32 Planning as a Control Layer: DAGs and Intelligence Arbitrage

32.1 Chapter status

Field	Value
Chapter ID	`planning-as-a-control-layer`
Part	Part II - Planning, Memory, Reasoning, and Execution
Status	conceptual
Manuscript maturity	v0.2 manuscript draft
Last updated	2026-08-02
Primary source records	`planforge`, `viea`, `cognitive_compilation`, `software_magic_grimoire`, `moecot`, `planforge_compiler_arch`, `coherence_exchange`, `tokenmana`, `ext_v_jepa_2_2025`, `reflexive_router_whitepaper`
Claim label	Design rationale
Evidence level	argument
Source queue	primary: `planforge`, `viea`, `planforge_compiler_arch`; supporting: `cognitive_compilation`, `software_magic_grimoire`, `tokenmana`, `reflexive_router_whitepaper`; connector/recovery: `moecot`, `coherence_exchange`
Source loading state	source notes: `planforge`, `platonic_world_model`, `viea`, `cognitive_compilation`, `software_magic_grimoire`, `moecot`, `planforge_compiler_arch`, `coherence_exchange`, `tokenmana`, `ext_v_jepa_2_2025`, `reflexive_router_whitepaper`, `regret_engine`; raw cache: `planforge`, `viea`, `cognitive_compilation`, `software_magic_grimoire`, `planforge_compiler_arch`, `tokenmana`; connector/recovery: `moecot`, `coherence_exchange`
Test state	The schema/fixture, plan-execution, scheduler-state, runtime-replan, and Lean checks pass over their exact synthetic records. Across them, eight valid records, 29 rejecting cases, two accepted no-change transitions, 12 complete graph-transport mutations, and 71 theorem declarations under seven targets establish finite record, route, lifecycle, actual-edge ordering, and information-loss consequences only. No natural planner output, dependency-truth/completeness result, planner-quality result, live scheduler, observed replan benefit, cost-quality dominance, or support transition exists.

32.2 Drafting guardrail

Planning is a prospective policy for ordering obligations under uncertainty, not a DAG-shaped claim of intelligence. The repository validates synthetic fields and finite routes only. It does not establish decomposition coverage, dependency truth, context or predictive-state calibration, route adequacy, scheduler benefit, live replanning, useful critical-path improvement, safe control, cost dominance, or transfer.

It follows command contracts because explicit commands are still inert until the stack decides what work should exist, what order it belongs in, and which boundaries must be consulted before dispatch.

Planning is therefore the stack’s first refusal-friendly layer after command intake. A plan can expose a missing dependency, overbroad tool request, impossible budget, inadequate route, failed quality predicate, or violated stop condition before the system spends authority. That makes plans useful even when they do not execute.

32.3 Human Reading Path

Concrete lens. The simpler planner retries or declares local completion after deployment fails. The control-layer plan blocks descendants, records the missing authority, and replaces only the failed scope.

Once a command is structured, the stack has to decide what work should exist and what kind of intelligence each piece deserves. Planning turns intent into obligations: dependencies, budgets, context needs, capability tiers, route choices, adequacy contracts, review points, and stop conditions.

Planning is control, not brainstorming. A plan is valuable only if downstream layers can inspect it, reject unsafe steps, dispatch bounded jobs, preserve residual work, and explain why a cheaper route was adequate or why stronger cognition was required.

The plan must be an artifact. It should show dependencies, assumptions, blocked paths, missing context, route choices, adequacy tests, and stop conditions before any runtime adapter touches the world.

Good planning reduces surprise by making work visible while changes are still cheap. The plan earns trust when it exposes what must be refused, deferred, reviewed, routed differently, or split into a safer path. It should make the negative space legible: tools not granted, context not loaded, cheap routes rejected, claims not made, and approvals still waiting.

That visibility turns planning into governance rather than a prettier brainstorm.

32.4 Problem

After a command contract is accepted, the stack must choose which obligations become work, which alternatives remain candidates, what dependencies and observations make nodes feasible, how scarce capacity is scheduled, when dispatch may be requested, and how feedback changes only the affected future.

A graph can be acyclic and still pursue the wrong decomposition, conceal uncertainty, request impossible context, select an inadequate route, violate authority or rights, erase counterfactuals, or create more coordination and recovery cost than useful work. Planning’s distinct owner is therefore the prospective plan policy: the versioned choice and revision of a partial order, schedule, observation strategy, and dispatch boundary under uncertainty.

Intent-to-Execution owns semantic conformance. Cognitive Compilation owns representation lowering. Routing owns worker selection. Labor OS owns jobs. Runtime owns effects. Planning decides which obligation should become eligible for those handoffs, in what order, under which assumptions, and with what fallback or abstention.

32.5 Why existing approaches are insufficient

Prompt plans, chain or tree search, HTN/PDDL task models, DAG schedulers, workflow engines, behavior trees, multi-agent orchestrators, compiler passes, learned world models, and capability routers each solve part of planning. None alone establishes consumer-relative decomposition adequacy, dependency truth, observation and predictive-state calibration, route feasibility, authority and rights compatibility, complete alternative and failure denominators, useful critical-path improvement, merge consistency, effect-bearing stop and replan behavior, or total cost against strong matched baselines.

A tidy DAG is not a good plan. A solver optimum is only relative to its model. A selected cheap route is not adequate. A recorded replan delta is not evidence that live feedback improved outcomes. ReAct, Tree of Thoughts, PDDL, SHOP2, TAMP, behavior trees, GOAP, AutoGen, TLA+, and V-JEPA 2 are therefore strong comparison pressures, not local planner evidence.

32.5.1 Strongest objection

The strongest objection is that a planning control plane can add ceremony, latency, and brittle bookkeeping while leaving decomposition quality unchanged. The bounded answer is empirical: the plan policy earns its place only through matched useful-work, safety, recovery, and total-cost outcomes; its records merely make failed assumptions, alternatives, authority requests, and residual work inspectable enough to test that tradeoff.

