The flight was ticketed. Then the hotel rate expired. The agent said "You're all set!" The traveler had no room. That failure isn't a model-IQ problem. A rate expiring between two API calls is an infrastructure event; a smarter model still strands the traveler if nothing voids the ticket. So we took the LLM out of the control flow. The flow is deterministic Python; the model only parses the request and words the reply. Agents advise, code decides. What separates a demo from a product is the partial failure. Every forward step registers its own undo the moment it runs, so ticketing a flight also registers "void ticket, 24-hour window." When the hotel step fails after the ticket issues, the engine runs those compensations in reverse (a Saga), voids the ticket inside the window, and hands the traveler honest alternatives instead of a flight to nowhere. We ran it beside a real LLM-in-control agent on the same scenarios. Over a fixed-seed 200-scenario synthetic batch: 0 stranded travelers on our side, 40 on the baseline. These are simulated bookings over a stubbed GDS, not live inventory. One question worth asking of any booking agent you're evaluating: when it tickets a flight and the next step fails, what actually voids the ticket? Or does the traveler find out at the airport? #TravelTech #AgenticAI #TMC #AIGovernance