@agenticprimitives/orchestration 0.0.0-alpha.26 → 0.0.0-alpha.28

package/dist/loop.js

@@ -14,9 +14,15 @@
 //
 // A step with no capability skips the path and still emits a receipt: the trace is the product, and
 // "nothing was verified" is itself a fact worth recording.
-import { compactObservations } from './artifacts.js';
+import { canonicalJson, compactObservations } from './artifacts.js';
+import { VALUE_DIGEST_SCHEME, isValueDigest, sameValue, valueDigest } from './digest.js';
 import { planDigest } from './plan-digest.js';
-import { CONTINUE_STEP_ID, OrchestrationError } from './types.js';
+import { CONTINUE_STEP_ID, OrchestrationError, isEvaluationIntent } from './types.js';
+import { frameUntrusted } from './planner.js';
+import { statedOutcomeOf } from './conformance.js';
+/** The stated-outcome rule's codes — the only violations the point-of-use re-judgment acts on (other admission rules
+ *  read the plan as the planner WORDED it and are not re-run against resolved values). */
+const POINT_OF_USE_CODES = new Set(['OUTCOME_NOT_ENTAILED', 'OUTCOME_BOUND_EXCEEDED', 'OUTCOME_BOUND_UNREAD', 'OUTCOME_BOUND_PENDING', 'OUTCOME_DISCLOSURE']);
 import { isToolInvocationResult } from './tool-invoker.js';
 import { inputsFor, isInputRequired, receiptPending } from './input.js';
 import { deriveArgs } from './derivation.js';
@@ -24,7 +30,8 @@ import { deriveArgs } from './derivation.js';
  *  dots is a plain top-level lookup. A missing segment short-circuits to `undefined` (the tool then validates
  *  its own args — fail-closed, no path traversal / eval). */
 function getPath(root, path) {
-    return path.split('.').reduce((acc, seg) => (acc == null ? undefined : acc[seg]), root);
+    // OWN properties only (07 §6 lead 5 / RUNC-14): `x.constructor`, `x.__proto__`, `x.toString` are not results a step returned.
+    return path.split('.').reduce((acc, seg) => (acc == null || !Object.prototype.hasOwnProperty.call(Object(acc), seg) ? undefined : acc[seg]), root);
 }
 /** Recursively resolve `{ $ref: 'name.path' }` placeholders (anywhere — nested objects/arrays included)
  *  against prior step results. Non-placeholder values pass through unchanged. */
@@ -115,8 +122,6 @@ function resolveStep(runRef, index, step, tool, args) {
 /** Spec 413 — the stepRef of the declared pre-plan retrieval step. */
 export const RETRIEVAL_STEP_REF = 'retrieve';
 const randomRef = () => `run-${Math.random().toString(36).slice(2, 10)}${Date.now().toString(36)}`;
-/** A stable digest is the sink's job (it has the hashing deps); here we record a cheap structural fingerprint
- *  so two receipts for the same input compare equal. Never treated as a cryptographic commitment. */
 /**
  * Spec 410 §2 — READ WHAT THE ADAPTER SAW, and bound it by what the tool can establish. A result contract is
  * taken at its word within that bound; a raw value is `attempted` for an act (the adapter showed nothing but
@@ -144,20 +149,12 @@ function observeInvocation(resolved, tool, now) {
     }
     return { output: resolved.output, observation: { ...o, outcome, evidence } };
 }
-function fingerprint(v) {
-    try {
-        return `json:${JSON.stringify(v, (_k, x) => (typeof x === 'bigint' ? x.toString() : x))}`.slice(0, 2048);
-    }
-    catch {
-        return 'json:<unserializable>';
-    }
-}
 /** Does a declared branch hold against the results so far? Absent/empty is false for `exists`; `equals`
- *  compares by fingerprint (the same JSON is the same value). */
+ *  compares the FULL canonical JSON (the same JSON is the same value) — never a prefix (RUN-8). */
 function holds(when, refs) {
     const v = getPath(refs, when.ref);
     if (when.equals !== undefined)
-        return fingerprint(v) === fingerprint(when.equals);
+        return sameValue(v, when.equals);
     if (when.exists === false)
         return v === undefined || v === null || (Array.isArray(v) && v.length === 0);
     return !(v === undefined || v === null || (Array.isArray(v) && v.length === 0));
@@ -233,6 +230,11 @@ function independentBatch(plan, i, toolsById, completed) {
  */
 /** The planner's own words for a step's arguments (before resolution turned "nathan.me" into an address). */
 const rawArgsOf = (rs) => rs.step.args ?? rs.args;
+/** Spec 445 decision 8 — the digest an outbound confirmation is bound to: the tool and EXACTLY the arguments it would
+ *  send (`sha256-jcs-v1`). A `yes` to one disclosure is not a `yes` to another. */
+export async function outboundDigest(toolId, sends) {
+    return valueDigest({ toolId, sends });
+}
 export async function runIntent(intent, opts) {
     // THE STEP BUDGET bounds what a PLANNER may keep proposing (a re-plan loop that never ends), not what a
     // declared fan-out enumerates: that is capped by the ontology's binding (spec 358 W4 `maxItems`) at the
@@ -251,6 +253,8 @@ export async function runIntent(intent, opts) {
     const plannerTools = opts.continuation && opts.continuation.max > 0 ? [...opts.tools, CONTINUE_TOOL] : opts.tools;
     const toolsById = new Map(plannerTools.map((t) => [t.id, t]));
     const toolIds = new Set(toolsById.keys());
+    /** The tools the AGENT exposes (never the reserved continuation step) — what a compensation may name (RUN-7). */
+    const exposedById = new Map(opts.tools.map((t) => [t.id, t]));
     const allObservations = [];
     const receipts = [];
     /** Executed steps whose tool declares a compensation, newest first — unwound on failure. */
@@ -282,18 +286,19 @@ export async function runIntent(intent, opts) {
         if (ports.receiptSink)
             await ports.receiptSink.record(r);
     };
-    const base = (rs, startedAt) => ({
+    // RUN-8 (spec 445) — the digests are SHA-256 over the full canonical value (`digest.ts`), so `base` awaits.
+    const base = async (rs, startedAt) => ({
         runRef, stepRef: rs.stepRef, index: rs.index, toolId: rs.tool.id, risk: rs.risk, startedAt,
         ...(rs.risk !== 'informational' ? { capability: rs.capability } : {}),
         ...(rs.idempotencyKey ? { idempotencyKey: rs.idempotencyKey } : {}),
-        inputDigest: fingerprint(rs.args),
+        inputDigest: await valueDigest(rs.args),
         // What was PLANNED for this step (resolved against earlier results only) — what a resume's replay can reproduce.
