Diagnosis Is Not Prescription: Linguistic Co-Adaptation Explains Patching Hazards in LLM Pipelines

# Diagnosis Is Not Prescription: Linguistic Co-Adaptation Explains Patching Hazards in LLM Pipelines
Source: [https://arxiv.org/html/2605.21958](https://arxiv.org/html/2605.21958)
Jeonghun Yoon1,2Dongchan Kim3 1KAIST \(Korea Advanced Institute of Science and Technology\), Republic of Korea 2NAVER Corp\., Seongnam, Republic of Korea3NAVER Corp\., Bellevue, WA, USA jeonghun\.yoon@kaist\.ac\.krhomer\.yoon@navercorp\.com dongchan\.usa@gmail\.com

###### Abstract

When a multi\-module LLM agent fails, the module most responsible for the failure is not necessarily the best place to intervene\. We demonstrate thisDiagnostic Paradoxempirically: causal analysis consistently identifies the*routing module*— which selects which tool to call next — as the primary bottleneck across three independent agent families\. Yet injecting prompt\-level correction examples into this module consistently degrades performance, sometimes severely\. Patching an upstream*query\-rewriting module*instead reliably improves outcomes\. The effect holds with statistical significance on two agent families and directional consistency on a third; alternative repair strategies at the routing module \(instruction rewriting, model upgrade\) are neutral, confirming that the harm is specific to correction\-injection patching\.

We explain this asymmetry through theLinguistic Contracthypothesis: each downstream module implicitly adapts to its upstream’s characteristic error distribution, so correcting the bottleneck breaks this implicit alignment in a way that upstream corrections do not\. We operationalize this via a per\-agent co\-adaptation measure, derived from diagnosis alone, and show it is consistently associated with patching harm across agent families: higher co\-adaptation co\-occurs with harm, lower with safety\. This trend holds across all three agent families, providing preliminary support for the hypothesis beyond a single\-agent observation\.

Diagnosis Is Not Prescription: Linguistic Co\-Adaptation Explains Patching Hazards in LLM Pipelines

Jeonghun Yoon1,2††thanks:Corresponding author\.Dongchan Kim31KAIST \(Korea Advanced Institute of Science and Technology\), Republic of Korea2NAVER Corp\., Seongnam, Republic of Korea3NAVER Corp\., Bellevue, WA, USAjeonghun\.yoon@kaist\.ac\.krhomer\.yoon@navercorp\.comdongchan\.usa@gmail\.com

![Refer to caption](https://arxiv.org/html/2605.21958v1/x1.png)Figure 1:Diagnosis Is Not Prescription\.Blue \(Δ​Fi¯\\overline\{\\Delta F\_\{i\}\}\): causal contribution of each module on the diagnosis set—the routing module \(M3M\_\{3\}\) peaks\. Red \(−ΔCCP​@​Mi\-\\Delta\_\{\\mathrm\{CCP\}\\,@\\,M\_\{i\}\}\): performance change from patching each module—negative atM3M\_\{3\}\(harm\), positive atM1M\_\{1\}\(improvement\)\. The primary statistically robust finding is theM1M\_\{1\}\-vs\.\-M3M\_\{3\}contrast \(p<0\.01p\{<\}0\.01, Holm\-corrected\);M1M\_\{1\}’s standalone improvement does not survive correction \(p=0\.086p\{=\}0\.086\)\.## 1Introduction

Modern LLM agents chain multiple NLP modules in sequence: a query rewriter clarifies the user’s intent, a planner decomposes it into steps, a router selects the appropriate tool, and a response generator produces the final reply\(Khattab et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib2); Yao et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib13); Shinn et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib8); Yao et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib12)\)\. Each module is an LLM call, and their sequential arrangement introduces a critical challenge: when the agent fails, the failure could originate anywhere in the chain—and the optimal place to intervene may not be where the failure originates\.

Existing approaches—end\-to\-end optimizers\(Yuksekgonul et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib14); Cheng et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib1)\)and process reward models\(Lightman et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib3)\)—treat diagnosis and prescription as equivalent\. We show they are not\.

We study this across three independent base agents using causal intervention analysis and discover theDiagnostic Paradox\(Figure[1](https://arxiv.org/html/2605.21958#S0.F1)\): the Router module, which causes the most failures, is the worst place to apply a prompt\-level correction\. Patching it consistently degrades performance, while patching the upstream Query Rewriter helps\. The effect is robust—statistically significant on two agents and directionally consistent on a third\.

We explain this through theLinguistic Contracthypothesis: downstream NLP modules implicitly adapt to their upstream’s output distribution, including its characteristic errors\. Correcting the diagnosed bottleneck changes this distribution in a way downstream modules cannot recover from, while upstream corrections propagate through co\-adapted chains more gracefully\. We operationalize Contract strength via a measurable per\-task quantity and show it exhibits a consistent trend with patching Hazard across all three agent families\.

