535:   const buildPayload = (candidates: ContextCandidate[]) => ({
536:     interactionId: request.interactionId,
537:     observationId: request.observationId,
538:     utterance: request.utterance,
539:     interaction: request.interaction,
540:     policy: policy.version,
541:     expansionLevel: level,
542:     // Capability order is caller order: the hash must cover the exact bytes
543:     // the backend will receive, not a canonicalized subset.
544:     capabilities: [...(request.capabilities ?? [])].map((capability) => ({
545:       capabilityId: capability.capabilityId,
546:       description: capability.description,
547:       semanticEffects: capability.semanticEffects,
548:       slots: capability.slots,
549:     })),
550:     candidates: candidates.map((candidate) => ({
551:       ...candidate,
552:       reasons: [...candidate.reasons].sort(),
553:     })),

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/context/src/assembly.ts` around lines 535-553, The hash payload is built before completeness and excludes it. It also differs from the full ContextFrame passed to the backend. The capability-order case is fixed, but exact-input provenance is not. Two providers return identical seeds and different truncated flags. The resulting frames have different completeness and can trigger different acceptance policy, yet their hashes are equal. With the same store version, their frame IDs also coincide; recordFrame treats the second as the already stored first frame because only hashes are compared. Define and persist one canonical model request, including coverage and relevant policy metadata, then hash that representation. Keep semantic cache keys separate from exact request identity. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

558:   let frameSizeExceeded = false;
559:   const maxFrameBytes = budget.maxFrameBytes;
560:   while (stableStringify(payload).length > maxFrameBytes) {
561:     // Drop the weakest soft candidate first; required (pinned) context is
562:     // never silently discarded, it is reported instead.
563:     let dropIndex = -1;
564:     let dropScore = Number.POSITIVE_INFINITY;
565:     candidates.forEach((candidate, index) => {
566:       const key = entityRefKey(candidate.ref);
567:       if (seedClasses.get(key) === "pinned") return;
568:       const score = scores.get(key) ?? 0;
569:       if (score < dropScore) {
570:         dropScore = score;
571:         dropIndex = index;
572:       }
573:     });
574:     if (dropIndex < 0) break;
575:     candidates.splice(dropIndex, 1);
576:     payload = buildPayload(candidates);
577:     frameSizeExceeded = true;
578:   }
579:
580:   const completeness: AssemblyCompleteness = {
581:     seedTruncated: seedCollection.truncated,
582:     traversalTruncated,
583:     candidateTruncated: selectedNonPinned.length < nonPinned.length || frameSizeExceeded,
584:     evidenceTruncated: candidates.some(
585:       (candidate) =>
586:         candidate.omitted.relations > 0 ||
587:         candidate.omitted.events > 0 ||
588:         candidate.omitted.annotations > 0,
589:     ),
590:     frameSizeExceeded,

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/context/src/assembly.ts` around lines 558-590, `frameSizeExceeded` becomes true only after a soft candidate is removed. If all remaining candidates are pinned, `dropIndex < 0` breaks the loop while leaving the flag false. The size calculation also counts JavaScript code units rather than UTF-8 bytes. One explicitly pinned candidate with a 300,000-character attribute exceeds the default 262,144 budget, remains fully included, and reports frameSizeExceeded=false. This can send an oversized request without the promised explicit failure signal. Calculate whether the final complete serialized request exceeds the budget independently of whether anything was dropped. Preserve pins but return an explicit unusable/needs-expansion outcome. Measure the documented byte unit. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

255:   recordEvent(input: Omit<TemporalEventRecord, "id">): EventRecordId {
256:     const id = `event:${++this.counters.event}`;
257:     const record = snapshot({ ...input, id } as TemporalEventRecord);
258:     this.eventRecords.set(id, record);
259:     for (const ref of record.refs) this.push(this.eventsByRef, entityRefKey(ref), id);
260:     this.bump();
261:     return id;
262:   }
263: 

