Clarify inspected input identifier disclosure

docs/roadmap/remediation.md

@@ -89,6 +89,11 @@ visit counts or a wall-clock threshold a public guarantee.
 
 ### Finding 3 — Qualify The Public Variable-Disclosure Statement (P3)
 
+**Status: Resolved.** Request and method GoDoc now expressly distinguish caller
+values from intentionally reported resolved input identifiers. Existing direct
+name and privacy coverage passed in the assembled verification; no runtime
+behavior or confidentiality mechanism changed.
+
 Location: [public request GoDoc](../../requirements.go), `Vars` (lines 22–24).
 
 The comment says that supplied values are not returned in inspection.

requirements.go

@@ -21,7 +21,8 @@ type RequirementInspectionRequest struct {
 	ProfileID string
 	// Vars supplies string values for caller-variable lookups and simple
 	// conditions. Presence is determined by exact map key, including an empty
-	// value; values are not returned in the inspection.
+	// value. Inspection reports caller keys and presence, not their values.
+	// A supplied value may nevertheless appear as a resolved input identifier.
 	Vars map[string]string
 	// SessionID, when nonblank after the normal session-ID normalization,
 	// bypasses the prompt's session template during discovery.
@@ -164,6 +165,10 @@ type RequirementInspection struct {
 // a useful partial result with Complete false. The returned inventories do
 // not reject otherwise valid templates or prohibit their use.
 //
+// Results exclude artifact payloads, prompt contents, and unrelated supplied
+// values. Resolved input identifiers may equal the caller values that supply
+// them; those identifiers are intentionally included in the inventory.
+//
 // This method does not perform artifact, schema, credential, rendering,
 // validation, capacity, observation, provider, or execution work. Complete
 // describes dependency discovery, not whether every dependency is supplied or