We study a four\-module pipeline onτ\\tau\-bench retail\(Yao et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib12)\):M1M\_\{1\}\(query rewrite\)→\\toM2M\_\{2\}\(planner\)→\\toM3M\_\{3\}\(router\)→\\toM4M\_\{4\}\(response generator\)\. Formal definitions are in App\.[A](https://arxiv.org/html/2605.21958#A1)\.

Contributions:

- •Diagnostic Paradox:through causal intervention experiments on a multi\-module LLM pipeline, we find the diagnosed bottleneck is the worst correction\-patch target; upstream modules are more effective\. Demonstrated across three agent families \(two with significance, one directional\)\.
- •Linguistic Contract:downstream modules co\-adapt to upstream error distributions; a diagnostic measure of this co\-adaptation shows a consistent trend with patching Hazard across all three agent families\.

## 2Related Work

Pipeline debugging in NLP has historically relied on component\-wise analysis and error propagation studies\(Khattab et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib2); Shinn et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib8)\)\. End\-to\-end optimizers such as TextGrad\(Yuksekgonul et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib14)\)and TRACE\(Cheng et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib1)\)improve overall pipeline performance but do not separate*where blame lies*from*where to intervene*\. Process reward models\(Lightman et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib3)\)localize step\-level errors but require costly human annotation\. Our work fills this gap with a causal framework operating at the LLM\-call level\.

Causal mediation analysis\(Pearl,[2009](https://arxiv.org/html/2605.21958#bib.bib6),[2014](https://arxiv.org/html/2605.21958#bib.bib7)\)has been applied inside single models at the neuron and attention\-head level\(Vig et al\.,[2020](https://arxiv.org/html/2605.21958#bib.bib10); Stolfo et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib9)\)to understand how linguistic information flows\. We apply the same principle one level up—across full LLM module calls in a pipeline—and discover that the module\-level co\-adaptation dynamics produce counter\-intuitive repair properties not visible at the token level\. CCP differs from iterative self\-refinement\(Madaan et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib5)\)and prompt optimization\(Yang et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib11); Zhou et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib15)\)by reusing causally curated correction triples with no additional inference\. The cross\-family agent/oracle/judge design prevents LLM\-judge self\-correlation\(Liu et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib4)\)\.

## 3Method: CICA and the Linguistic Contract

CICA \(*Causal Intervention\-based Analysis*\) comprises four layers: failure indexFF\(§[3\.1](https://arxiv.org/html/2605.21958#S3.SS1)\), causal contributionΔ​Fi\\Delta F\_\{i\}\(§[3\.2](https://arxiv.org/html/2605.21958#S3.SS2)\), per\-task fates viaNIEi\\mathrm\{NIE\}\_\{i\}\(§[3\.3](https://arxiv.org/html/2605.21958#S3.SS3)\), and CCP with module\-normalized routing \(§[3\.4](https://arxiv.org/html/2605.21958#S3.SS4)\), connected by the Linguistic Contract \(§[3\.5](https://arxiv.org/html/2605.21958#S3.SS5)\)\.

### 3\.1Failure IndexFF: System\-Level Symptom

An LLM judge scores per\-module severitiessevi∈\[0,1\)\\mathrm\{sev\}\_\{i\}\\in\[0,1\); the failure index aggregates them:

F​\(E\)=−∑i=1klog⁡\(1−sevi\)\.F\(E\)=\-\\sum\_\{i=1\}^\{k\}\\log\\\!\\bigl\(1\-\\mathrm\{sev\}\_\{i\}\\bigr\)\.\(1\)Every prescription configuration aims to reduceF¯\\overline\{F\}on𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}\. NegativeΔ=Fpatched−Fbase\\Delta\{=\}F\_\{\\mathrm\{patched\}\}\-F\_\{\\mathrm\{base\}\}indicates improvement\. Intuitively, lowerFFmeans the agent behaved better: when the agent selects the correct first action,F¯=1\.87\\bar\{F\}\{=\}1\.87; when it does not,F¯=4\.69\\bar\{F\}\{=\}4\.69\(gap2\.812\.81\)\.111Pearsonr=−0\.90r\{=\}\{\-\}0\.90\(p<10−40p\{<\}10^\{\-40\}\) and Spearmanρ=−0\.83\\rho\{=\}\{\-\}0\.83between per\-taskFFand first\-action tool\-name match on the prescription baseline \(np=111n\_\{p\}\{=\}111\); App\.[M](https://arxiv.org/html/2605.21958#A13)\.FFthus reflects behavioral outcomes, not merely internal judge scores\.