-        ...(() => { try {
-            return { planArgsDigest: fingerprint(resolveArgs(rs.step.args, refs)) };
+        ...(await (async () => { try {
+            return { planArgsDigest: await valueDigest(resolveArgs(rs.step.args, refs)) };
         }
         catch {
             return {};
-        } })(),
+        } })()),
         // Spec 421 W2 — whose words each argument of an ACT came from (raw planner values against her goal and what was read).
         ...(rs.risk !== 'informational' ? (() => { const d = deriveArgs(rawArgsOf(rs), intent.goal, allObservations); return Object.keys(d).length ? { derivation: d } : {}; })() : {}),
         // Spec 367 §5 — the binding the step was admitted under, pinned by the harness that knows the
@@ -325,7 +330,7 @@ export async function runIntent(intent, opts) {
             // 401, not 403. Nothing was verified and nothing ran; the receipt records that the plan reached a
             // step it had no authority for, and the caller is told WHICH step so it can go and get one.
             emit({ type: 'RunSuspended', runRef, stepRef: rs.stepRef, resumeToken: rs.stepRef });
-            await record({ ...base(rs, startedAt), status: 'authority-required', completedAt: now() });
+            await record({ ...(await base(rs, startedAt)), status: 'authority-required', completedAt: now() });
             return {
                 outcome: 'authority-required', plan, steps: allObservations, receipts, runRef,
                 required: { stepRef: rs.stepRef, toolId: rs.tool.id, capability: rs.capability, risk: rs.risk, args: rs.args, ...(() => { const d = deriveArgs(rawArgsOf(rs), intent.goal, allObservations); return Object.keys(d).length ? { derivation: d } : {}; })(), ...(rs.tool.carries ? { carries: rs.tool.carries } : {}) },
@@ -336,7 +341,7 @@ export async function runIntent(intent, opts) {
         emit({ type: 'MandateChecked', runRef, stepRef: rs.stepRef, decision: decision.decision, afterApproval: false });
         if (decision.decision === 'deny') {
             emit({ type: 'MandateDenied', runRef, stepRef: rs.stepRef, reasons: decision.reasons });
-            await record({ ...base(rs, startedAt), status: 'denied', authority: { presentedRef: presented.ref, decision, afterApproval: false }, completedAt: now(), error: decision.reasons.map((r) => `${r.code}: ${r.message}`).join('; ') });
+            await record({ ...(await base(rs, startedAt)), status: 'denied', authority: { presentedRef: presented.ref, decision, afterApproval: false }, completedAt: now(), error: decision.reasons.map((r) => `${r.code}: ${r.message}`).join('; ') });
             return { outcome: 'denied', plan, steps: allObservations, receipts, runRef, error: decision.reasons.map((r) => `${r.code}: ${r.message}`).join('; ') };
         }
         // Obligations: the verifier's, plus whatever policy adds for this risk class. Never fewer.
@@ -355,7 +360,7 @@ export async function runIntent(intent, opts) {
                 emit({ type: 'RunSuspended', runRef, stepRef: rs.stepRef, resumeToken: outcome.resumeToken });
                 const prompt = outcome.prompt ? { ...outcome.prompt, stepRef: rs.stepRef, toolId: rs.tool.id } : undefined;
                 await record({
-                    ...base(rs, startedAt), status: 'suspended',
+                    ...(await base(rs, startedAt)), status: 'suspended',
                     authority: { presentedRef: presented.ref, decision, afterApproval: false },
                     ...(prompt ? { pendingInput: receiptPending(prompt) } : {}),
                     completedAt: now(),
@@ -365,7 +370,7 @@ export async function runIntent(intent, opts) {
             if (outcome.status === 'refused') {
                 emit({ type: 'ApprovalRefused', runRef, stepRef: rs.stepRef, ...(outcome.reason ? { reason: outcome.reason } : {}) });
                 const error = `approval refused${outcome.by ? ` by ${outcome.by}` : ''}${outcome.reason ? `: ${outcome.reason}` : ''}`;
-                await record({ ...base(rs, startedAt), status: 'denied', authority: { presentedRef: presented.ref, decision, afterApproval: false }, completedAt: now(), error });
+                await record({ ...(await base(rs, startedAt)), status: 'denied', authority: { presentedRef: presented.ref, decision, afterApproval: false }, completedAt: now(), error });
                 return { outcome: 'denied', plan, steps: allObservations, receipts, runRef, error };
             }
             approvalRecords = outcome.records;
@@ -378,44 +383,91 @@ export async function runIntent(intent, opts) {
                 const reasons = decision.decision === 'deny' ? decision.reasons : [{ code: 'still-obligated', message: 'obligations remain after approval' }];
                 emit({ type: 'MandateDenied', runRef, stepRef: rs.stepRef, reasons });
                 const error = reasons.map((r) => `${r.code}: ${r.message}`).join('; ');
-                await record({ ...base(rs, startedAt), status: 'denied', authority: { presentedRef: presented.ref, decision, afterApproval: true }, approvalRecords, completedAt: now(), error });
+                await record({ ...(await base(rs, startedAt)), status: 'denied', authority: { presentedRef: presented.ref, decision, afterApproval: true }, approvalRecords, completedAt: now(), error });
                 return { outcome: 'denied', plan, steps: allObservations, receipts, runRef, error };
             }
         }
         return { decision, approvalRecords, used: presented };
     }
-    /** Unwind executed steps that declared compensation, newest first. Best effort: a compensation that
-     *  fails is recorded, not retried — the receipt is the honest record. Compensations are AUTHORIZED
-     *  like any other capability step; a denied compensation is recorded as such. */
+    /**
+     * Unwind executed steps that declared compensation, newest first. Best effort: a compensation that fails is
+     * recorded, not retried — the receipt is the honest record.
+     *
+     * RUN-7 (spec 445 W0) — A COMPENSATION IS A STEP. It runs only if it is a tool this run EXPOSES, and, when that tool
+     * exercises a capability, only under a verdict: the verifier judged it `allow` against a presented mandate that fits
+     * it, with no obligation outstanding (or it is one of the loop's declared non-mandate paths — self-acting, or judged
+     * at the subject's agent — exactly as in `attempt`). Its arguments come from the original tool's RESULT, so they are
+     * the last thing that may run unjudged. Anything else is NOT RUN: it is recorded on its own receipt and returned as
+     * `compensationsOwed`, naming the step, so the caller can obtain the authority and perform it — owed, never done
+     * unverified, never dropped.
