diff --git a/src/execution-world/candidate.ts b/src/execution-world/candidate.ts
index f9fd215..924fd73 100644
--- a/src/execution-world/candidate.ts
+++ b/src/execution-world/candidate.ts
@@ -130,7 +130,7 @@ export async function loadCheckedInstallationCandidate(
     const expectedGraph = graphExecutionRepresentation(plan, installation, kernel, queries);
     // The stored graph embeds the same kernel/query programs. Validate it in a
     // short-lived scope and retain the representation that shares those trees.
-    await (async () => {
+    const graphDigest = await (async () => {
       const input = await readJson(root, "graph-execution.json", scope);
       try {
         const digest = await hexDigestAsync(input.value);
@@ -140,6 +140,7 @@ export async function loadCheckedInstallationCandidate(
             root,
             "Stored graph execution differs from checked inputs",
           );
+        return digest;
       } finally {
         input.releaseTree();
       }
@@ -168,7 +169,8 @@ export async function loadCheckedInstallationCandidate(
     return {
       reference,
       workspace: plan.definition.workspace.workspaceId,
-      world: await hexDigestAsync(expectedGraph),
+      // The checked representation was already compared with this digest.
+      world: graphDigest,
       plan: kernel.plan as string,
       graphExecution: expectedGraph,
       provenance,
diff --git a/test/candidate-metadata.test.ts b/test/candidate-metadata.test.ts
index 6039c47..112123c 100644
--- a/test/candidate-metadata.test.ts
+++ b/test/candidate-metadata.test.ts
@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { CandidateMetadataBudget, readCandidateMetadata } from "../src/execution-world/metadata.js";
 import { loadCheckedInstallationCandidate } from "../src/execution-world/candidate.js";
+import { hexDigestAsync } from "../src/execution-world/plan.js";
 
 test(
   "a real checked application can stage its replacement within the default metadata budget",
@@ -21,6 +22,8 @@ test(
       try {
         assert.equal(budget.snapshot().bytes, retained * 2);
         assert.deepEqual(second.reference, first.reference, "Compaction preserves exact checked identity");
+        assert.equal(first.world, await hexDigestAsync(first.graphExecution));
+        assert.equal(second.world, first.world, "Replacement retains the checked execution identity");
         assert.equal(second.graphExecution.kernel, second.kernel, "Graph representation shares the validated program");
         assert.equal(second.graphExecution.queries, second.queries);
         // A deliberately tighter pool admits the serving installation but must