### 3\.2Causal ContributionΔ​Fi\\Delta F\_\{i\}: Locating the Failure Origin

We replaceMiM\_\{i\}’s output with oracleSi∗S^\{\*\}\_\{i\}and re\-execute:

Δ​Fi=F​\(E\)−F​\(E∣do​\(Mi=Si∗\)\)\.\\Delta F\_\{i\}=F\(E\)\-F\\bigl\(E\\mid\\mathrm\{do\}\(M\_\{i\}=S^\{\*\}\_\{i\}\)\\bigr\)\.\(2\)LargerΔ​Fi\\Delta F\_\{i\}meansMiM\_\{i\}is more causally responsible\. The population diagnostic targetipop⋆=arg⁡maxi⁡Δ​Fi¯i^\{\\star\}\_\{\\mathrm\{pop\}\}=\\arg\\max\_\{i\}\\overline\{\\Delta F\_\{i\}\}\(where the bar denotes the mean ofΔ​Fi​\(c\)\\Delta F\_\{i\}\(c\)overc∈𝒟diagc\\in\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\) drives the matched Population\-level CCP \(Pop CCP\) measurement that exposes the Diagnostic Paradox \(§[4\.3](https://arxiv.org/html/2605.21958#S4.SS3)\)\.

### 3\.3Per\-task Fates: Natural Indirect EffectNIEi\\mathrm\{NIE\}\_\{i\}

NIEi\\mathrm\{NIE\}\_\{i\}isolates the upstream\-cleanup effect flowing*through*MiM\_\{i\}: two worlds share oracle\-clean upstream but differ in whetherMiM\_\{i\}re\-executes or is frozen at baseline \(App\.[B](https://arxiv.org/html/2605.21958#A2)\)\. With thresholdτ=0\.05\\tau\{=\}0\.05, each \(module, task\) pair is acompensator\(NIEi<−τ\\mathrm\{NIE\}\_\{i\}\{<\}\{\-\}\\tau: downstream absorbs upstream noise\),amplifier\(NIEi\>\+τ\\mathrm\{NIE\}\_\{i\}\{\>\}\{\+\}\\tau: it amplifies\), orpropagator\(neutral\)\. The fraction of compensator tasks atM3M\_\{3\}is our proxy for*Contract strength*\(§[3\.5](https://arxiv.org/html/2605.21958#S3.SS5)\)\.

### 3\.4Non\-destructive Repair: CCP

CCP appendsk=5k\{=\}5severity\-ranked correction triples\(input,wrong,oracle\)\(\\text\{input\},\\text\{wrong\},\\text\{oracle\}\)from𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}to the target module’s prompt, with frozen instructions and output schema\. Downstream modules thus see outputs from the same distributional family as baseline— distinguishing CCP from rewriting, which alters instructions and triggers a different downstream cascade\. Details in App\.[C](https://arxiv.org/html/2605.21958#A3)\. An adaptivezz\-score routing variant normalizes per\-module NIE heterogeneity \(App\.[D](https://arxiv.org/html/2605.21958#A4)\)\.

### 3\.5The Linguistic Contract Hypothesis

We name the theoretical structure that connects all four CICA layers\. Each downstream module implicitly adapts to its upstream’s output distribution—including its characteristic errors—developing compensation behaviors we call theLinguistic Contract\. This is not a formal agreement but an emergent property: modules trained or prompted on a given upstream become sensitive to its specific output patterns\. When a prescription corrects the bottleneck, this alignment breaks: compensation fails, previously masked errors surface, and the system regresses \(the Prescription Hazard\)\.

The decisive distinction between patchingM3M\_\{3\}vs\.M1M\_\{1\}is direction:M3M\_\{3\}CCP perturbs an executable\-semantic layer \(tool\-name routing\) that downstream modules cannot absorb;M1M\_\{1\}CCP perturbs a surface\-linguistic layer that downstream modules naturally compensate for \(§[4\.4](https://arxiv.org/html/2605.21958#S4.SS4)\)\.

We distinguish two forms:*Relative*\(M3M\_\{3\}is the worst patch target\) and*Absolute*\(Δ​\(M3\)\>0\\Delta\(M\_\{3\}\)\{\>\}0, only when Contract strength is high\)\. We use theM3M\_\{3\}compensator rate as a preliminary proxy for Contract strength; empirical values and the resulting Hazard trend are reported in §[4\.3](https://arxiv.org/html/2605.21958#S4.SS3)and App\.[H](https://arxiv.org/html/2605.21958#A8)\.