+     */
+    const compensationsOwed = [];
+    const withOwed = (r) => (compensationsOwed.length ? { ...r, compensationsOwed: [...compensationsOwed] } : r);
     async function compensate() {
         for (const { resolved, result } of compensable.reverse()) {
             const comp = resolved.tool.compensation;
-            const compTool = toolsById.get(comp.toolId);
+            const compTool = exposedById.get(comp.toolId);
             const startedAt = now();
-            const args = resolveValue(comp.args, { ...refs, $result: result });
+            const args = (resolveValue(comp.args, { ...refs, $result: result }) ?? {});
             const crs = compTool
                 ? resolveStep(runRef, resolved.index, { toolId: comp.toolId, args, id: `${resolved.stepRef}:compensate` }, compTool, args)
-                : { ...resolved, stepRef: `${resolved.stepRef}:compensate`, tool: { id: comp.toolId, description: '' }, args, risk: 'informational', capability: { id: '', action: '' } };
-            let ok = false;
-            let error;
+                : { ...resolved, stepRef: `${resolved.stepRef}:compensate`, step: { toolId: comp.toolId, args, id: `${resolved.stepRef}:compensate` }, tool: { id: comp.toolId, description: '' }, args, risk: 'informational', capability: { id: '', action: '' } };
+            let authority;
+            const notRun = async (reason, status, detail) => {
+                compensationsOwed.push({ stepRef: crs.stepRef, forStepRef: resolved.stepRef, toolId: comp.toolId, ...(crs.risk !== 'informational' ? { capability: crs.capability } : {}), risk: crs.risk, args, reason, detail });
+                emit({ type: 'StepCompensated', runRef, stepRef: resolved.stepRef, by: comp.toolId, ok: false });
+                await record({ ...(await base(crs, startedAt)), status, ...(authority ? { authority } : {}), completedAt: now(), error: `compensation owed (${reason}): ${detail}` });
+            };
+            if (!compTool) {
+                await notRun('tool-not-exposed', 'failed', `${resolved.tool.id} declares ${comp.toolId} as its compensation, which this run does not expose — refused, not run`);
+                continue;
+            }
             try {
-                const compPresented = presentedFor(crs);
-                if (crs.risk !== 'informational' && ports.mandateVerifier && compPresented) {
-                    const d = await ports.mandateVerifier.verify({ intent, presented: compPresented, step: crs, afterApproval: false, planDigest: currentPlanDigest });
-                    if (d.decision !== 'allow') {
-                        error = `compensation not authorized: ${d.decision}`;
+                if (crs.risk !== 'informational') {
+                    const judgedAt = opts.authorityJudgedElsewhere ? opts.authorityJudgedElsewhere(crs) : null;
+                    if (judgedAt) {
+                        authority = { presentedRef: 'routed', decision: { decision: 'allow', obligations: [], evidence: { mandateRef: `routed:${judgedAt}`, intentDigest: await valueDigest(intent), evaluatedAt: now(), verdicts: [{ enforcer: 'routed', allowed: true, reason: `the compensation's subject is ${judgedAt}; its authority is judged at that agent` }] } }, afterApproval: false };
+                    }
+                    else if (compTool.selfAuthorized) {
+                        if (holdSelfActs) {
+                            await record({ ...(await base(crs, startedAt)), status: 'skipped', completedAt: now(), error: holdReason });
+                            continue;
+                        }
+                        authority = { presentedRef: 'self', decision: { decision: 'allow', obligations: [], evidence: { mandateRef: 'self', intentDigest: await valueDigest(intent), evaluatedAt: now(), verdicts: [{ enforcer: 'self', allowed: true, reason: 'the run\'s own principal owns what this touches; the session is the authority' }] } }, afterApproval: false };
+                    }
+                    else {
+                        if (!ports.mandateVerifier) {
+                            await notRun('no-mandate', 'authority-required', `${comp.toolId} exercises ${crs.capability.id} and no MandateVerifier is configured — nothing could judge it`);
+                            continue;
+                        }
+                        const compPresented = presentedFor(crs);
+                        if (!compPresented) {
+                            await notRun('no-mandate', 'authority-required', `${comp.toolId} exercises ${crs.capability.id} and no presented mandate covers it`);
+                            continue;
+                        }
+                        const req = { intent, presented: compPresented, step: crs, afterApproval: false, planDigest: currentPlanDigest };
+                        const d = await ports.mandateVerifier.verify(req);
+                        emit({ type: 'MandateChecked', runRef, stepRef: crs.stepRef, decision: d.decision, afterApproval: false });
+                        authority = { presentedRef: compPresented.ref, decision: d, afterApproval: false };
+                        if (d.decision === 'deny') {
+                            await notRun('not-authorized', 'denied', d.reasons.map((r) => `${r.code}: ${r.message}`).join('; '));
+                            continue;
+                        }
+                        const extra = ports.policyEvaluator ? (await ports.policyEvaluator.evaluate({ ...req, decision: d })).obligations : [];
+                        if (d.decision !== 'allow' || d.obligations.length + extra.length > 0) {
+                            await notRun('approval-required', 'authority-required', `${comp.toolId} carries obligation(s) that an unwinding run does not discharge — it needs its own approval`);
+                            continue;
+                        }
                     }
                 }
-                if (!error) {
-                    await opts.invoke(comp.toolId, args, { intent, step: crs.step, index: crs.index, ...(crs.idempotencyKey ? { idempotencyKey: crs.idempotencyKey } : {}), operationId: `${crs.idempotencyKey ?? `${runRef}:${crs.stepRef}`}:compensate`, planDigest: currentPlanDigest });
-                    ok = true;
-                }
+                await opts.invoke(comp.toolId, args, { intent, step: crs.step, index: crs.index, ...(crs.idempotencyKey ? { idempotencyKey: crs.idempotencyKey } : {}), operationId: `${crs.idempotencyKey ?? `${runRef}:${crs.stepRef}`}:compensate`, planDigest: currentPlanDigest, untrustedSeen });
             }
             catch (e) {
-                error = e instanceof Error ? e.message : String(e);
+                await notRun('failed', 'failed', e instanceof Error ? e.message : String(e));
+                continue;
             }
-            emit({ type: 'StepCompensated', runRef, stepRef: resolved.stepRef, by: comp.toolId, ok });
-            await record({ ...base(crs, startedAt), status: ok ? 'compensated' : 'failed', completedAt: now(), ...(error ? { error } : {}) });
+            emit({ type: 'StepCompensated', runRef, stepRef: resolved.stepRef, by: comp.toolId, ok: true });
+            await record({ ...(await base(crs, startedAt)), status: 'compensated', ...(authority ? { authority } : {}), completedAt: now() });
         }
         compensable.length = 0;
     }
@@ -428,10 +480,20 @@ export async function runIntent(intent, opts) {
     // placeholder drop, a re-plan): what the verifier compares a plan-bound mandate against. A re-planned run
     // is a different plan and a plan-bound mandate refuses it, which is the point.
     let currentPlanDigest = '';
+    // Spec 445 decision 8 (EVAL-13) — an EVALUATION's intent holds self-acting writes exactly as a comparison's dry run does.
