Your most expensive operational
gap is what happens when
nobody's watching.

// LOOP SHIELD: From Step 4 onward, if tools appear in two consecutive
// steps, it's a cognitive loop. Tracks tool presence, not identity.
// Threshold is 4 because steps 1-3 are permitted critical transitions.
if (stepNumber >= 4) {
  const prevStepHadTools = (steps[stepNumber - 1]?.toolCalls?.length ?? 0) > 0;
  const prevPrevStepHadTools = (steps[stepNumber - 2]?.toolCalls?.length ?? 0) > 0;
  if (prevStepHadTools && prevPrevStepHadTools) {
    return { toolChoice: 'none' };
  }
}

// If gate advanced to GATE_SCHEDULE or GATE_IDENTITY and transaction
// tools are not yet registered, inject them.
if (
  (freshGate === 'GATE_SCHEDULE' || freshGate === 'GATE_IDENTITY') &&
  !allowedTools['reservar_cita_sota']
) {
  allowedTools['revisar_disponibilidad_sota'] = buildRevisarDisponibilidadTool(
    identityContext.org_id,
    identityContext.contact_id,
    identityContext.min_hours_notice
  );
  allowedTools['reservar_cita_sota'] = buildReservarCitaTool(
    identityContext.org_id,
    identityContext.contact_id,
    freshInterestId,
    freshName,
    freshDni,
    dbMeta.resolvedDeposit || '0',
    identityContext.bank_details_text,
    identityContext.min_hours_notice,
    activeOptionsArr
  );
}

public class JwtRefreshMiddleware
{
    private readonly RequestDelegate _next;

    public JwtRefreshMiddleware(RequestDelegate next) => _next = next;

    public async Task InvokeAsync(HttpContext context)
    {
        var accessToken = context.Request.Headers["Authorization"]
            .FirstOrDefault()?.Replace("Bearer ", "");

        if (accessToken is null)
        {
            await _next(context);
            return;
        }

        try
        {
            var principal = ValidateToken(accessToken);
            context.User = principal;
        }
        catch (SecurityTokenExpiredException)
        {
            var refreshToken = context.Request.Cookies["refresh_token"];
            if (refreshToken is null)
            {
                context.Response.StatusCode = 401;
                return;
            }

            var newAccessToken = await RotateRefreshToken(refreshToken);
            context.Response.Cookies.Append("refresh_token",
                newAccessToken.RefreshToken,
                new CookieOptions
                {
                    HttpOnly = true,
                    Secure = true,
                    SameSite = SameSiteMode.Strict
                });

            context.Request.Headers["Authorization"] =
                $"Bearer {newAccessToken.AccessToken}";
            context.User = ValidateToken(newAccessToken.AccessToken);
        }

        await _next(context);
    }
}

CREATE PROCEDURE usp_GenerateLeadReport
    @StartDate DATE,
    @EndDate DATE
AS
BEGIN
    SELECT
        ClientName,
        Status,
        DATEDIFF(MINUTE, CreatedAt, ClosedAt)
            AS ProcessingTime
    FROM Leads
    WHERE CreatedAt BETWEEN @StartDate AND @EndDate
    ORDER BY CreatedAt DESC
END