32.6 Core Claim

[planning-as-a-control-layer.core, label: Design rationale, support: argument] Planning as a Control Layer should own a versioned, consumer-relative plan policy that selects and revises a partial order of obligations under uncertainty before execution. The policy binds the accepted command version; candidate decompositions and explicit abstention; typed nodes and dependency semantics; assumptions, observations, predictive-state and error models; context, tool, capability, authority, rights, resource, and verifier requirements; adequacy and utility predicates; lifecycle, dispatch, merge, stop, fallback, recovery, and replan rules; complete alternative and attempt denominators; and expected versus observed cost, latency, risk, and residuals.

Only nodes whose dependencies and feasibility predicates are satisfied may request lowering and dispatch, and every feedback-driven change must preserve the contract or produce a scoped re-contract or residual. The plan policy does not grant authority, perform semantic compilation, choose a worker, execute an effect, validate its own predictions, or prove that a decomposition is useful, optimal, safe, or transferable by itself.

Reader claim. A plan is a revisable control record, not a confident list of future steps. Its value appears when reality disagrees with it and the system changes course without losing authority, evidence, or stop conditions.

Operational rule. Dispatch only ready nodes whose dependencies, context, authority, verifier, and receipt requirements pass. On failure, freeze affected descendants, record the observation, and admit a scoped replacement graph only if it preserves the parent ceiling and every unresolved residual.

32.6.1 Worked replan: a dependency fails after dispatch

A repository-release plan has three ordered obligations: render the book, deploy the rendered artifact, then verify the public route. Rendering succeeds and produces a digest-bound artifact. Deployment then fails because the hosting credential is unavailable. A naive planner retries unrelated commands or rewrites the goal as “local build complete.” The control layer instead marks the deploy node blocked, prevents the public-route check from pretending it ran, and records the missing credential as a residual owned outside the planner.

When a later observation supplies an authorized artifact-only deployment path, replanning creates a new plan version. It reuses the completed render receipt, replaces only the blocked deploy node, and keeps public verification downstream. The local seven-event witness reaches a second lowered job only after feedback and scoped replanning. Eleven closed countermodels reject authority widening, incomplete decomposition, missing context, premature feedback, stop erasure, unscoped repair, and missing residuals. This demonstrates finite ordering and custody; it does not show that the chosen decomposition or scheduler is optimal.

The claim remains at argument support. PlanForge supplies decomposition, dependency, tier, scheduler, and intelligence-arbitrage vocabulary; VIEA supplies the accepted-command-to-artifact spine; Cognitive Compilation supplies compiler-pass and IR pressure; Software Magic Grimoire supplies bounded workflow language; TokenMana broadens the budget surface beyond token count; Coherence Exchange remains speculative connector context for intelligence-arbitrage language; MoECOT remains an implementation-reference route rather than local evidence for planning behavior.

32.6.2 Claim-source mapping status

Appendix C maps this merged planning-control claim to all assigned source notes. Six local raw-cache mappings and the complete authenticated moecot connector text are passage-reviewed. The mappings support planning as a bounded control artifact between accepted goals and execution, DAG scheduling, capability-tier annotation, adequacy contracts, cost-quality accounting, and residual routing. They do not establish planner quality, dependency soundness, selected-tier adequacy, context-demand prediction, route-quality improvement, measured savings, or deployed replanning behavior. coherence_exchange remains connector-bounded, and MoECOT code, logs, release artifacts, benchmark records, and external corroboration remain unimported.

Source	What it supports	Limit
`planforge`	Passage-reviewed: planning middleware decouples planning from execution through hierarchical decomposition, primitive schemas, plan optimization, dependency inference, scheduling, MVI tiering, fallback, and failure-driven replanning.	Conceptual whitepaper only; no verified scheduler, acyclicity checker, or benchmark result is present.
`viea`	Passage-reviewed: accepted commands feed an artifact spine with orchestration, routing, workflow-to-tool compilation, verification, runtime adapters, feedback, residuals, tools, benchmarks, and regression coverage.	Does not prove a deployed planner, runtime handoff, or end-to-end execution trace.
`cognitive_compilation`	Passage-reviewed: plan formation, semantic compilation, target compilation, execution, and repair are separated while goals and constraints become source plans, semantic atoms, DAGs, validators, and repairable artifacts.	No local compiler, planner harness, task trace suite, or empirical ablation validates planning quality.
`software_magic_grimoire`	Passage-reviewed: workflows can be represented as spell stacks with handoffs, guards, entry/exit rules, loops, recursion, recovery paths, evidence-advancing loops, and mode separation.	Operational vocabulary only; no workflow engine, prompt-stack benchmark, or behavioral planning test is present.
`planforge_compiler_arch`	Passage-reviewed: planner-as-compiler framing with task graphs or IR, typed primitives, dependencies, interfaces, quality gates, model/tool tier routing, cost/latency profiles, independent-node parallelism, critical-path scheduling, and execution handoff.	Source-reported estimates remain motivating context; no cost, time, routing-quality, scheduler-quality, or artifact-quality numbers are reproduced here.
`tokenmana`	Passage-reviewed: budgets include governed capacity, load variance, latency, bounded burst controls, token-normalized cognitive friction, study design, privacy constraints, and quality/human-friction limits.	Economic model and study design only; no simulation, usage data, welfare result, or scheduler-resource experiment exists here.
`coherence_exchange`	Connector/source-note mapped: speculative intelligence-arbitrage and coherence/liquidity framing connects PlanForge to verification supply chains, reviewable knowledge units, accounting mechanisms, and governance-visible knowledge movement.	Speculative connector context only; economic and institutional claims are not implemented or externally corroborated here.
`moecot`	Connector/source-note mapped: runtime-reference context for compact orchestration, specialist lanes, fail-closed ledgers, readiness gates, replay, residual tracking, promotion blockers, and handoff.	Runtime and benchmark claims remain source-reported until artifacts are inspected or reproduced.

32.7 Mechanism

The plan policy first freezes its contract, consumer, environment, epoch, horizon, authority and rights ceilings, resource accounts, and material-change triggers. It then preserves multiple candidate decompositions—including clarification, deferral, human planning, and no-plan outcomes—instead of retaining only the winner.

Each node is an obligation rather than a prose step. It names inputs, outputs, preconditions, postconditions, forbidden means, observations, context, authority, rights, resources, verifier, failure, fallback, and residual owner. Dependencies are typed as data, control, semantic, temporal, authority, rights, evidence, resource, state, or recovery relations, with provenance, confidence, and falsifiers. Acyclicity is therefore necessary but never sufficient.