+    const holdSelfActs = opts.dryRunSelfActs === true || isEvaluationIntent(intent);
+    const holdReason = isEvaluationIntent(intent) ? 'held: an evaluation run does not commit a self-acting write' : 'dry run: a comparison run does not commit a self-acting write';
     // Spec 409 §4 — whether any observation so far carried untrusted content (see `InvokeContext.untrustedSeen`).
     let untrustedSeen = false;
     const isUntrusted = (result) => !!result && typeof result === 'object' && (result.untrusted === true || result['x-ap-untrusted'] === true);
     const completedByRef = new Map((opts.resume?.completed ?? []).map((c) => [c.stepRef, c]));
+    // Spec 445 decision 8 — A REPLAYED UNTRUSTED OBSERVATION STILL MARKS THE RUN. The checkpoint carries what this run
+    // read before it parked; a resume is the same run, so what it read then counts from the first step now — not only
+    // once its replay is reached (and whether or not a host relays it on `ctx.untrustedSeen`).
+    if ((opts.resume?.completed ?? []).some((c) => isUntrusted(c.result)))
+        untrustedSeen = true;
+    /** Spec 445 decision 8 — the `ref`s whose results are untrusted, or were threaded from one (transitively). */
+    const taintedRefs = new Set();
     // Spec 413 — the declared retrieval step (see `RunIntentOpts.retrieval`), before the plan and outside its budget —
     // or, with `onlyIf`, after the plan and only when the plan needs it (416 §4g).
     const runRetrieval = async () => {
@@ -458,26 +520,42 @@ export async function runIntent(intent, opts) {
             obs = { step, ok: false, error: e instanceof Error ? e.message : String(e), stepRef: rs.stepRef };
         }
         emit({ type: 'ToolInvoked', runRef, stepRef: rs.stepRef, toolId: tool.id, ok: obs.ok });
-        await record({ ...base(rs, startedAt), status: obs.ok ? 'executed' : 'failed', ...(obs.ok ? { outputDigest: fingerprint(obs.result) } : { error: obs.error }), ...(observation ? { observation, attests: observation.outcome } : {}), completedAt: now() });
+        await record({ ...(await base(rs, startedAt)), status: obs.ok ? 'executed' : 'failed', ...(obs.ok ? { outputDigest: await valueDigest(obs.result) } : { error: obs.error }), ...(observation ? { observation, attests: observation.outcome } : {}), completedAt: now() });
         allObservations.push(obs);
         opts.onObserve?.(obs);
     };
     if (opts.retrieval && !opts.resume && !opts.retrieval.onlyIf)
         await runRetrieval();
-    const forPlanner = (list) => list.filter((o) => o.stepRef !== RETRIEVAL_STEP_REF);
+    // RUN-3 — what the planner is shown of a FAILED step is its error framed as untrusted data (`frameUntrusted`: the
+    // same `<data>` delimiter a continuation's results use, the delimiter neutralised inside, bounded): an error string
+    // can be text a remote service chose. The run's own observations and receipts keep the error as it was.
+    const forPlanner = (list) => list.filter((o) => o.stepRef !== RETRIEVAL_STEP_REF)
+        .map((o) => (!o.ok && typeof o.error === 'string' ? { ...o, error: frameUntrusted(o.error) } : o));
     // ── PLAN ADMISSION (spec 367 W1), as ONE function — the first plan, a failure re-plan and a continuation plan
     // (spec 421) all pass the same gate. Returns the admitted plan, or the run's terminal result.
     const admitPlan = async (p) => {
         if (!ports.planAdmission)
             return { plan: p };
-        let verdict = await ports.planAdmission.admit({ intent, plan: p, tools: plannerTools });
+        // Spec 445 W0 — A DEFERRED JUDGMENT IS NOT A PASS, AND THIS LOOP IS WHAT MAKES IT SAFE TO PROCEED. A rule that cannot
+        // judge a value that does not exist yet (an amount to be asked for, or threaded by `$ref`) says `defer`; to any other
+        // caller of `admit` that is a refusal. Here it is set aside, because every step that exercises a capability under a
+        // stated outcome is judged AGAIN on its concrete arguments at the point of use (`judgeAtPointOfUse`, below) before
+        // the verifier, a signature request or the tool sees it.
+        const admit = async (candidate) => {
+            const v = await ports.planAdmission.admit({ intent, plan: candidate, tools: plannerTools });
+            if (v.admitted)
+                return v;
+            const rest = v.violations.filter((x) => x.recovery !== 'defer');
+            return rest.length ? { admitted: false, violations: rest } : { admitted: true };
+        };
+        let verdict = await admit(p);
         // Spec 421 W1 — A PLAN THAT READ WHAT ITS ACT NEEDS AND STOPPED continues: the loop appends `plan.continue` and admits
         // again. Only when every violation says so; the continuation plan that follows is admitted by these same rules.
         if (!verdict.admitted && verdict.violations.every((v) => v.recovery === 'continue')) {
             emit({ type: 'PlanRefused', runRef, violations: verdict.violations, replanning: false });
             owed = verdict.violations.map((v) => v.message);
             p = { ...p, steps: [...p.steps, { toolId: CONTINUE_STEP_ID, args: {} }] };
-            verdict = await ports.planAdmission.admit({ intent, plan: p, tools: plannerTools });
+            verdict = await admit(p);
             if (verdict.admitted)
                 emit({ type: 'PlanCreated', runRef, steps: p.steps.length, rationale: 'the plan read what the act needs — continuing from what it returns' });
         }
@@ -498,7 +576,7 @@ export async function runIntent(intent, opts) {
                     return { ...st, args };
                 }) };
             emit({ type: 'PlanRefused', runRef, violations: verdict.violations, replanning: false });
-            verdict = await ports.planAdmission.admit({ intent, plan: p, tools: plannerTools });
+            verdict = await admit(p);
             if (verdict.admitted)
                 emit({ type: 'PlanCreated', runRef, steps: p.steps.length, rationale: `placeholders dropped to be asked for: ${asked.join(', ')}` });
         }
@@ -514,7 +592,7 @@ export async function runIntent(intent, opts) {
             emit({ type: 'PlanRefused', runRef, violations: verdict.violations, replanning: true });
             const told = { ...intent, context: { ...(intent.context ?? {}), admission: verdict.violations.map((v) => v.message) } };
             p = await callPlanner(opts.planner, { intent: told, tools: plannerTools });
-            verdict = await ports.planAdmission.admit({ intent, plan: p, tools: plannerTools });
+            verdict = await admit(p);
             if (!verdict.admitted) {
                 emit({ type: 'PlanRefused', runRef, violations: verdict.violations, replanning: false });
                 const error = `plan_refused: ${verdict.violations.map((v) => v.message).join(' | ')}`;
@@ -543,6 +621,16 @@ export async function runIntent(intent, opts) {
         // 416 §4g — a conditional retrieval runs now, once the plan is known, and only if the plan needs it.
