A request to send a draft ends in awaiting_human_action. A request to delete a booking is rejected because no such tool is allowed. A retrieved note asking for record disclosure remains untrusted content and cannot extend the dispatcher allowlist.

Critical check: No unapproved external action occurs, and untrusted retrieved text cannot add a tool or permission.

Final project: Submit the tool contract, state diagram, runnable simulator, event logs and scenario results. Add a failing search result and demonstrate a safe terminal outcome within the step budget.