Scheduling happens only after decomposition coverage, dependency validity, feasibility, route eligibility, verifier availability, recovery readiness, and expected utility are visible. Feedback enters as a versioned observation. A replan computes the affected future subgraph, invalidates stale assumptions and routes, and preserves unaffected work only when dependency closure still holds.

The policy evaluates alternatives against a declared utility model without pretending that the model is complete. Expected critical path, resource use, risk, rights burden, verification demand, recovery burden, and opportunity cost remain separate estimates with provenance and calibration state. An apparently cheap plan cannot win by moving hard verification, human review, repair, or residual custody outside its ledger. When alternatives are incomparable, the policy records the disagreement and may abstain or request a human decision.

Scheduling and replanning preserve counterfactuals. The selected graph retains the candidates it defeated, the assumptions that made it eligible, the nodes that were blocked, and the observations that changed the decision. That history allows later outcome evidence to distinguish a genuinely useful planning rule from luck, hindsight, extra search, or selective reporting.

32.7.1 Decision capsules and admissible regret

The Regret Engine source (regret_engine) sharpens what this counterfactual record must freeze. Before dispatch, a Decision Capsule commits the information then available, the objective and authority versions, feasible alternatives, forecasts and uncertainty, resources, planned checks, model and tool identities, and the selected continuation policy. Later observations may revise estimates of what would have happened; they may not manufacture a duty to have known the future.

Retrospective comparison therefore needs a comparator contract. An alternative is admissible only if it was available under comparable information, authority, resources, continuation semantics, and causal feasibility. Rejected and unresolved alternatives remain in the record. Planning may then consume a prospective distribution over loss, hard violations, opportunity closure, recovery burden, and avoidable deficit, but no one scalar may trade away an authority boundary or conceal which assumption changed the recommendation.

This yields a useful mitigation order under uncertainty: acquire information, run a bounded probe, narrow scope, add verification, checkpoint, delegate, prepare rollback, or schedule abstention, then recompute the frontier. Inaction is itself a candidate policy with delay and opportunity cost. The source is a conceptual design, so this addition does not establish comparator quality, counterfactual identifiability, regret calibration, or better planning.

flowchart LR
  A["Accepted command and epoch"]
  B["Candidate decompositions"]
  C["Typed obligations and dependencies"]
  D["Observations, uncertainty, feasibility"]
  E["Routes, resources, adequacy, recovery"]
  F{"Current dispatch predicates"}
  G["Lowering and dispatch request"]
  H["Block, abstain, or residualize"]
  I["Versioned feedback"]
  J["Affected-future replan"]
  K["Alternative and cost ledger"]
  A --> B
  B --> C
  C --> D
  D --> E
  E --> F
  F -- "satisfied" --> G
  F -- "unsatisfied" --> H
  G --> K
  H --> K
  I --> J
  J --> C
  J --> K

How to read the planning loop: Dispatch is one possible plan outcome, not the definition of success. Missing information, infeasibility, authority or rights conflict, inadequate routes, insufficient recovery, or failed utility may produce a block or abstention. Feedback never edits history in place; it creates a scoped replan whose invalidations, alternatives, and costs remain in the ledger.

32.7.2 Plan node lifecycle states

Plan nodes should carry lifecycle states:

State	Meaning	Lowering rule
`proposed`	A node is useful for decomposition but not yet checked.	No job creation.
`blocked_context`	Required context or source adequacy is missing.	Request context or split task.
`blocked_authority`	Required means, tool, publication, or effect lacks authority.	Re-contract or approval route.
`blocked_rights`	An affected-party, privacy, license, contestability, or disclosure obligation is unresolved.	Rights-owner review or narrower plan.
`blocked_dependency`	Upstream node, artifact, or review is incomplete.	Wait or replan.
`blocked_verification`	Success predicate or verifier is missing.	Define verifier or narrow output.
`route_pending`	Planning has requested a worker or tool route but qualification is not yet returned.	No job creation.
`dispatchable`	Constraints, context, authority, dependencies, and verification plan are satisfied.	May lower into a typed job.
`dispatched`	The node has produced a job packet.	Track job parentage.
`replanned`	The node changed after feedback while preserving contract boundaries.	Record delta and residuals.
`residualized`	The obligation remains unresolved with an accountable owner.	No completion claim.
`stopped`	Stop condition, denial, budget exhaustion, or risk gate ended the node.	Preserve reason and evidence.
`failed`	An attempted node failed its effect, artifact, verifier, merge, or recovery contract.	Preserve failure and evaluate replan.
`completed`	The downstream owners returned the required observed outcome and acceptance receipts.	Record outcome; no automatic support movement.

These states let the plan graph be useful before execution and accountable after execution. They also keep candidate routes from being confused with authorized work.

32.7.3 DAG scheduling and intelligence arbitrage

PlanForge sharpens the plan graph into a schedulable DAG. Each node should name dependencies, expected inputs, expected outputs, context demand, authority state, capability tier, adequacy contract, quality predicate, verification requirement, budget limit, route assignment, merge condition, escalation path, and residual behavior.

That extra structure changes the meaning of “use a smaller model.” A cheap route is acceptable only when the node has a bounded work contract, an adequacy contract, a verifier, and a fallback. A stronger model, specialist core, tool, human reviewer, or tribunal route is justified when risk, source uncertainty, context demand, quality predicate, or failure cost makes the cheaper route inadequate.

Every node therefore carries two contracts. The work contract names what the node may do. The adequacy contract names what would make the output usable by downstream dependents. Scheduling without the second contract creates text or artifacts without reliable progress.

The DAG also makes local repair possible. If one source-reading node used stale evidence, the scheduler should identify the affected subgraph, repair the stale node, rerun dependents whose assumptions changed, and preserve unaffected work. That is the compiler intuition behind PlanForge: the graph lets the stack rebuild only the parts whose dependencies changed while keeping residuals and rejected routes visible.

32.7.4 PlanForge compiler, scheduler, and Watchdog contract

PlanForge’s front end stops recursive decomposition only when a leaf matches a versioned primitive schema. Matching a verb is insufficient. The leaf binds typed arguments, units, preconditions, postconditions, idempotence, effects, authority, context, output schema, verifier, and recovery behavior. A fixed catalog of semantic words is not automatically an executable primitive set: VERIFY can describe an epistemic relation while still lacking a verifier, target, threshold, evidence class, and failure consequence. Unknown or ill-typed leaves route to clarification, schema extension review, or residuals rather than being coerced into the nearest tool.