         if (opts.retrieval?.onlyIf && !opts.resume && opts.retrieval.onlyIf(plan))
             await runRetrieval();
+        // The plan loop: walk the current plan; on a step failure, re-plan (bounded) and restart with a fresh plan.
+        //
+        // ── ONE ATTEMPT OF ONE STEP (spec 370 P3) ────────────────────────────────────────────────────────
+        // Everything a step goes through — replay, a declared branch, the answers already given, normalisation,
+        // authority, execution, the receipt, declared effects — in one function, so the scheduler below can run
+        // it for one step or for a batch of independent ones. It reports what happened; the scheduler decides
+        // what it means for the plan.
+        /** Spec 445 W0 — consequential steps that have run in this run, with the arguments they ran with (see the point of use). */
+        const spent = [];
+        const concreteArgs = new Map();
         const attempt = async (i, step) => {
             const tool = toolsById.get(step.toolId);
             // ── ALREADY RAN (spec 370 P1) — replayed as evidence, never as permission. ────────────────
@@ -568,9 +656,18 @@ export async function runIntent(intent, opts) {
                     refuse(`the receipt records ${r.toolId}, the plan says ${step.toolId}`);
                 if (r.status !== 'executed')
                     refuse(`the receipt records '${r.status}', not an execution`);
-                if (r.outputDigest !== fingerprint(done.result))
+                // RUN-8 (spec 445 W0) — THE DIGESTS BIND THE WHOLE VALUE, AND ONLY UNDER THE CURRENT SCHEME. They were a
+                // 2,048-character JSON prefix: a result altered past it replayed as recorded. A receipt written under that
+                // retired form (or under no form) cannot vouch for anything, and there is exactly one comparison — it is
+                // never compared by prefix "for compatibility", and the step is never quietly re-executed either (an act
+                // that already happened would happen twice). The run is refused, by name; start it again.
+                const retired = (d) => !isValueDigest(d);
+                if (retired(r.outputDigest) || retired(r.inputDigest) || (r.planArgsDigest !== undefined && retired(r.planArgsDigest))) {
+                    refuse(`its receipt carries no ${VALUE_DIGEST_SCHEME} digest of its arguments and result — it was recorded under the retired prefix scheme (or was not written by this loop), which cannot vouch for a replayed value; this run cannot be resumed with integrity and must be started again`);
+                }
+                if (r.outputDigest !== await valueDigest(done.result))
                     refuse('the supplied result is not the one the receipt recorded');
-                if (r.inputDigest !== undefined) {
+                {
                     let resolvedArgs = {};
                     try {
                         resolvedArgs = resolveArgs(step.args, refs);
@@ -583,7 +680,7 @@ export async function runIntent(intent, opts) {
                     // resume past goal regression's inserted roster read of "missio nexus" was refused). As strict as before:
                     // any change to the plan's arguments or to an earlier result still refuses.
                     const recorded = r.planArgsDigest ?? r.inputDigest;
-                    if (recorded !== fingerprint(resolvedArgs))
+                    if (recorded !== await valueDigest(resolvedArgs))
                         refuse('the receipt recorded different arguments than this plan and the results before it produce');
                 }
                 const obs = { step, ok: true, result: done.result, stepRef, replayed: true };
@@ -597,9 +694,9 @@ export async function runIntent(intent, opts) {
             if (step.when && !holds(step.when, refs)) {
                 const stepRef = step.id ?? `s${i}`;
                 const rs = resolveStep(runRef, i, step, tool, resolveArgs(step.args, refs));
-                const because = `${step.when.ref} ${step.when.equals !== undefined ? `≠ ${fingerprint(step.when.equals)}` : 'is absent'}`;
+                const because = `${step.when.ref} ${step.when.equals !== undefined ? `≠ ${canonicalJson(step.when.equals).slice(0, 120)}` : 'is absent'}`;
                 emit({ type: 'StepSkipped', runRef, stepRef, toolId: tool.id, because });
-                await record({ ...base(rs, now()), status: 'skipped', completedAt: now(), error: `not taken: ${because}` });
+                await record({ ...(await base(rs, now())), status: 'skipped', completedAt: now(), error: `not taken: ${because}` });
                 return { kind: 'done', obs: { step, ok: true, stepRef, skipped: true } };
             }
             let args = resolveArgs(step.args, refs);
@@ -613,6 +710,9 @@ export async function runIntent(intent, opts) {
             // asked is not a licence to set arguments we did not ask about.
             const declaredArgs = tool.inputSchema?.properties;
             for (const answer of inputsFor(opts.supplied, step.id ?? `s${i}`)) {
+                // A CONFIRMATION answers yes/no; its `data` (an outbound `disclosure` digest) binds the answer, never an argument.
+                if (answer.confirmed !== undefined)
+                    continue;
                 for (const [name, value] of Object.entries(answer.data ?? {})) {
                     if (value === undefined || value === '')
                         continue;
@@ -641,15 +741,43 @@ export async function runIntent(intent, opts) {
                     const pending = resolveStep(runRef, i, step, tool, args);
                     const request = { ...e.request, stepRef: pending.stepRef, toolId: tool.id };
                     emit({ type: 'RunSuspended', runRef, stepRef: pending.stepRef, resumeToken: pending.stepRef });
-                    await record({ ...base(pending, startedAt), status: 'suspended', pendingInput: receiptPending(request), completedAt: now() });
+                    await record({ ...(await base(pending, startedAt)), status: 'suspended', pendingInput: receiptPending(request), completedAt: now() });
                     return { kind: 'exit', result: { outcome: 'suspended', plan, steps: allObservations, receipts, runRef, resumeToken: pending.stepRef, prompt: request }, compensate: false };
                 }
             }
             const rs = resolveStep(runRef, i, step, tool, args);
             emit({ type: 'StepProposed', runRef, stepRef: rs.stepRef, toolId: tool.id, risk: rs.risk });
+            // ── THE STATED OUTCOME, JUDGED ON THE ARGUMENTS THE STEP RUNS WITH (spec 445 W0) ────────────────────────
+            // Plan admission judged the plan as written. An amount that was absent then (asked for since) or threaded from an
+            // earlier result (resolved since) is a figure only now — and the bound is over the run, so it is summed with the
+            // amounts that have already moved. Judged here, before the verifier, before any signature is asked for and
+            // before the tool: over the bound ⇒ denied and unwound; still not stated ⇒ the PERSON is asked, by the loop, so
+            // no tool is left to choose an amount nobody compared with what she said.
