argumentRefsOf-based validation.

Evidence: Static reference search: only definition and self-calls

298: /** Entity refs hidden anywhere in opaque argument values. */
299: function collectRefKeys(value: unknown, found = new Set<string>()): Set<string> {
300:   if (Array.isArray(value)) {
301:     for (const item of value) collectRefKeys(item, found);
302:     return found;
303:   }
304:   if (typeof value !== "object" || value === null) return found;
305:   const record = value as Record<string, unknown>;
306:   if (
307:     typeof record.namespace === "string" &&
308:     typeof record.type === "string" &&
309:     typeof record.id === "string" &&
310:     typeof record.authority === "string"
311:   ) {
312:     found.add(entityRefKey(record as { namespace: string; type: string; id: string; authority: string }));
313:   }
314:   for (const nested of Object.values(record)) collectRefKeys(nested, found);
315:   return found;
316: }