The middle end can deduplicate exact operations and propose semantic merges, but an embedding threshold is only a candidate generator. Two nodes merge only when their parameters, consumers, authority, rights, state epoch, side effects, quality predicates, and downstream dependency meaning are compatible. “Email Bob” and “contact Robert” can be the same intent, different people, or different channels; a cosine score cannot decide that. Every merge retains the source nodes, proof or review basis, affected edges, rollback split, and any saved cost. Failed positive controls on true aliases or negative controls on confusable actions block deduplication claims.

Minimum Viable Intelligence is a calibrated adequacy estimate, not a permanent rank attached to a model name. For node \(n\) and route \(w\), the scheduler needs the predicted probability and consequence of failing the node’s adequacy contract, confidence and data age, task-family coverage, context and tool requirements, latency distribution, verifier capacity, and fallback burden. Historical failure logs may train a classifier, but unseen primitives and distribution shift default conservatively; a source-paper rule such as “bump a tier above 20% historical failure” is an illustrative policy, not a validated constant. Humans, scripts, tools, local models, services, and robots share the same contract surface without being reduced to one fictional intelligence scalar.

For a feasible DAG, critical-path slack creates a genuine scheduling option. Zero-slack nodes may justify faster qualified routes; positive-slack nodes may use cheaper slower routes without moving the deadline. A heuristic such as HEFT or greedy list scheduling can minimize a declared combination of route cost and sink finish time under dependency, capacity, deadline, and adequacy constraints. It does not compute an “optimal plan” when duration, failure, queue, merge, verification, and repair estimates are uncertain. The receipt reports predicted and observed makespan, cost, slack, queueing, coordination, verification, retries, canceled work, and quality rather than only the visible worker bill.

The Watchdog is a runtime consumer of the compiled schedule, not proof that the plan is correct. It validates input and output schemas; observes start, heartbeat, completion, effect, and verifier events; retries only where idempotence or compensation permits; carries structured failure context into a qualified escalation; and asks Planning to recompile when an assumption or dependency changes. A lazy-start speculative route can launch a stronger worker near a latency quantile while a cheaper attempt runs, but both attempts, cancellation latency, duplicate effects, privacy exposure, rate limits, and verifier capacity count. Speculation is disabled for non-idempotent or irreversible effects unless a downstream owner supplies isolation and commit.

The paper family’s reported 60–85% token-cost language comes from two synthetic arithmetic scenarios with assumed prices, fifty-way parallelism, no rate-limit bottleneck, and no measured output-quality, orchestration, verification, failure, or merge burden. Those numbers illustrate why workload mix matters: the “grunt work” scenario predicts large savings while a reasoning-heavy refactor predicts little. They are not a benchmark result, empirical validation, or a prior for this book’s mature campaign.

32.7.5 Semantic-operation DAGs and partial qualification

The Reflexive Router narrows “composite request” into a planning obligation. The pre-deliberative layer may detect that one request contains several semantic operations, but it may emit only a bounded candidate DAG whose nodes name operation type, inputs, outputs, dependencies, capability contract, authority demand, verifier, effect class, budget, fallback, and provenance. Planning remains the owner of the graph; the router owns candidate routes for its nodes.

Qualification is node-local and dependency-aware. Exact transforms, retrieval, proof, specialist inference, deliberation, and effects need not share a route, yet no node becomes dispatchable merely because another node passed. A plan may partially qualify safe branches while preserving blocked, ambiguous, stale, or unauthorized branches as explicit residuals. Any merge must state how partial results, contradictions, missing nodes, and verifier failures affect the downstream acceptance predicate.

The graph contract must also fix cancellation, idempotent retry, fallback, deadline, partial-result, and compensation behavior before execution. A retry of a retrieval node is not equivalent to a retry of a monetary or publication effect. A failed forced route cannot silently relabel the node and proceed. A replan retains the original operation identities, qualification receipts, route proposals, rejected candidates, and changed assumptions so later outcome evaluation can distinguish planning quality from route luck.

This integration strengthens the planned natural multi-planner campaign: it must score DAG validity, argument binding, dependency truth, partial qualification, cancellation and retry correctness, plan provenance, and final outcome separately. The paper contains no executed DAG planner or measured benefit, so the planning core remains at argument.

32.8 Interfaces

Planning consumes a versioned command but cannot reinterpret it. Context and Memory answer typed observation requests. Cognitive Compilation owns semantic lowering. Routing and Stable Capability Fields return eligible routes. Labor OS creates jobs. Runtime and Security decide effects. Verification evaluates outcomes. Resource Economics owns complete cost. Artifact Graphs preserve lineage. Rights and publication owners retain their own approvals. Evidence States alone can move support.

The plan record therefore needs more than nodes and edges. At minimum it binds the contract and epoch; consumer and horizon; alternatives and abstention; typed obligations and dependency semantics; assumptions, observations, predictive-state identities, uncertainty, and staleness; context, route, authority, rights, resource, verifier, fallback, stop, recovery, merge, and utility predicates; lifecycle state; complete attempts and costs; dispatch and replan requests; invalidation closure; outcome receipts; and residuals.

A dispatch request cites the exact node, contract, satisfied dependency and feasibility predicates, context and observations, eligible route, authority and rights requirements, verifier, stop, recovery, and resource state. It is a request to downstream owners, not a job, capability, effect, or completion receipt.

32.9 Invariants

These invariants constrain the planning policy rather than certifying the world. A record may satisfy every field rule while its decomposition or dependency model is wrong. Each predicate therefore needs a producer, an independent-enough falsifier, an observed consumer, and a consequence that can block, narrow, replan, or residualize the affected obligation.