+            if (ports.planAdmission && tool.capability && statedOutcomeOf(intent)) {
+                const at = spent.length;
+                const verdict = await ports.planAdmission.admit({ intent, plan: { steps: [...spent, { toolId: step.toolId, args }] }, tools: plannerTools, concrete: true });
+                const mine = verdict.admitted ? [] : verdict.violations.filter((v) => v.stepIndex === at && POINT_OF_USE_CODES.has(v.code));
+                const refused = mine.filter((v) => v.recovery !== 'ask');
+                if (refused.length) {
+                    const error = `plan_refused: ${refused.map((v) => v.message).join(' | ')}`;
+                    emit({ type: 'PlanRefused', runRef, violations: refused.map((v) => ({ ...v, stepIndex: i })), replanning: false });
+                    await record({ ...(await base(rs, startedAt)), status: 'denied', completedAt: now(), error });
+                    return { kind: 'exit', result: { outcome: 'denied', plan, steps: allObservations, receipts, runRef, error }, compensate: true };
+                }
+                const asked = mine.filter((v) => v.field);
+                if (asked.length) {
+                    const request = { kind: 'data', stepRef: rs.stepRef, toolId: tool.id, prompt: asked.map((v) => v.message).join(' '), fields: asked.map((v) => ({ name: v.field, label: v.field, type: 'number', required: true })) };
+                    emit({ type: 'RunSuspended', runRef, stepRef: rs.stepRef, resumeToken: rs.stepRef });
+                    await record({ ...(await base(rs, startedAt)), status: 'suspended', pendingInput: receiptPending(request), completedAt: now() });
+                    return { kind: 'exit', result: { outcome: 'suspended', plan, steps: allObservations, receipts, runRef, resumeToken: rs.stepRef, prompt: request }, compensate: false };
+                }
+                concreteArgs.set(rs.stepRef, args);
+            }
             // ── authority, for every step that exercises a capability ──
             let authority;
             let approvalRecords = [];
+            /** Spec 445 decision 8 — this step runs under a VERIFIED mandate (the effectful-step authority path). */
+            let mandated = false;
             // Spec 374 §1 — THE ASK IS ROUTED; THE MANDATE IS NOT. A step whose subject is another agent is
             // sent there (spec 366 R1), and THAT agent judges its authority under its own playbook, asks its own
             // steward, and answers. Judging it here would ask the asker for a mandate the subject never
@@ -662,12 +790,12 @@ export async function runIntent(intent, opts) {
                     presentedRef: 'routed',
                     decision: {
                         decision: 'allow', obligations: [],
-                        evidence: { mandateRef: `routed:${judgedAt}`, intentDigest: fingerprint(intent), evaluatedAt: now(), verdicts: [{ enforcer: 'routed', allowed: true, reason: `the step's subject is ${judgedAt}; its authority is judged at that agent, under its own playbook and its own steward — this run holds only what it answers` }] },
+                        evidence: { mandateRef: `routed:${judgedAt}`, intentDigest: await valueDigest(intent), evaluatedAt: now(), verdicts: [{ enforcer: 'routed', allowed: true, reason: `the step's subject is ${judgedAt}; its authority is judged at that agent, under its own playbook and its own steward — this run holds only what it answers` }] },
                     },
                     afterApproval: false,
                 };
             }
-            else if (rs.risk !== 'informational' && tool.selfAuthorized && opts.dryRunSelfActs && tool.dryRun === 'invoke') {
+            else if (rs.risk !== 'informational' && tool.selfAuthorized && holdSelfActs && tool.dryRun === 'invoke') {
                 // A tool that honours a dry run is INVOKED with it: its preconditions run, nothing is written. A refusal is recorded as
                 // executed (it ran, and declined); anything else as skipped — the write it describes did not happen.
                 let result;
@@ -681,19 +809,19 @@ export async function runIntent(intent, opts) {
                     if (isInputRequired(e)) {
                         const request = { ...e.request, stepRef: rs.stepRef, toolId: tool.id };
                         emit({ type: 'RunSuspended', runRef, stepRef: rs.stepRef, resumeToken: rs.stepRef });
-                        await record({ ...base(rs, startedAt), status: 'suspended', pendingInput: receiptPending(request), completedAt: now() });
+                        await record({ ...(await base(rs, startedAt)), status: 'suspended', pendingInput: receiptPending(request), completedAt: now() });
                         return { kind: 'exit', result: { outcome: 'suspended', plan, steps: allObservations, receipts, runRef, resumeToken: rs.stepRef, prompt: request }, compensate: false };
                     }
-                    await record({ ...base(rs, startedAt), status: 'failed', completedAt: now(), error: e instanceof Error ? e.message : String(e) });
+                    await record({ ...(await base(rs, startedAt)), status: 'failed', completedAt: now(), error: e instanceof Error ? e.message : String(e) });
                     return { kind: 'done', obs: { step, ok: false, stepRef: rs.stepRef, error: e instanceof Error ? e.message : String(e) } };
                 }
                 const declined = !!result && typeof result === 'object' && typeof result.refused === 'string';
-                await record({ ...base(rs, startedAt), status: declined ? 'executed' : 'skipped', completedAt: now(), ...(declined ? {} : { error: 'dry run: the invoker checked and wrote nothing' }),
-                    authority: { presentedRef: 'self', decision: { decision: 'allow', obligations: [], evidence: { mandateRef: 'self', intentDigest: fingerprint(intent), evaluatedAt: now(), verdicts: [{ enforcer: 'self', allowed: true, reason: 'dry run' }] } }, afterApproval: false } });
+                await record({ ...(await base(rs, startedAt)), status: declined ? 'executed' : 'skipped', completedAt: now(), ...(declined ? {} : { error: 'dry run: the invoker checked and wrote nothing' }),
+                    authority: { presentedRef: 'self', decision: { decision: 'allow', obligations: [], evidence: { mandateRef: 'self', intentDigest: await valueDigest(intent), evaluatedAt: now(), verdicts: [{ enforcer: 'self', allowed: true, reason: 'dry run' }] } }, afterApproval: false } });
                 return { kind: 'done', obs: { step, ok: true, stepRef: rs.stepRef, ...(declined ? {} : { skipped: true }), result } };
             }
-            else if (rs.risk !== 'informational' && tool.selfAuthorized && opts.dryRunSelfActs) {
-                await record({ ...base(rs, startedAt), status: 'skipped', completedAt: now(), error: 'dry run: a comparison run does not commit a self-acting write' });
+            else if (rs.risk !== 'informational' && tool.selfAuthorized && holdSelfActs) {
+                await record({ ...(await base(rs, startedAt)), status: 'skipped', completedAt: now(), error: holdReason });
                 return { kind: 'done', obs: { step, ok: true, stepRef: rs.stepRef, skipped: true, result: { dryRun: true, toolId: tool.id } } };
             }
             else if (rs.risk !== 'informational' && tool.selfAuthorized) {
@@ -708,7 +836,7 @@ export async function runIntent(intent, opts) {
                         decision: 'allow', obligations: [],
                         // The evidence names the basis honestly — there is no mandate to reference, and inventing a
                         // mandateRef would make a receipt claim a signature that never happened.