## 4Experiments

Table 1:Per\-module diagnostic stats \(nd=500n\_\{d\}\{=\}500,𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}, gpt\-4o\-mini\)\.†M3M\_\{3\}isipop⋆i^\{\\star\}\_\{\\mathrm\{pop\}\}\. Right half: per\-task fate counts \(\|NIEi\|\>0\.05\|\\mathrm\{NIE\}\_\{i\}\|\{\>\}0\.05\)\.M1M\_\{1\}excluded \(Δ​F1¯=0\.357\\overline\{\\Delta F\_\{1\}\}\{=\}0\.357, enters via §[4\.3](https://arxiv.org/html/2605.21958#S4.SS3)\)\. Full mediation triple in App\.[B](https://arxiv.org/html/2605.21958#A2)\.Two questions:RQ1is the diagnosed module \(M3M\_\{3\}\) also the worst CCP target \(*the Diagnostic Paradox*\)?RQ2what mechanism explains this gap \(*mechanistic account, exploratory*\)?

### 4\.1Setup

#### Benchmark and splits\.

τ\\tau\-bench retail\(Yao et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib12)\): train split is the diagnosis set𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\(nd=500n\_\{d\}\{=\}500\), test split is the prescription set𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}\(np=111n\_\{p\}\{=\}111valid; disjoint\)\. All diagnosis\-derived artifacts \(ipop⋆i^\{\\star\}\_\{\\mathrm\{pop\}\}, CCP pool, fates,\(μi,σi\)\(\\mu\_\{i\},\\sigma\_\{i\}\)\) come from𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}only\.τ\\tau\-bench airline\(Yao et al\.,[2024](https://arxiv.org/html/2605.21958#bib.bib12)\)is used for diagnostic generalization only \(n=37n\{=\}37; no prescription split\)\.

#### Agent families\.

We use three base agents from distinct model families: gpt\-4o\-mini \(OpenAI\), Llama 4 Scout \(Meta\), and Qwen3\-32b \(Alibaba\)\. Each is paired with the same oracle \(Claude Sonnet 4\.6, Anthropic\) and LLM judge \(Gemini 2\.5 Flash, Google\); this cross\-family triple prevents judge–oracle self\-correlation\(Liu et al\.,[2023](https://arxiv.org/html/2605.21958#bib.bib4)\)\. Full prescription experiments are run on gpt\-4o\-mini and Qwen3\-32b on𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}; Llama 4 Scout provides directional prescription replication\. Diagnostic sweeps cover all three agents\. See App\.[F](https://arxiv.org/html/2605.21958#A6)for model details\.

### 4\.2Configurations and Statistical Analysis

The main configuration sweep applies Pop CCP at each ofM1M\_\{1\}–M4M\_\{4\}withk=5k\{=\}5severity\-ranked correction triples, plus azz\-score adaptive routing variant and an oracle upper\-bound injection\. Ablations test alternate repair strategies atM3M\_\{3\}\(full list in App\.[E](https://arxiv.org/html/2605.21958#A5)\)\. Significance is assessed via paired Wilcoxon tests with Holm–Bonferroni correction over four pre\-specified comparisons \(Table[5](https://arxiv.org/html/2605.21958#A5.T5)\); effect size is paired Cohen’sdzd\_\{z\}\. The Qwen3\-32b prescription pilot uses the same correction pool constructed from gpt\-4o\-mini𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\(App\.[H](https://arxiv.org/html/2605.21958#A8)\)\.

### 4\.3The Diagnostic Paradox

#### Diagnosis: identifying the bottleneck\.

CICA identifies the router \(M3M\_\{3\}\) as the population diagnostic target with the largest causal contribution \(Δ​F3¯=1\.018\\overline\{\\Delta F\_\{3\}\}\{=\}1\.018; Table[1](https://arxiv.org/html/2605.21958#S4.T1)\), ahead of the planner \(0\.8170\.817\), response generator \(0\.5890\.589\), and query rewriter \(0\.3570\.357\)\. This result generalizes across both domains and agent families\. Onτ\\tau\-bench airline,M3M\_\{3\}again ranks first \(Δ​F3¯=1\.69\\overline\{\\Delta F\_\{3\}\}\{=\}1\.69; App\.[G](https://arxiv.org/html/2605.21958#A7)\), as it does when Llama 4 Scout \(1\.5641\.564\) and Qwen3\-32b \(1\.1481\.148\) replace gpt\-4o\-mini as the base agent on retail \(App\.[H](https://arxiv.org/html/2605.21958#A8)\)\.

#### Prescription: the diagnosed bottleneck is the worst patch target\.

Table[2](https://arxiv.org/html/2605.21958#S4.T2)summarises the key prescription results across all three agents; full per\-configuration details are in App\.[H](https://arxiv.org/html/2605.21958#A8)\. TheM3M\_\{3\}\-worst,M1M\_\{1\}\-best ordering holds consistently:M3M\_\{3\}CCP produces degradation on the two high\-compensator agents \(absolute Hazard\), whileM1M\_\{1\}CCP yields the largest improvement of any agent tested\. Baseline\-vs\.\-M1M\_\{1\}alone does not survive Holm correction on any agent \(p≥0\.086p\{\\geq\}0\.086\); the Paradox is established by theM1M\_\{1\}\-vs\.\-M3M\_\{3\}contrast\.