Every plan binds one contract version, consumer, environment, epoch, horizon, authority and rights ceiling, resource account, and support ceiling.
Every obligation is covered by a node, explicit non-planning decision, or owned residual; no node silently adds an objective or means.
Every dependency has typed meaning, provenance, confidence, consumer, and falsifier; acyclicity does not prove truth or completeness.
Assumptions, observations, unknowns, predictive-state versions, uncertainty, staleness, and disagreement remain visible downstream.
Candidate plans, blocked nodes, route requests, review notes, and planner scores are not jobs, authority, effects, or evidence transitions.
Only nodes with current dependency closure, feasible context, eligible route, authority and rights compatibility, resources, verifier, stop, and recovery predicates may request lowering and dispatch.
Planning requests routes but cannot qualify workers or grant authority.
Cheap, parallel, compressed, learned-model, and automated routes retain the same adequacy, verification, utility, recovery, and rights obligations.
All generation, coordination, waiting, evaluator, repair, retry, merge, human, privacy, recovery, opportunity, and governance costs stay attributed.
Replanning preserves contract, authority, rights, stops, residuals, negative knowledge, alternatives, and history or requests re-contract.
Local repair preserves work only after dependency and assumption closure.
Merge gates compare semantics, state, sources, authority, rights, effects, evidence, criteria, costs, and residuals.
Stop, fallback, recovery, rollback-request, compensation, escalation, and residual routes require owners and observed consequences.
Every alternative, failure, block, timeout, retry, replan, discard, merge failure, denial, cost, and residual remains in the denominator.
Scores, simulations, fixtures, theorems, and scheduler optima cannot replace independent outcome evaluation.
Non-dispatch or a shorter critical path is not useful planning, safety, or cost dominance without matched opportunity and outcome denominators.
No planning component may approve its own broader authority, support, deployment, or publication.

32.10 Failure modes

The failure surface includes scope and obligation drift, decomposition theater, dependency hallucination and omission, acyclicity laundering, context and observation fantasy, model-predictive overconfidence, dispatch laundering, capability-tier laundering, scheduler-objective capture, arbitrage laundering, parallelism theater, merge laundering, replanning erasure, repair-radius laundering, plan survivorship, fail-closed planning, and ceremonial stop or recovery.

These failures can coexist in a graph that passes every shape check. A planner may produce an acyclic schedule whose hidden dependency is wrong, select a cheap route whose downstream verifier cannot detect inadequacy, then report a shorter critical path after moving repair and human work outside the ledger. That is a syntactically successful plan and an empirical planning failure.

32.11 Minimum Viable Implementation

The current minimum is a record-and-route scaffold:

plan-graph, PlanForge-DAG, command, job, and semantic-atom schemas;
three valid and ten invalid plan-execution fixtures;
two valid synthetic scheduler traces and seven rejecting mutations;
two valid runtime-replan traces and nine rejecting mutations;
two accepted no_change transitions; and
71 theorem declarations grouped under seven proof targets.

These artifacts exercise exact shapes, declared and actual finite edge order, bounded dependency paths and cycle exclusion, lifecycle and dispatch branches, authority and stop preservation, graph/artifact binding, local-repair scope, cost-ledger fields, a lossy graph-summary collision, complete graph transport, digests, and no-promotion boundaries. They contain no planner-generated natural plan, independent decomposition oracle, measured dependency truth or edge completeness, context-demand prediction, selected-tier adequacy, live scheduler, observed replan benefit, or support movement.

The next honest minimum is a prospectively frozen natural planning campaign with multiple planner and model families; human-authored, direct, and strong algorithmic or workflow baselines; hidden obligations and perturbations; complete alternative denominators; independent semantic, dependency, feasibility, and outcome evaluators; observed cost and feedback; effect-tested stop and recovery; causal ablations; clean reproduction; and transfer.

32.12 Mature Research Target

A mature planning control plane is a measured policy for obligation scheduling under uncertainty, not a diagram generator. On prospectively sampled natural tasks it compares no-plan/direct, single-pass, search/tree, HTN/PDDL/workflow, human-authored, learned-model/MPC where applicable, and the full governed policy under matched models, tools, information, authority, rights, resources, and horizons.

Independent implementations score obligation coverage, semantic preservation, dependency precision and recall, feasibility, context and observation calibration, plan stability, route adequacy, merge validity, useful critical path and completion outcomes, unsafe actions, abstention and missed help, delayed effects, rights and privacy, recovery completeness, latency, compute, coordination, human work, and total governance cost.

Adversaries inject hidden dependencies, stale state, conflicting sources, authority and rights traps, evaluator gaming, shared bottlenecks, replan shocks, merge conflicts, and recovery failures. Causal ablations test each mechanism; replications span planners, models, tasks, languages, modalities, environments, organizations, jurisdictions, threats, horizons, and time. Promotion requires predicted causal signatures, nonzero useful opportunity, strong matched baselines, independent evaluation, reproducible raw traces, effect-bearing controls, transfer, and an accepted claim-specific transition.

The governed policy advances only when its useful outcomes remain positive after all abstentions, missed help, discarded alternatives, repairs, and governance costs are restored to the denominator.

No current result meets this governed-planning endpoint; support remains argument until useful natural plans, effect-bearing controls, independent evaluation, causal ablations, reproduction, and transfer pass.