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/context/src/store.ts` around lines 255-263, Knowledge generations advance on observation and relation changes, but `recordEvent()` only appends and bumps the store version. Existing beliefs depending on a subject generation remain active. The test creates a belief from current knowledge and then records a new obligation-opened event for the same entity. The belief remains valid. This directly affects questions such as 'which one needs me?' where obligations are material evidence. Declare and advance event/obligation read generations, or a broader subject generation where appropriate. Test event additions, resolutions, removals and temporal expiry against dependent beliefs. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

278:   addAnnotation(input: Omit<SemanticAnnotation, "id">): AnnotationId {
279:     const id = `annotation:${++this.counters.annotation}`;
280:     const record = snapshot({ ...input, id } as SemanticAnnotation);
281:     this.annotationRecords.set(id, record);
282:     for (const ref of record.refs) this.push(this.annotationsByRef, entityRefKey(ref), id);
283:     const generations = record.refs.map((ref) => this.currentGeneration(ref));
284:     this.linkDependencies(id, [...record.dependsOn, ...generations]);
285:     // A result published after its evidence changed is stale on arrival; keep
286:     // it as history but never let it masquerade as current.
287:     if (!this.dependenciesFresh(record.dependsOn)) {
288:       this.annotationRecords.set(id, snapshot({ ...record, invalidatedAt: record.createdAt }));
289:     }
290:     this.bump();

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/context/src/store.ts` around lines 278-290, Annotations implicitly depend on each subject's current generation at insertion time, not the generation read during inference. Only explicit dependsOn values are checked for staleness. The helper does not derive the read generations from the recorded context frame. The test assembles a frame, adds a new blockedBy relation while its interpretation is outstanding, then inserts an annotation depending on the unchanged observation. It remains active because the new generation is attached after the change. Capturing the old generation explicitly can avoid this, but the default claimed guarantee does not. Capture generations in the interpretation's read set and require them when publishing a belief. Validate those captured values atomically; do not infer freshness from the publication-time generation. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

185:
186: export function createRuntime(deps: RuntimeDeps): SemanticRuntime {
187:   const clock = deps.clock ?? (() => new Date().toISOString());
188:   const state: MutableState = {
189:     interactionId: "interaction:1",
190:     scopes: new Map(),
191:     scopeStack: [],

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 185-191, `nextEffectId()` includes `state.interactionId`, but every runtime initializes that value to the literal `interaction:1`. There is no RuntimeDeps option to assign a distinct interaction identity. Two independently created runtimes both send `effect:interaction:1:1` as their first idempotency key. A shared idempotent executor can suppress legitimate work or return another operation's result. Restart also resets the counters. Require an injected, stable interaction identity and persist operation identity allocation. Test two concurrent interactions against the same executor and recovery against an existing journal. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

289:   function makeSlotBinding(
290:     slot: string,
291:     refs: EntityRef[],
292:     references: ResolvedReference[],
293:     now: string,
294:     expectations?: FrozenPrecondition[],
295:     origins?: SlotBinding["origins"],
296:   ): SlotBinding {
297:     let frozen: FrozenPrecondition[];
298:     if (expectations && expectations.length > 0) {
299:       frozen = expectations.map((precondition) => ({ ...precondition }));
300:     } else {
301:       const observed = latestSnapshots(refs);
302:       frozen = [];
303:       for (const ref of refs) {
304:         const snapshot = observed.get(entityRefKey(ref));
305:         if (snapshot && snapshot.version.authority === ref.authority) {
306:           frozen.push({ ref, token: snapshot.version });
307:         }
308:       }
309:     }

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 289-309, `makeSlotBinding()` copies arrays and precondition wrappers but shares nested refs and tokens with the caller. Arguments and other proposal fields also receive only shallow copies. The test starts validation of A, changes `command.slots[0].refs[0].id` to B, then releases validation. The adapter recorded A as the checked target, but the executor receives B. Returning a detached `state()` snapshot does not protect this input boundary. Snapshot and validate the entire incoming command before storing it or awaiting anything. Freeze immutable intent/effect inputs and avoid sharing mutable nested objects with caller or adapter code. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