Table 2:PrescriptionΔ\\Deltafor Pop CCP\.M3M\_\{3\}\-worst,M1M\_\{1\}\-best\.∗Holmp<0\.05p\{<\}0\.05;p∗∗<0\.01\{\}^\{\\ast\\ast\}p\{<\}0\.01;∗∗∗rawp<0\.001p\{<\}0\.001; no mark = not significant after Holm\. Full results in App\.[H](https://arxiv.org/html/2605.21958#A8)\.
#### Contract trend: consistent across agent families\.

The Linguistic Contract hypothesis suggests that agents with heavy downstream co\-adaptation should exhibit CCP\-induced degradation, while agents without co\-adaptation should not\. We measured compensator rates on𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}before any prescription experiment, then observed Hazard on𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}: the two high\-rate agents \(gpt\-4o\-mini98\.2%98\.2\\%, Qwen3\-32b96\.0%96\.0\\%\) both show absolute Hazard, while Llama 4 Scout \(0%0\\%\) does not\. This consistent trend across three agent families—with measurements derived from diagnosis before any prescription run—supports the Contract hypothesis without establishing it causally\. Cross\-judgeM3M\_\{3\}agreement:α=0\.128\\alpha\{=\}0\.128\(ceiling\-compressed; binary 80%, direction 84%; App\.[L](https://arxiv.org/html/2605.21958#A12)\)\.

#### CCP\-specificity\.

The Hazard is specific to CCP: alternative repair strategies atM3M\_\{3\}\(instruction rewriting, model upgrade, task\-type routing\) all produceΔ≈0\\Delta\{\\approx\}0\(App\.[E](https://arxiv.org/html/2605.21958#A5)\)\. This scoping rules out the interpretation thatM3M\_\{3\}is simply a fragile module—rather, the Hazard arises from CCP’s particular mechanism of injecting correction examples that shiftM3M\_\{3\}’s output distribution\. As an upper bound, oracle injection atM3M\_\{3\}\(replacingM3M\_\{3\}’s output with a cached gold action\) yields the strongest improvement on gpt\-4o\-mini \(Δ=−2\.007\\Delta\{=\}\{\-\}2\.007\) and Llama 4 Scout \(Δ=−1\.795\\Delta\{=\}\{\-\}1\.795; App\.[H](https://arxiv.org/html/2605.21958#A8)\); this configuration was not tested on Qwen3\-32b\. The result confirms thatM3M\_\{3\}is improvable—just not via CCP\.

### 4\.4Mechanistic Account \(Exploratory\)

Cascade analysis \(App\.[K](https://arxiv.org/html/2605.21958#A11)\) gives a candidate distinction:*magnitude of downstream shift is patch\-location\-invariant*\.M4M\_\{4\}cosine to baseline is0\.837/0\.9060\.837/0\.906\(BoW / sentence\-encoder all\-MiniLM\-L6\-v2\) under Pop CCP @M3M\_\{3\}vs\.0\.839/0\.9060\.839/0\.906under Pop CCP @M1M\_\{1\}\(paired Wilcoxonp=0\.76p\{=\}0\.76,n=111n\{=\}111\), yetΔ​F\\Delta Fdiffers by0\.4340\.434\(\+0\.243\+0\.243vs\.−0\.191\-0\.191\) in opposite directions\. The two locations diverge atM3M\_\{3\}itself \(sentence\-encoder0\.9200\.920vs\.0\.9590\.959,p=0\.006p\{=\}0\.006\), suggesting the divergence localizes to the executable\-semantic layer \(9\.9%9\.9\\%tool\-name disagreement atM3M\_\{3\}vs\. mostly surface\-text shift atM1M\_\{1\}\)\. We frame this as suggestive rather than confirmed: the directional account is inferred from the joint pattern of comparable cosine and opposite outcome, and structural confounds \(M3M\_\{3\}categorical vs\.M1M\_\{1\}continuous outputs\) remain \(§[6](https://arxiv.org/html/2605.21958#S6)item 6\)\. A direct geometric projection onto an oracle\-aligned axis would constitute cleaner evidence; App\.[I](https://arxiv.org/html/2605.21958#A9)\.

## 5Conclusion

We demonstrated the Diagnostic Paradox: in a multi\-module LLM pipeline, the module with the highest causal blame is the worst target for prompt\-level correction patching, while upstream modules are more effective\. In our pipeline, this manifests as the router \(M3M\_\{3\}, diagnosed bottleneck\) being consistently outperformed by patching the query rewriter \(M1M\_\{1\}, upstream\) across three independent agent families\. The Linguistic Contract hypothesis—downstream modules co\-adapt to upstream noise—shows a consistent trend with patching Hazard across all three agent families\.

