... catching it at the decision point rather than in the post-mortem. The moment the agent goes from "task A" to "I'll refactor this config to fix a missing dependency," that's a scope expansion, and a scope expansion