Ario – a bounded agent runtime where a local PASS cannot become global truth