480:   async function commit(ctx: TurnCtx, tx: Transaction): Promise<void> {
481:     const intent = state.intents.get(tx.intentId);
482:     if (!intent) return;
483:     if (isTerminal(tx)) return;
484:     // A commit for this revision is already in flight: a duplicate
485:     // confirmation must not start a second authority validation.
486:     if (tx.pendingCommitRevision !== undefined) return;

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 480-486, `commit()` rejects terminal states and an active validation, but allows COMMITTED and DISPATCHED transactions. The pending revision flag is cleared before invocation completes, and existing frozen effects are not checked. After an executor returns RUNNING, a typed confirmation with a new command ID for the same transaction and revision validates, freezes and invokes again. The reproduction records two invokes for one intent revision. Restrict confirmation to explicitly committable states and atomically associate one frozen effect set with an intent revision. Repeated confirmation of that revision must never create another set. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

801:       // Evidence the interpretation declared wins over a kernel snapshot: if
802:       // expected versions were supplied but do not cover a ref, that ref has
803:       // incomplete evidence and commit will refuse it.
804:       const declaredEvidence =
805:         proposed.expectations && proposed.expectations.length > 0
806:           ? proposed.expectations
807:           : command.expectedVersions && command.expectedVersions.length > 0
808:             ? command.expectedVersions.filter((precondition) =>
809:                 proposed.refs.some((ref) => entityRefKey(ref) === entityRefKey(precondition.ref)),
810:               )
811:             : undefined;
812:       return makeSlotBinding(
813:         proposed.slot,
814:         proposed.refs,
815:         references,
816:         ctx.now,
817:         declaredEvidence,
818:         proposed.origins,
819:       );
820:     });

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 801-820, `applyProposal()` filters supplied expectedVersions for each slot, then passes an empty array to `makeSlotBinding()`. That helper treats an empty array as absent and fills in versions from current kernel views. This contradicts the comment saying incomplete declared evidence will be rejected. The test supplies evidence for an unrelated ref while A exists in a version-2 view. Instead of rejecting missing evidence for A, the kernel validates A at version 2 and invokes. Distinguish absent evidence from explicitly supplied empty or non-covering evidence. Never fill holes in a supplied read set with current snapshots; reject incomplete coverage. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

861:   async function applyRevision(ctx: TurnCtx, command: ReviseCommand): Promise<void> {
862:     const tx = transactionById(command.transactionId) ?? liveTransaction();
863:     if (!tx) {
864:       ctx.errors.push("STALE_INTENT");
865:       ctx.reply = "none";
866:       return;
867:     }
868:     if (tx.effects.length > 0) {
869:       // frozen effects are immutable; a revision after dispatch is a new intent
870:       ctx.errors.push("STALE_INTENT");
871:       ctx.reply = "none";
872:       return;
873:     }
874:     const intent = state.intents.get(tx.intentId);
875:     if (!intent) {
876:       ctx.errors.push("STALE_INTENT");
877:       ctx.reply = "none";
878:       return;
879:     }
880:     if (intent.revision !== command.expectedIntentRevision) {
881:       ctx.errors.push("STALE_INTENT");
882:       ctx.reply = "none";
883:       return;
884:     }
885:     const descriptor = descriptorFor(intent.capability);
886:     if (!descriptor) {
887:       ctx.errors.push("UNSUPPORTED_CAPABILITY");
888:       ctx.reply = "question";

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 861-888, `applyRevision()` rejects transactions with effects but never rejects a terminal transaction addressed by ID. Cancellation before dispatch leaves no effects, so the revision is accepted and replaces CANCELLED with a new gate state. The test cancels a transaction, revises its unchanged revision by explicit ID, then confirms revision 2. The cancelled action executes. This violates the transaction lifecycle even without concurrency. Validate the transition state before applying a revision. Terminal transactions stay terminal; further work must create an explicit new intent. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

