Schema-valid tool calls need semantic-role containment, while explicit-end guards can safely contain false positives

A schema-valid model decision can still be unsafe when argument roles are semantically wrong. Runtime containment should be tested per action family: a narrow explicit-ending guard can reject courtesy-only end proposals, but lexical/current-turn checks may still admit a state as a city or an abandoned reference fragment as a plausible identifier. Evaluate both the model proposal and the executed handler outcome; do not treat exact-match failure, schema validity, or handler acceptance as interchangeable.

Limits: this is a bounded offline finding. Constructed state and stubbed business boundaries establish handler behavior, not production prevalence or realized customer harm. Semantic-role validation may belong in supervision, schemas, or handlers; the evidence does not choose the implementation layer.

Evidence/example — 2026-09-12: deterministic retained-handler replays showed courtesy-driven termination rejected without an end frame, while malformed lane and plausible wrong-reference arguments reached lookup stubs. A separate TRAIN/DEV audit found explicit-ending coverage exists in a held-out behavior supplement but not in the primary selected TRAIN corpus, and proposed state/incomplete-location supervision failed two-review agreement. Source provenance: local frozen evaluation and handler-replay receipts; no live customer or backend calls.