32.13 Codex test plan

Test	Purpose	Status
Plan graph fixture validation	Check that the plan-graph fixture matches the public schema and declares assumptions, nodes, dependencies, context, tools, authority budget, risk and compute budgets, verification, replanning history, stop conditions, lifecycle states, dispatch receipts, residuals, non-claims, and dispatch state.	implemented by protocol validation; validated locally
Authority inheritance finite-record proof	Check that a modeled plan node inherits the parent contract authority ceiling unless governance lowers it.	implemented in `AsiStackProofs.Planning`; runtime replanning test not run
Unsatisfied-constraint finite-record proof	Check that a modeled plan node with unsatisfied required constraints cannot dispatch.	implemented in `AsiStackProofs.Planning`; runtime planner not run
Plan-control record proof envelope	Check that a modeled dispatchable plan carries command validation, constraints, stop conditions, context requirements, a verification plan, no blocked nodes, a dispatch receipt, and authority within the parent ceiling; check that modeled blocked and replanned states preserve the expected receipt and residual boundaries.	implemented in `AsiStackProofs.Planning`; planner quality and runtime replanning traces not run
Plan-control dispatch route proof	Check that a modeled valid dispatchable plan routes through the finite `PlanControlRouteFor` decision to `allowDispatch` only after the required command, constraint, stop-condition, context, verification, receipt, and no-blocked-node gates hold.	implemented in `AsiStackProofs.Planning`; route-quality, scheduler, and runtime dispatch traces not run
Plan-graph admission lifecycle route proof	Check that a modeled plan graph admission routes missing command-contract acceptance, decomposition, acyclicity, dependency order, authority inheritance, context demand, adequacy contract, verification plan, dispatch gate, dispatch receipt, replanning controls, residual register, and non-claim boundary to explicit outcomes before admission.	implemented in `AsiStackProofs.Planning`; finite record routing only, not planner quality, scheduler behavior, selected-tier adequacy, or deployed replanning
Reachable planning lifecycle and vertical-refinement proof	Check arbitrary finite accepted runs for authority, ready-before-job, feedback-before-replan, version, stop-condition, dispatch, and residual invariants; exercise one complete replan witness and rejecting transition controls; refine admitted-plan and lowered-job events into the intent-to-execution vertical model; require exact graph/artifact binding and executable graph verification for graph-bound admission.	implemented in `AsiStackProofs.Planning`; 21 lifecycle and five graph-bound admission declarations compile and are required by the scheduler/replan consumers; no planner-quality, dependency-truth/completeness, route-adequacy, deployed-scheduler, causal-benefit, or support-promotion claim
Decomposition accuracy test	Check whether plan nodes preserve the accepted command objective and constraints.	planned; not run
Dependency ordering test	Check whether dependencies precede dependents before dispatch.	implemented in `python3 scripts/validate_plan_execution_contracts.py`; synthetic graph fixtures only
Context-demand prediction test	Check whether each node declares needed context before execution.	planned; not run
Runtime replanning test	Check whether replanning preserves authority, stop conditions, and residual history.	planned; not run
Dispatch-state enforcement test	Check that only `dispatchable` nodes can lower into typed jobs and blocked/proposed nodes remain residuals or review items.	planned; not run
Replanning-delta audit	Check that replanning records changed assumptions, authority basis, context, verification, stop conditions, and residuals.	planned; not run
Planning scheduler-state probe	Check synthetic scheduler states plus actual finite PlanForge edge verification, dependency reachability, graph-summary information loss, complete graph transport, and graph-bound planning admission.	implemented by `python3 scripts/validate_planning_scheduler_state_probe.py`, with result `experiments/planning_scheduler_state/results/2026-07-02-local.json`: two valid scheduler traces, seven expected-invalid controls, one valid and three rejected graph cases, five reachable dependency pairs without a cycle, one thin-summary admission collision, 12/12 complete graph-transport mutation rejections, and exact recompilation of 53 Planning plus 18 PlanForge declarations; accepted no-promotion decision unchanged; no decomposition-quality, dependency-truth/completeness, context-demand-prediction, selected-tier-adequacy, route-quality, scheduler-optimality, deployed scheduler/replanning, support-state-promotion, or upward evidence-transition claim
Planning runtime-replan delta audit	Check that synthetic runtime replans preserve authority and stop conditions, stay inside the affected subgraph, record context and verification deltas, keep residual ownership, block authority-denied dispatch, and preserve no-promotion boundaries.	implemented by `python3 scripts/validate_planning_runtime_replan_delta.py`, with result `experiments/planning_runtime_replan_delta/results/2026-07-02-local.json`, two valid synthetic runtime-replan traces, and nine expected-invalid controls; no deployed-planner, runtime-scheduler, decomposition-quality, route-quality, selected-tier-adequacy, live-feedback-handling, support-state-promotion, or upward evidence-transition claim
DAG acyclicity test	Check actual finite PlanForge edges for bounds and strict topological order, derive increasing dependency paths and cycle exclusion, and reject self, reverse, out-of-bounds, summary-collision, and artifact-mismatch controls.	implemented in `AsiStackProofs.PlanForge`, the graph-bound `AsiStackProofs.Planning` bridge, and `python3 scripts/validate_planning_scheduler_state_probe.py`; no dependency-truth/completeness or deployed-scheduler claim
Capability tier assignment test	Check that each node has a minimum adequate tier, route assignment, and verification burden.	planned; not run
Escalation trigger test	Check that failed quality predicates route to escalation or residuals.	implemented in `AsiStackProofs.PlanForge`; builds locally

The fixture-shape check, finite route predicates, reachable Planning lifecycle, vertical-refinement bridge, graph-bound admission bridge, and synthetic consumers now cover modeled dispatch gates, authority and stop preservation across arbitrary accepted finite runs, ready-before-job and feedback-before-replan ordering, exact version/residual accounting, blocked-plan receipt separation, actual finite edge bounds and strict topological order, increasing dependency paths and cycle exclusion, nonvacuous and rejecting graph witnesses, thin-summary information loss, complete graph transport, failed-quality fallback, scheduler-state boundaries, and runtime-replan delta shape. Decomposition quality, dependency truth and edge completeness, context-demand prediction, selected-tier adequacy, route quality, live feedback handling, deployed scheduling/replanning, causal benefit, and support-state movement still require a natural planner harness and Project Theseus system evidence.

32.13.1 Formalization hooks

Tag	Module	Target	Status
`lean:planning.control_layer.operational_invariant`	`AsiStackProofs.Planning`	A plan node inherits the authority ceiling of its parent contract unless governance lowers it.	implemented
`lean:planning.control_layer.failure_blocks_promotion`	`AsiStackProofs.Planning`	A plan with unsatisfied required constraints cannot be dispatched.	implemented
`lean:planning.control_layer.plan_graph_admission_route`	`AsiStackProofs.Planning`	Modeled plan-graph admission routes missing command-contract acceptance, decomposition, acyclicity, dependency order, authority inheritance, context demand, adequacy contracts, verification plans, dispatch gates, dispatch receipts, replanning controls, residual registers, and non-claim boundaries to explicit outcomes.	implemented
`lean:planning.scheduler_state.probe_fixture_bridge`	`AsiStackProofs.Planning`	An independent finite scheduler-state consumer validates scheduler and local-repair traces, actual-edge PlanForge graph decisions and transports, and rejecting controls; graph-bound admission requires both lifecycle admissibility and an exact verified graph artifact before applying the planning transition.	implemented
`lean:planning.runtime_replan.delta_audit_bridge`	`AsiStackProofs.Planning`	An independent finite runtime-replan consumer validates local-repair and blocked-authority traces plus rejecting controls, while the retained Lean delta route family rejects authority widening, stop erasure, and blocked-authority dispatch and accepts a complete bounded audit.	implemented
`lean:planforge.dag.operational_invariant`	`AsiStackProofs.PlanForge`	An executable finite plan graph verifies node bounds and strict topological order over its actual edge list; every dependency path strictly increases and therefore cannot cycle. A five-field summary has a valid/invalid admission collision that no exact summary-only classifier can recover, while the complete edge-carrying transport round-trips, is injective, and preserves admission.	implemented
`lean:planforge.dag.failure_blocks_promotion`	`AsiStackProofs.PlanForge`	A node whose quality predicate fails must escalate or emit a residual.	implemented

