In my last claim, a sequence got allowed that probably should have made you nervous. Thirteen refunds, split across two windows, with a close in between. Each window stayed under its limit. The close was authorized. The gate let it through. And it was right to.
That bothered me for days. Not because the gate was broken. Because it wasn't.
CLAIM-30 was about the sharpest failure mode I have found in agent memory: every individual step can be allowed while the sequence as a whole is the attack. A per-step gate sees nothing wrong because nothing is wrong at the step level. The violation only lives in the trajectory. I built a gate that reads the whole trajectory, and it caught three kinds of composed escape.
But it left one honest hole, and I wrote that hole down at the time instead of hiding it. The gate counted within a window. When a window legitimately closed, the count reset. So one sequence took the same dangerous total and split it across two legitimately closed windows. No single window broke the bound. The gate allowed it. Correctly.
What this already is