## 6Limitations

1. 1\.Scope of evidence\.The diagnostic finding \(M3M\_\{3\}as bottleneck\) generalizes across three agent families and two domains \(retail and airline\)\. Prescription evidence, however, remains limited toτ\\tau\-bench retail with one fixed pipeline topology; whether the patching Hazard persists in other task domains or architectures requires further study\.
2. 2\.Single\-turn first\-action protocol\.Causal mediation requires per\-stage oracle pairing, well\-defined only at one decision point; multi\-turn extension is deferred\. We expect the Paradox direction to persist under multi\-turn evaluation, but this is plausibility, not evidence\.
3. 3\.Oracle/judge design\.The cross\-family oracle/judge triple mitigates self\-correlation; an inter\-judge audit confirms substantial agreement \(App\.[L](https://arxiv.org/html/2605.21958#A12)\)\. Human evaluation remains future work\.
4. 4\.Fate thresholdτ\\tau\.The Paradox finding is robust acrossτ∈\{0\.01,0\.05,0\.10,0\.20\}\\tau\\in\\\{0\.01,0\.05,0\.10,0\.20\\\}\(App\.[J](https://arxiv.org/html/2605.21958#A10)\)\.
5. 5\.Directional account is indirect\.The direction hypothesis is inferred from comparableM4M\_\{4\}cosine yet oppositeΔ​F\\Delta Foutcomes\. A direct geometric projection onto an oracle\-aligned axis would constitute cleaner evidence\.
6. 6\.Contract proxy is NIE\-derived\.Compensator rate is derived from the sameNIEi\\mathrm\{NIE\}\_\{i\}used in diagnosis; an independent co\-adaptation measure is needed to establish a causal mechanism rather than a correlational indicator\.

## References

- Cheng et al\. \(2024\)Ching\-An Cheng, Allen Nie, and Adith Swaminathan\. 2024\.TRACE is the next AutoDiff: Training compute\-optimal language model agents\.*arXiv preprint arXiv:2406\.16218*\.
- Khattab et al\. \(2024\)Omar Khattab, Arnav Singhvi, Paridhi Maheshwari, Zhiyuan Zhang, Keshav Santhanam, Sri Vardhamanan, Saiful Haq, Ashutosh Sharma, Thomas T\. Joshi, Hanna Moazam, Heather Miller, Matei Zaharia, and Christopher Potts\. 2024\.DSPy: Compiling declarative language model calls into self\-improving pipelines\.In*International Conference on Learning Representations \(ICLR\)*\.
- Lightman et al\. \(2023\)Hunter Lightman, Vineet Kosaraju, Yura Burda, Harri Edwards, Bowen Baker, Teddy Lee, Jan Leike, John Schulman, Ilya Sutskever, and Karl Cobbe\. 2023\.Let’s verify step by step\.*arXiv preprint arXiv:2305\.20050*\.
- Liu et al\. \(2023\)Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu\. 2023\.G\-Eval: NLG evaluation using GPT\-4 with better human alignment\.In*Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*\.
- Madaan et al\. \(2023\)Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, Shashank Gupta, Bodhisattwa Prasad Majumder, Katherine Hermann, Sean Welleck, Amir Yazdanbakhsh, and Peter Clark\. 2023\.Self\-refine: Iterative refinement with self\-feedback\.In*Advances in Neural Information Processing Systems \(NeurIPS\)*\.
- Pearl \(2009\)Judea Pearl\. 2009\.*Causality: Models, Reasoning and Inference*, 2nd edition\.Cambridge University Press\.
- Pearl \(2014\)Judea Pearl\. 2014\.Interpretation and identification of causal mediation\.*Psychological Methods*, 19\(4\):459–481\.
- Shinn et al\. \(2023\)Noah Shinn, Federico Cassano, Edward Berman, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao\. 2023\.Reflexion: Language agents with verbal reinforcement learning\.In*Advances in Neural Information Processing Systems \(NeurIPS\)*\.
- Stolfo et al\. \(2023\)Alessandro Stolfo, Yonatan Belinkov, and Mrinmaya Sachan\. 2023\.A mechanistic interpretation of arithmetic reasoning in language models using causal mediation analysis\.In*Proceedings of EMNLP*\.
- Vig et al\. \(2020\)Jesse Vig, Sebastian Gehrmann, Yonatan Belinkov, Sharon Qian, Daniel Nevo, Yaron Singer, and Stuart Shieber\. 2020\.Investigating gender bias in language models using causal mediation analysis\.In*Advances in Neural Information Processing Systems \(NeurIPS\)*\.
- Yang et al\. \(2024\)Chengrun Yang, Xuezhi Wang, Yifeng Lu, Hanxiao Liu, Quoc V\. Le, Denny Zhou, and Xinyun Chen\. 2024\.Large language models as optimizers\.In*International Conference on Learning Representations \(ICLR\)*\.
- Yao et al\. \(2024\)Shunyu Yao, Noah Shinn, Pedram Razavi, and Karthik Narasimhan\. 2024\.τ\\tau\-bench: A benchmark for tool\-agent\-user interaction in real\-world domains\.In*Advances in Neural Information Processing Systems \(NeurIPS\)*\.
- Yao et al\. \(2023\)Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao\. 2023\.ReAct: Synergizing reasoning and acting in language models\.In*International Conference on Learning Representations \(ICLR\)*\.
- Yuksekgonul et al\. \(2024\)Mert Yuksekgonul, Federico Bianchi, Joseph Boen, Sheng Liu, Zhi Huang, Carlos Guestrin, and James Zou\. 2024\.TextGrad: Automatic “differentiation” via text\.*arXiv preprint arXiv:2406\.07496*\.
- Zhou et al\. \(2023\)Yongchao Zhou, Andrei Ioan Muresanu, Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and Jimmy Ba\. 2023\.Large language models are human\-level prompt engineers\.In*International Conference on Learning Representations \(ICLR\)*\.