890:     }
891:     const declared = new Map(descriptor.slots.map((slot) => [slot.name, slot]));
892:     for (const proposed of command.slots) {
893:       if (!declared.has(proposed.slot)) {
894:         ctx.errors.push("INVALID_SLOT");
895:         ctx.reply = "question";
896:         return;
897:       }
898:     }
899:     const replaced = new Set(command.slots.map((slot) => slot.slot));
900:     const bindings = [
901:       ...intent.bindings.filter((binding) => !replaced.has(binding.slot)),
902:       ...command.slots.map((proposed) =>
903:         makeSlotBinding(proposed.slot, proposed.refs, [], ctx.now, proposed.expectations, proposed.origins),
904:       ),
905:     ];
906:     const updated: Intent = {
907:       ...intent,
908:       revision: intent.revision + 1,

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 890-908, `applyProposal()` checks arity-one slots, but `applyRevision()` checks only that slot names exist. `missingRequired()` and commit do not enforce arity later. The test creates a one-target intent, revises the targets slot to contain A and B, then confirms. Both targets reach execution despite the descriptor allowing one. Use a shared intent/binding validator on proposal, revision and precommit. Validate arity, duplicate slot names, required values and supported argument schemas consistently. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

1053:   function proposalFromFrame(
1054:     classification: ClassificationResult,
1055:     observation: Observation,
1056:   ): AdaptedClassification | undefined {
1057:     const frame = classification.frame as SemanticFrame;
1058:     if (typeof frame.capability !== "string" || frame.capability.length === 0) return undefined;
1059:     const descriptor = descriptorFor(frame.capability);
1060:     const slot = descriptor ? targetSlotFor(descriptor) : "targets";
1061:     let slots = parseProposedSlots(frame.slots);
1062:     if (!slots) {
1063:       slots = [];
1064:     }
1065:     if (slots.length === 0) {
1066:       const refs = targetRefsFrom(classification.references);
1067:       if (refs.length > 0) slots = [{ slot, refs }];
1068:     }
1069:     const expectedVersions = parseExpectedVersions(frame.expectedVersions);
1070:     const command: ProposeCommand = {
1071:       kind: "propose",
1072:       commandId: observation.id,
1073:       observationId: observation.id,
1074:       capability: frame.capability,
1075:       slots,
1076:       ...(isRecord(frame.arguments) ? { arguments: { ...frame.arguments } } : {}),
1077:       ...(Array.isArray(frame.decisions)
1078:         ? { decisions: frame.decisions.filter((decision): decision is string => typeof decision === "string") }
1079:         : {}),
1080:       ...(expectedVersions ? { expectedVersions } : {}),
1081:       ...(typeof frame.expectedIntentRevision === "number"
1082:         ? { expectedIntentRevision: frame.expectedIntentRevision }
1083:         : {}),
1084:       provenance: classification.provenance,
1085:     };
1086:     return {
1087:       command,
1088:       ...(classification.ambiguous ? { pendingCapability: frame.capability } : {}),
1089:     };

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 1053-1089, `proposalFromFrame()` returns a proposal even when `classification.ambiguous` is true. It adds pendingCapability as extra metadata, but request handling executes the proposal first. This path bypasses the accepted-decision guard in the separate proposition helper. The test supplies an ambiguous classification with capability, slots and complete version evidence. `ingest()` invokes the executor. This reproduces an actual effect path, not merely an ambiguous answer being exposed to a later stage. Reject ambiguous classifications before building or applying executable commands. Prefer one validated semantic-command path so frame-based ingestion cannot bypass the acceptance rules. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

1478:   async function command(command: KernelCommand): Promise<TurnResult> {
1479:     const cached = state.commandResults.get(command.commandId);
1480:     if (cached) return structuredClone(cached);
1481:     const ctx = newCtx(clock(), command.commandId, command.commandId);
1482:     pruneScopes(ctx.now);
1483:     switch (command.kind) {
1484:       case "propose": {

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 1478-1484, `command()` checks only completed `commandResults`; it does not reserve an in-flight command ID. Two deliveries of the same proposal each create a transaction before either finishes. The per-transaction commit flag cannot deduplicate them. The required-behavior test submits the same command twice while validation is deferred. Both validations complete and two invokes occur. Sequential duplicate delivery is fixed, but concurrent delivery remains unsafe. Reserve a command identity before the first await and share its in-flight result. Check that repeats have identical content; clear or record failures under a defined retry policy. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