-                        evidence: { mandateRef: 'self', intentDigest: fingerprint(intent), evaluatedAt: now(), verdicts: [{ enforcer: 'self', allowed: true, reason: 'the run\'s own principal owns what this touches; the session is the authority' }] },
+                        evidence: { mandateRef: 'self', intentDigest: await valueDigest(intent), evaluatedAt: now(), verdicts: [{ enforcer: 'self', allowed: true, reason: 'the run\'s own principal owns what this touches; the session is the authority' }] },
                     },
                     afterApproval: false,
                 };
@@ -719,12 +847,43 @@ export async function runIntent(intent, opts) {
                     return { kind: 'exit', result: a, compensate: true };
                 authority = { presentedRef: a.used.ref, decision: a.decision, afterApproval: a.approvalRecords.length > 0 };
                 approvalRecords = a.approvalRecords;
+                mandated = true;
+            }
+            // ── OUTBOUND (spec 445 decision 8) — a tool that sends data to another party is not run silently once this run
+            // has read untrusted content, nor when an argument is threaded from an untrusted result. A verified mandate is
+            // the authority path; without one the step PARKS for the asker's confirmation, bound to `outboundDigest` over
+            // exactly what would leave. Declined ⇒ denied, nothing sent. Batched steps cannot `$ref` their own batch's
+            // results (`independentBatch`), so a batched outbound step sends the plan's literal arguments only.
+            let outboundConfirmed;
+            if (tool.outbound && !mandated) {
+                const threaded = [...refsUsed(step.args)].some((r) => taintedRefs.has(r));
+                if (untrustedSeen || threaded) {
+                    const disclosure = await outboundDigest(tool.id, args);
+                    const answers = inputsFor(opts.supplied, rs.stepRef).filter((s) => s.confirmed !== undefined);
+                    const party = typeof tool.outbound === 'object' ? String(args[tool.outbound.partyArg] ?? 'another party') : 'another party';
+                    if (answers.some((s) => s.confirmed === false)) {
+                        const error = `outbound_declined: nothing was sent to ${party} — the person declined`;
+                        await record({ ...(await base(rs, startedAt)), status: 'denied', completedAt: now(), error });
+                        return { kind: 'exit', result: { outcome: 'denied', plan, steps: allObservations, receipts, runRef, error }, compensate: true };
+                    }
+                    if (!answers.some((s) => s.confirmed === true && s.data?.disclosure === disclosure)) {
+                        const request = {
+                            kind: 'confirmation', stepRef: rs.stepRef, toolId: tool.id,
+                            prompt: `This run has read content written by others. Send this to ${party}? Nothing leaves until you confirm exactly this.`,
+                            summary: { party, sends: args, disclosure, why: threaded ? 'threaded-from-untrusted' : 'untrusted-content-seen', confirmWith: { confirmed: true, data: { disclosure } } },
+                        };
+                        emit({ type: 'RunSuspended', runRef, stepRef: rs.stepRef, resumeToken: rs.stepRef });
+                        await record({ ...(await base(rs, startedAt)), status: 'suspended', ...(authority ? { authority } : {}), pendingInput: receiptPending(request), completedAt: now() });
+                        return { kind: 'exit', result: { outcome: 'suspended', plan, steps: allObservations, receipts, runRef, resumeToken: rs.stepRef, prompt: request }, compensate: false };
+                    }
+                    outboundConfirmed = disclosure;
+                }
             }
             // ── execute ──
             const suppliedHere = inputsFor(opts.supplied, rs.stepRef);
             const binding = opts.bindingFor?.(rs);
             const operationId = binding?.operationId ?? rs.idempotencyKey ?? `${runRef}:${rs.stepRef}`;
-            const ctx = { intent, step, index: i, ...(rs.idempotencyKey ? { idempotencyKey: rs.idempotencyKey } : {}), operationId, ...(suppliedHere.length ? { supplied: suppliedHere } : {}), planDigest: currentPlanDigest, untrustedSeen };
+            const ctx = { intent, step, index: i, ...(rs.idempotencyKey ? { idempotencyKey: rs.idempotencyKey } : {}), operationId, ...(suppliedHere.length ? { supplied: suppliedHere } : {}), planDigest: currentPlanDigest, untrustedSeen, ...(outboundConfirmed ? { outboundConfirmed } : {}) };
             executed++;
             let obs;
             let observation;
@@ -764,7 +923,7 @@ export async function runIntent(intent, opts) {
                     const request = { ...e.request, stepRef: rs.stepRef, toolId: tool.id };
                     emit({ type: 'RunSuspended', runRef, stepRef: rs.stepRef, resumeToken: rs.stepRef });
                     await record({
-                        ...base(rs, startedAt),
+                        ...(await base(rs, startedAt)),
                         status: 'suspended',
                         ...(authority ? { authority } : {}),
                         ...(approvalRecords.length ? { approvalRecords } : {}),
@@ -778,13 +937,13 @@ export async function runIntent(intent, opts) {
             emit({ type: 'ToolInvoked', runRef, stepRef: rs.stepRef, toolId: tool.id, ok: obs.ok });
             const decisions = opts.decisionsFor?.(tool.id, args) ?? [];
             const stepReceipt = {
-                ...base(rs, startedAt),
+                ...(await base(rs, startedAt)),
                 status: obs.ok ? 'executed' : 'failed',
                 // What was decided FOR the person on the way here, and on what basis (spec 363 W6).