## Appendix APreliminaries

#### Multi\-module pipeline\.

A multi\-module agent is a pipelineM1→⋯→MkM\_\{1\}\\to\\cdots\\to M\_\{k\}where eachMiM\_\{i\}is a separate LLM call\. We mapτ\\tau\-bench retail tasks toM1M\_\{1\}\(query rewrite\),M2M\_\{2\}\(planner\),M3M\_\{3\}\(router\),M4M\_\{4\}\(response generator\), with a non\-LLM tool call betweenM3M\_\{3\}andM4M\_\{4\}\.

#### Causal interventions\.

do​\(Mi=v\)\\mathrm\{do\}\(M\_\{i\}\{=\}v\)\(Pearl,[2009](https://arxiv.org/html/2605.21958#bib.bib6)\)setsMiM\_\{i\}’s output tovvand re\-executes downstream modules\. Oracle outputSi∗S^\{\*\}\_\{i\}\(Claude Sonnet 4\.6, cached offline on𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\) enters in two forms: \(i\) single\-module replacement forΔ​Fi\\Delta F\_\{i\}; \(ii\) Pearl mediation\(Pearl,[2014](https://arxiv.org/html/2605.21958#bib.bib7)\)forNIEi\\mathrm\{NIE\}\_\{i\}\(App\.[B](https://arxiv.org/html/2605.21958#A2)\)\.

#### Notation\.

Table[3](https://arxiv.org/html/2605.21958#A1.T3)collects the symbols used throughout the paper\.

Table 3:Symbol legend\. Three usage classes: \(i\)*failure*is exactlyFF;Δ​Fi\\Delta F\_\{i\}andNIEi\\mathrm\{NIE\}\_\{i\}are causal effects onFF, not failures\. \(ii\)*Diagnosis*has two levels: populationipop⋆i^\{\\star\}\_\{\\mathrm\{pop\}\}and per\-taskfate​\(i,c\)\\mathrm\{fate\}\(i,c\)\. \(iii\)*Prescription*refers to modifying the agent \(rewrite, compute upgrade, CCP, oracle injection\);*intervention*refers to causaldo​\(⋅\)\\mathrm\{do\}\(\\cdot\)operations;*patch*refers specifically to the CCP correction mechanism\.

## Appendix BNIE: Detailed Definition, Worked Example, and Sign Analysis

#### Detailed definition\.

LetMi\(0\)M\_\{i\}^\{\(0\)\}denoteMiM\_\{i\}’s output in the baseline run \(under noisy upstream\), and letMi​\(S<i∗\)M\_\{i\}\(S^\{\*\}\_\{<i\}\)denoteMiM\_\{i\}’s output when re\-executed on oracle upstream values forM<iM\_\{<i\}\.NIEi\\mathrm\{NIE\}\_\{i\}compares two intervened worlds:

- •World A \(refresh\):replace upstream with oracle \(do​\(M<i=S<i∗\)\\mathrm\{do\}\(M\_\{<i\}\{=\}S^\{\*\}\_\{<i\}\)\), re\-executeMiM\_\{i\}on the new upstream, then re\-executeM\>iM\_\{\>i\}\. YieldsF​\(A\)F\(\\text\{A\}\)\.
- •World B \(frozen\):same upstream replacement, but holdMiM\_\{i\}at its original baseline output \(Mi\(0\)M\_\{i\}^\{\(0\)\}\); onlyM\>iM\_\{\>i\}is re\-executed\. YieldsF​\(B\)F\(\\text\{B\}\)\.