The seven targets group 71 theorem declarations across the 53-declaration AsiStackProofs.Planning and 18-declaration AsiStackProofs.PlanForge modules. Their useful content now includes a 21-result reachable planning lifecycle in addition to finite consequence and branch coverage over trusted records. The lifecycle proves arbitrary-run authority, ordering, version, stop, dispatch, and residual invariants; a complete scoped-replan witness; rejecting countermodels; denial noninterference; and two transitions that refine the independently owned intent-to-execution vertical model. The two former valid-summary projections are retired, and the independently implemented scheduler and replan consumers now bind to retained admission and delta route families. PlanForge now verifies bounds and strict order over the actual finite edge list, proves every dependency path strictly increases and excludes cycles, and supplies a reachable diamond graph plus self, reverse, and out-of-bounds rejections. A five-field graph summary admits a valid/invalid collision that no exact summary classifier can recover; the complete edge-carrying transport round-trips, is injective, and preserves admission. Five Planning theorems bind that verifier and exact graph artifact to the lifecycle admission step. The models still trust authored decomposition, edge completeness and meaning, context, adequacy, route, receipt, authority, stop, and residual fields. The proof excludes cycles for this complete listed-edge representation; it does not establish missing-edge absence or semantic dependency truth. These are mechanized control semantics, not evidence of decomposition coverage, semantic dependency validity, context prediction, route adequacy, scheduler optimality, live feedback benefit, cost dominance, safe model-predictive control, or deployed replanning. Stronger graph semantics, executable planner producers, observed outcomes, causal comparison, deployment, reproduction, and transfer remain Project Theseus or empirical obligations.

These targets do not prove planning correctness, dependency truth, useful scheduling, safe control, or deployed runtime behavior.

32.14 Predictive state and model-predictive control

Task-graph planning and learned world-model planning are complementary. A task DAG says which obligations depend on which artifacts. A predictive model says how an observed state may change under candidate actions. ext_v_jepa_2_2025 provides a concrete comparator: action-free video pretraining supplies a latent representation, a smaller action-conditioned predictor estimates future representations, and model-predictive control repeatedly scores candidate action sequences and replans from new observations.

The plan node must therefore name the observation and world-model versions, predictor and representation identities, action space, horizon, candidate search budget, prediction-error ledger, uncertainty or disagreement, replanning trigger, controller fallback, and sim-to-real boundary. A low predicted cost is not execution authority. Camera sensitivity, accumulated prediction error, exponential action search, image-goal assumptions, and representation limits remain explicit residuals. Adoption requires a matched baseline, intervention tests, calibration, cost accounting, and safe fallback; the cited robot results do not establish local control quality or safety.

32.14.1 A finite world-model control result

Campaign 5 turns a narrow part of this interface into executable evidence. A prospectively frozen count-table agent ran 11,250 matched episodes across an adaptive-workshop simulator and a meaningfully different service-mesh simulator. The 6,000 held-out episodes separated reference state, delivered observation, interpretation, belief, prediction, intervention, prediction error, observed effect, and consolidation. Reference state scored the run but never entered the agent input.

The governed arm reached hidden-state accuracy 0.7933 in the workshop and 0.7967 in the service mesh, versus 0.4500 and 0.4067 for the reactive arm. Its unsafe-action rates were 0.1000 and 0.1133, versus 0.2333 and 0.2733 for the ungoverned predictive arm. That safety improvement was not free: task success was lower than the ungoverned predictive arm by 0.0233 and 0.0300 because the governed path escalated uncertain cases.

The causal packet matters more than the headline. Removing the uncertainty gate raised unsafe action in both environments; removing intervention or consolidation reduced accuracy in both; merging observation into belief worsened Brier score in both. Active information gathering was heterogeneous: slightly harmful in the workshop and helpful in the service mesh. Shift detection remained only 0.1667 and 0.2200. Planning should therefore consume a world-model interface as fallible state estimation with explicit uncertainty, intervention cost, escalation, and shift residuals—not as a learned oracle.

The accepted transition is the non-core claim situated-world-model.finite-pomdp-governed-acquisition-and-consolidation at synthetic-test-backed. The full receipt is docs/p4_situated_world_model_campaign.md. The planning-control core remains at argument: two authored finite simulators do not establish a neural world model, natural-task planning, general causal understanding, safe model- predictive control, or transfer beyond the declared interface.

32.14.2 Branch-protected action semantics

The Platonic World Model supplies the semantic contract around predictive planning. An Action Form declares actor and target roles, preconditions, effects, explicit non-effects, authority, observability, reversibility, cost, failure modes, and grounding implementation. Transition models may be symbolic, causal, probabilistic, neural, simulated, or hybrid, but each declares its state vocabulary, applicable contexts, intervention semantics, uncertainty, validation evidence, cost, and conflict policy.

Plans execute only in a branch until an observation or authorized action event promotes a state change into actuality. A counterfactual receipt preserves the baseline, intervention, held-fixed assumptions, selected causal model, semantic basis, branch, outcome comparison, and limitations. Model disagreement remains visible rather than being averaged into a single confident state. The paper’s laboratory-access trace demonstrates the intended object flow only; it is not executed planning evidence.