1491:       }
1492:       case "confirm": {
1493:         const tx = transactionById(command.transactionId) ?? gateTransaction() ?? liveTransaction();
1494:         if (!tx) {
1495:           ctx.reply = "none";
1496:           break;
1497:         }
1498:         const intent = state.intents.get(tx.intentId);

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 1491-1498, `transactionById(command.transactionId) ?? gateTransaction() ?? liveTransaction()` treats an explicit but missing ID as if no ID was supplied. Revision, cancellation and resumption have similar fallback behavior. The reproduction creates one pending transaction, then confirms `tx:missing`. The existing transaction executes. A stale or mistyped reference therefore authorizes different work, contrary to the no-substitution rule. Use fallback selection only when the command omits transactionId. Reject any explicit ID that is missing, and apply the same rule consistently to confirm, revise, cancel and resume. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

331:       state.answers.set(spec.id, answer);
332:       if (outcome.bindingAction === "auto-bind") state.accepted.set(spec.id, answer);
333:       state.outcomes.set(spec.id, outcome);
334:       state.traces.push(trace);
335:       answers.push(answer);

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/perception/src/orchestrator.ts` around lines 331-335, Spec IDs are checked for duplicates only inside each stage. If a later stage reuses an ID, raw answers and outcomes are replaced, but accepted is updated only for auto-bind and never cleared when the new answer is rejected. The test asks spec x twice. The first result is accepted at .99; the second requires clarification at .55. `choiceOf(state, 'x')` still returns the first accepted answer. The aggregate run stays AMBIGUOUS, but accepted-value access and further dependencies contradict the latest outcome. Either reject reused spec IDs across the workflow or define explicit attempts and clear/recompute accepted values and dependent decisions when an attempt changes the outcome. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

14:   if (turn.status !== "RESOLVED") return undefined;
15:   if (!proposition.capability) return undefined;
16:   if (!proposition.decisions.every((decision) => options.acceptedDecisions.has(decision))) {
17:     return undefined;
18:   }
19:   if (proposition.polarity === "exclude") return undefined;
20:   const slots =
21:     proposition.slots && proposition.slots.length > 0
22:       ? proposition.slots.map((slot) => ({ slot: slot.slot, refs: [...slot.refs] }))
23:       : [{ slot: "targets", refs: [...proposition.refs] }];
24:   return {
25:     kind: "propose",

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/perception/src/proposals.ts` around lines 14-25, The new consumer only checks turn status, a capability, accepted decision IDs and include polarity. It ignores proposition.act, operation and relations, and always returns kind `propose`. Empty decision lists also pass its `every()` check. A query/inspect proposition naming `task.resume` returns an executable proposal in the required-behavior test. The helper cannot distinguish asking about an operation from requesting it. Exclusion/dependency relationships between propositions are likewise not compiled. Validate allowed act/operation combinations and compile the turn as a whole, preserving prohibitions and dependencies. Emit no executable command for unsupported or incomplete semantic structures. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

19:   if (proposition.polarity === "exclude") return undefined;
20:   const slots =
21:     proposition.slots && proposition.slots.length > 0
22:       ? proposition.slots.map((slot) => ({ slot: slot.slot, refs: [...slot.refs] }))
23:       : [{ slot: "targets", refs: [...proposition.refs] }];
24:   return {
25:     kind: "propose",
26:     commandId: options.commandId,
27:     capability: proposition.capability,
28:     slots,
29:     ...(proposition.arguments ? { arguments: proposition.arguments } : {}),
30:     ...(proposition.constraints ? { constraints: proposition.constraints } : {}),
31:     ...(proposition.targetIntentRevision !== undefined
32:       ? { expectedIntentRevision: proposition.targetIntentRevision }
33:       : {}),
34:     decisions: [...proposition.decisions],