                 ...(decisions.length ? { decisions: [...decisions] } : {}),
                 ...(authority ? { authority } : {}),
                 ...(approvalRecords.length ? { approvalRecords } : {}),
-                ...(obs.ok ? { outputDigest: fingerprint(obs.result) } : { error: obs.error }),
+                ...(obs.ok ? { outputDigest: await valueDigest(obs.result) } : { error: obs.error }),
                 // Spec 410 §2 — what the adapter saw, and the one word the receipt attests.
                 ...(observation ? { observation, attests: observation.outcome } : {}),
                 ...(reconciled ? { reconciled: true } : {}),
@@ -916,6 +1075,20 @@ export async function runIntent(intent, opts) {
                     emit({ type: 'PlanCreated', runRef, steps: expanded.length, rationale: `fan-out of ${baseId} over <${relation}> into ${expanded.length} steps` });
                     maxSteps += Math.max(0, expanded.length - 1);
                     plan = { ...plan, steps: [...plan.steps.slice(0, i), ...expanded, ...plan.steps.slice(i + 1)] };
+                    // RUNC-4 (spec 445 W0) — A BOUND STATED OVER THE PLAN IS JUDGED OVER THE EXPANDED PLAN. Admission saw ONE step
+                    // where there are now N; "up to 20 in total" over three payees is only decidable here. The expanded plan goes
+                    // back through the same admission port, and a violation no re-plan may cure (`refuse`) ends the run before
+                    // any item runs. Other recoveries are not acted on here: the plan as written was already admitted, and an
+                    // expansion is not a new plan to re-word.
+                    if (ports.planAdmission && expanded.length > 0) {
+                        const verdict = await ports.planAdmission.admit({ intent, plan, tools: plannerTools });
+                        const refused = verdict.admitted ? [] : verdict.violations.filter((v) => v.recovery === 'refuse');
+                        if (refused.length) {
+                            emit({ type: 'PlanRefused', runRef, violations: refused, replanning: false });
+                            await compensate();
+                            return withOwed({ outcome: 'denied', plan, steps: allObservations, receipts, runRef, error: `plan_refused: ${refused.map((v) => v.message).join(' | ')}` });
+                        }
+                    }
                     if (expanded.length === 0)
                         continue; // an empty set fans out to nothing, which is a fine answer (the step is gone; `i` now names the next)
                     step = plan.steps[i];
@@ -940,8 +1113,24 @@ export async function runIntent(intent, opts) {
                 for (const o of outcomes) {
                     if (o.kind === 'done') {
                         allObservations.push(o.obs);
+                        // What has MOVED in this run, with the arguments it moved with — the running total a bound over the run is
+                        // judged against at the next step's point of use (a replayed step counts: it ran, in the run this resumes).
+                        if (o.obs.ok && !o.obs.skipped && toolsById.get(o.obs.step.toolId)?.capability) {
+                            let ran = o.obs.stepRef ? concreteArgs.get(o.obs.stepRef) : undefined;
+                            if (!ran) {
+                                try {
+                                    ran = resolveArgs(o.obs.step.args, refs);
+                                }
+                                catch {
+                                    ran = o.obs.step.args;
+                                }
+                            }
+                            spent.push({ toolId: o.obs.step.toolId, args: ran });
+                        }
                         if (o.obs.ok && isUntrusted(o.obs.result))
                             untrustedSeen = true;
+                        if (o.obs.ok && o.obs.step.ref && (isUntrusted(o.obs.result) || [...refsUsed(o.obs.step.args)].some((r) => taintedRefs.has(r))))
+                            taintedRefs.add(o.obs.step.ref);
                         opts.onObserve?.(o.obs);
                         if (o.obs.ok && !o.obs.skipped)
                             lastResult = o.obs.result;
@@ -954,7 +1143,7 @@ export async function runIntent(intent, opts) {
                 if (exit) {
                     if (exit.compensate)
                         await compensate();
-                    return exit.result;
+                    return withOwed(exit.result);
                 }
                 if (failedMidPlan)
                     break; // stop this plan; decide whether to re-plan below
@@ -969,12 +1158,23 @@ export async function runIntent(intent, opts) {
                 await compensate();
                 const error = last?.error ?? 'step failed';
                 emit({ type: 'RunFailed', runRef, error });
-                return { outcome: 'failed', plan, steps: allObservations, receipts, runRef, error };
+                return withOwed({ outcome: 'failed', plan, steps: allObservations, receipts, runRef, error });
             }
             replans++;
             // Spec 391 W2 — the planner sees what each prior step WAS and how big, not a 40 KB body in its prompt.
-            plan = await callPlanner(opts.planner, { intent, tools: plannerTools, observations: compactObservations(forPlanner(allObservations)) });
-            assertKnownTools(plan, toolIds);
+            // RUN-3 (spec 445 W0) — and what a failed step SAID is framed as data, bounded (`forPlanner`): it can be a remote
+            // service's text. The plan that comes back is a plan like any other: it passes `admitPlan` — the one gate the
+            // first plan and a continuation pass — BEFORE a step of it runs. It used to go straight to the known-tools
+            // guard, so every admission rule (a `refuse` rule included) was skipped on exactly the planner turn that had
+            // just read an error string. Refused ⇒ the run ends there, and what already ran is unwound.
+            const replanned = await callPlanner(opts.planner, { intent, tools: plannerTools, observations: compactObservations(forPlanner(allObservations)) });
+            const readmitted = await admitPlan(replanned);
+            if ('result' in readmitted) {
+                await compensate();
+                return withOwed(readmitted.result);
+            }
+            plan = readmitted.plan;
+            assertKnownTools(plan, toolIds); // fail-closed after admission (ADR-0013).
             currentPlanDigest = await planDigest(plan);
             emit({ type: 'PlanCreated', runRef, steps: plan.steps.length, ...(plan.rationale ? { rationale: plan.rationale } : {}) });
         }
@@ -983,7 +1183,7 @@ export async function runIntent(intent, opts) {
         const error = e instanceof OrchestrationError ? `${e.code}: ${e.message}` : e instanceof Error ? e.message : String(e);
         await compensate();
         emit({ type: 'RunFailed', runRef, error });
-        return { outcome: 'failed', plan, steps: allObservations, receipts, runRef, error };
+        return withOwed({ outcome: 'failed', plan, steps: allObservations, receipts, runRef, error });
     }
 }
 //# sourceMappingURL=loop.js.map