32.15 Source crosswalk

Source ID	Title	Layer	Planned use	Readiness
`reflexive_router_whitepaper`	The Reflexive Router	pre_deliberative_reflexive_routing_control_plane	Bounded semantic-operation DAGs, node-local qualification, mixed capability routes, partial results, explicit retry/cancellation/fallback semantics, and plan provenance.	source note available
`planforge`	PlanForge	planning_control	Planning substrate. Goal-to-execution compilation, hierarchical decomposition, DAG planning, scheduling, intelligence arbitrage.	source note available; local raw cache available
`viea`	Verified Intent-to-Execution Architecture	whole_stack_execution_spine	Keystone source. Human intent -> command contracts -> artifacts -> routing -> runtime targets -> verification -> deployment -> feedback.	source note available; local raw cache available
`cognitive_compilation`	Cognitive Compilation	planning_semantic_ir	Compiler framing for LLM-centered planning, semantic IR, target compilation, incremental repair.	source note available; local raw cache available
`software_magic_grimoire`	Software Magic Grimoire	command_contracts_promptcraft	Structured command contracts and semantic density of software words.	source note available; local raw cache available
`moecot`	MoECOT-Agent Architecture Whitepaper	implementation_reference	Concrete implementation evidence: governed low-parameter multi-core runtime, readiness gates, ledgers, replay.	source note available; connector or recovery required
`planforge_compiler_arch`	PlanForge: A Compiler Architecture for AI Task Orchestration	planning_control	Later/alternate PlanForge framing around task graphs, typed primitives, model/tool routing, quality gates, parallelism, and critical-path scheduling.	source note available; local raw cache available
`coherence_exchange`	The Coherence Exchange	epistemic_market_synthesis	Speculative intelligence-arbitrage and coherence/liquidity framing; use only as architecture vocabulary.	source note available; connector or recovery required
`tokenmana`	TokenMana	resource_economics	Regenerative capacity and broader budget vocabulary for load, latency, review capacity, burst control, and human cognitive friction.	source note available; local raw cache available
`ext_v_jepa_2_2025`	V-JEPA 2	predictive_planning_comparator	Latent prediction and model-predictive replanning comparator with explicit error, horizon, action-search, camera, and sim-to-real limits.	source note available

All nine assigned sources are mapped and reviewed at their available evidence level. The core claim stays at argument because no natural planner campaign, independent decomposition or dependency evaluator, selected-tier adequacy test, context-demand test, live scheduler, observed replan benefit, cost-quality result, or reproduced predictive-control result is recorded.

32.15.1 Manifest source assignment reconciliation

These rows keep Planning as a Control Layer: DAGs and Intelligence Arbitrage’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
`platonic_world_model`	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
`regret_engine`	Passage-reviewed Corben architecture source: The Regret Engine: Governed Counterfactual Learning Signals for Continual Adaptation, Prospective Risk Control, and Self-Correction in Artificial Agents. Corben-authored August 2026 conceptual architecture and research program for decision-time-fair Governed Counterfactual Regret, immutable Decision Capsules, admissible comparator contracts, sparse Regret Tensors, append-only Regret Packets, prospective regret control, regret-aware replay, regret-to-rule compilation, three update clocks, root-cause adjudication, and bounded update leases. Existing chapters are upgraded first; no implementation, experiment, reproduction, causal-identification result, formal proof, safety result, support transition, SOTA, AGI, or ASI is inferred.	The bibliography and Markdown figure companions were not supplied; the DOCX embeds its visual material. All propositions, algorithms, experiments, and architecture claims remain proposed rather than independently validated. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.

32.16 Summary

Planning owns the prospective choice and revision of obligation order under uncertainty. Its output is not merely a DAG, but a versioned policy over alternatives, dependencies, observations, feasibility, route requirements, resources, lifecycle, dispatch, merge, stop, recovery, replan, costs, and residuals.

The present fixtures and Lean modules show how selected synthetic records route and fail. They do not show that a planner finds good decompositions, true dependencies, adequate routes, useful schedules, or beneficial replans. Those claims remain open until natural workloads, strong matched baselines, independent evaluators, effect-bearing controls, complete denominators, causal ablations, reproduction, and transfer produce claim-specific evidence.

Until then, planning remains a falsifiable control proposal whose present value is clearer boundaries and better tests, not demonstrated planning superiority.

Its immediate contribution is an auditable handoff whose failures, repairs, abstentions, and downstream effects remain attributable.

32.17 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the planning-as-a-control-layer slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains blocked after full attempt at argument support. The strongest family attempt was Intent-to-execution vertical refinement. Its exact boundary is: Structured local scenarios only; no natural-language semantic sufficiency, production backend, transfer, or deployment claim. Across 76 atoms, the terminal ledger records 76 blocked_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	`CF-03` / 76 atoms
Terminal dispositions	76 `blocked_after_full_attempt`
Core	`planning-as-a-control-layer.core`: `blocked_after_full_attempt` at `argument`
Core attempted / missing lanes	`source-synthesis` / `causal`, `empirical`, `executable`, `formal`, `normative`, `transfer`
Attempted local lanes	`source-synthesis`
Missing or unproved lanes	`causal`, `empirical`, `executable`, `formal`, `normative`, `transfer`
Strongest family bundle	Intent-to-execution vertical refinement (`end_to_end`): Nine versioned scenarios and 89 events from governed intake through six observed local effects and terminal outcomes.
Negative controls	pre-effect refusal; failed rollback quarantine; 30 rejecting mutations.
Accepted transitions	`v1_0_pilot.planning_control.no_change`
Maximum inference	Structured local scenarios only; no natural-language semantic sufficiency, production backend, transfer, or deployment claim.
Reproduction / next burden	Replay `scripts/validate_intent_execution_vertical_refinement.py` and `scripts/validate_claim_family_terminal_program.py`; fill the named atom-specific lanes under a new prospective protocol.

32.18 Handoff

DAG scheduling gives work an order, route, and budget, but it can still plan against a stale or self-confirming picture of the environment. Governed World Models and Reality Grounding receives plan-relevant observations, hypotheses, counterfactual queries, and uncertainty obligations and returns versioned qualified branch packets, discrepancy, correction, and action-grounding gates. The packet may influence planning only within its model, observation, horizon, calibration, disagreement, and authority ceiling; it is not evidence that the predicted world is true and cannot authorize an effect. Only after that reality boundary is explicit does Cognitive Compilation and Semantic IR lower the surviving plan obligations into checkable artifact form.