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/perception/src/proposals.ts` around lines 19-34, `propositionCommand()` accepts a frame ID and decision ID set but receives no frame/read set and emits no expectedVersions. SemanticProposition has no observation-version field. Neither acceptance nor dependency freshness is checked against the store here. The test interprets A from a version-1 ContextFrame, updates the kernel view to version 2, then builds a command with this helper. The kernel silently binds and validates version 2. It never tests the version that supported the model's judgment. Build proposals from an accepted interpretation plus its immutable frame/read set. Carry exact observation versions and captured knowledge generations; reject stale support rather than reinterpreting it as current. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

1004:     const event = observation.event;
1005:     if (event.view) state.views.set(event.view.id, event.view);
1006:     if (event.refs && event.refs.length > 0) {
1007:       if (event.action === "select" || event.action === "focus") {
1008:         const scope: Scope = {
1009:           id: `scope:${String(++state.counters.scope).padStart(2, "0")}`,
1010:           refs: [...event.refs],
1011:           origin: { kind: "focus", refs: [...event.refs] },
1012:           lifetime: { kind: "until-replaced" },
1013:           createdAt: ctx.now,
1014:         };
1015:         state.scopes.set(scope.id, scope);
1016:         state.scopeStack.push(scope.id);
1017:         state.retainedScopes.unshift(scope.id);
1018:         state.retainedScopes = state.retainedScopes.slice(0, 8);
1019:         const kind: Referent["kind"] = event.refs.length > 1 ? "plural" : "singular";
1020:         const referent: Referent = {
1021:           id: `referent:${++state.counters.referent}`,
1022:           role: kind === "singular" ? "current" : "set",
1023:           kind,
1024:           refs: [...event.refs],
1025:           scopeId: scope.id,
1026:           provenance: { rule: "ui.selection.v1", inputs: [], conclusion: event.refs.map(entityRefKey).join(","), confidence: 1, at: ctx.now },
1027:           createdAt: ctx.now,
1028:           updatedAt: ctx.now,
1029:         };
1030:         state.referents.set(referent.id, referent);
1031:         state.recentReferentIds.unshift(referent.id);
1032:         if (kind === "singular") state.currentReferentId = referent.id;
1033:         ctx.reply = "ack";
1034:         return;
1035:       }
1036:       if (event.action === "clear-selection") {
1037:         state.currentReferentId = undefined;
1038:         ctx.reply = "ack";
1039:         return;
1040:       }
1041:     }

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 1004-1041, `clear-selection` handling is nested inside `if (event.refs && event.refs.length > 0)`. A clear event naturally needs no refs, so it bypasses that branch. The test selects A and then sends `{ action: 'clear-selection' }`. currentReferentId still points at A. Subsequent deictic interpretation can continue using a selection the user cleared. Handle clear-selection independently of supplied refs, and explicitly define which focus, scope and referent records should be cleared. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.

1478:   async function command(command: KernelCommand): Promise<TurnResult> {
1479:     const cached = state.commandResults.get(command.commandId);
1480:     if (cached) return structuredClone(cached);
1481:     const ctx = newCtx(clock(), command.commandId, command.commandId);
1482:     pruneScopes(ctx.now);
1483:     switch (command.kind) {
1484:       case "propose": {
1485:         await applyProposal(ctx, command, []);
1486:         break;
1487:       }
1488:       case "revise": {

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/core/src/runtime.ts` around lines 1478-1488, `command()` does not append the command. InteractionLogEntry has no typed-command record, and intent-revised stores only an ID and revision. The runtime neither reads an existing journal nor reconstructs commandResults. A persistent append implementation alone cannot add those missing semantics. After a typed proposal with commandId unique-command-123 completes, that command ID appears nowhere in the journal. The test fails even before attempting restart. Deferring a disk-backed implementation is reasonable; this is a separate missing recovery contract. Record the full accepted command and identity, reconstructible intent/transaction transitions, and command results or sufficient replay events. Add a recovery entry point and crash-boundary tests before claiming durability. Use the corresponding desired-behavior reproduction in `/tmp/circe-safety-pass-review/required.test.ts`, then retain it in the appropriate repository suite and run typecheck and the full baseline. Preserve the typed kernel boundary and do not add English routing rules.