NIEi=F​\(A\)−F​\(B\)\\mathrm\{NIE\}\_\{i\}=F\(\\text\{A\}\)\-F\(\\text\{B\}\)\. The two worlds share the oracle upstream and the same downstream re\-execution; the only difference is whetherMiM\_\{i\}adapted to the cleaner upstream or kept its baseline\-derived output\. The mediation identity\(Pearl,[2014](https://arxiv.org/html/2605.21958#bib.bib7)\)givesTEi\(med\)=NDEi\+NIEi\\mathrm\{TE\}^\{\(\\mathrm\{med\}\)\}\_\{i\}=\\mathrm\{NDE\}\_\{i\}\+\\mathrm\{NIE\}\_\{i\}, whereTEi\(med\)=F​\(A\)−F​\(E\)\\mathrm\{TE\}^\{\(\\mathrm\{med\}\)\}\_\{i\}=F\(\\text\{A\}\)\-F\(E\)andNDEi=F​\(B\)−F​\(E\)\\mathrm\{NDE\}\_\{i\}=F\(\\text\{B\}\)\-F\(E\)\.

#### Sign analysis \(per task\)\.

- •NIEi\>\+τ\\mathrm\{NIE\}\_\{i\}\>\+\\tau–amplifier:Mi​\(S<i∗\)M\_\{i\}\(S^\{\*\}\_\{<i\}\)is structurally cleaner thanMi\(0\)M\_\{i\}^\{\(0\)\}but lies outside the distribution that downstreamM\>iM\_\{\>i\}was tuned for, soFFrises\. This is the cascade signature\.
- •NIEi<−τ\\mathrm\{NIE\}\_\{i\}<\-\\tau–compensator:Mi​\(S<i∗\)M\_\{i\}\(S^\{\*\}\_\{<i\}\)is in\-family for downstream and improves the final outcome;MiM\_\{i\}tracks upstream quality\.
- •\|NIEi\|≤τ\|\\mathrm\{NIE\}\_\{i\}\|\\leq\\tau–propagator:MiM\_\{i\}’s output is effectively invariant to upstream cleanup at this task\.

#### Identification note\.

OurNIEi=F​\(A\)−F​\(B\)\\mathrm\{NIE\}\_\{i\}=F\(\\text\{A\}\)\-F\(\\text\{B\}\)corresponds to theX=x∗X\{=\}x^\{\*\}arm of Pearl’s mediation decomposition \(NIEr\\mathrm\{NIE\}\_\{r\}\), which together withNDEi=F​\(B\)−F​\(E\)\\mathrm\{NDE\}\_\{i\}=F\(\\text\{B\}\)\-F\(E\)satisfiesTEi\(med\)=NDEi\+NIEi\\mathrm\{TE\}^\{\(\\mathrm\{med\}\)\}\_\{i\}=\\mathrm\{NDE\}\_\{i\}\+\\mathrm\{NIE\}\_\{i\}by telescoping\. Equivalence with the standardNIE=Y​\(x,M​\(x∗\)\)−Y​\(x,M​\(x\)\)\\mathrm\{NIE\}=Y\(x,M\(x^\{\*\}\)\)\-Y\(x,M\(x\)\)requires no upstream×\{\\times\}MiM\_\{i\}interaction onFF, i\.e\.,FFfactorizes asf​\(M<i\)\+g​\(Mi,M\>i\)f\(M\_\{<i\}\)\+g\(M\_\{i\},M\_\{\>i\}\)up to noise\. The chain structure of our pipeline naturally motivates this, withNDEi≠0\\mathrm\{NDE\}\_\{i\}\{\\neq\}0in Table[1](https://arxiv.org/html/2605.21958#S4.T1)reflecting residual cross\-prompt context sharing \(e\.g\.,M4M\_\{4\}accessing the user query alongsideM3M\_\{3\}’s output\) and stale\-output mismatch in World B\. The fate signs of §[3\.3](https://arxiv.org/html/2605.21958#S3.SS3)are defined directly onNIEr\\mathrm\{NIE\}\_\{r\}and remain valid regardless\.

## Appendix CCCP Correction Pool Construction

The correction pool used by every CCP configuration is built once, offline on𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\(nd=500n\_\{d\}\{=\}500\), before any test\-time evaluation on𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}\. Source: the intervention sweep we already run forΔ​F\\Delta Fidentification \(§[4\.3](https://arxiv.org/html/2605.21958#S4.SS3)\), which produces, for every diagnosis taskc∈𝒟diagc\\in\\mathcal\{D\}\_\{\\mathrm\{diag\}\}and every moduleMiM\_\{i\}, the triple\(module input,Mi\(0\)​\(c\),Si∗​\(c\)\)\(\\text\{module input\},M\_\{i\}^\{\(0\)\}\(c\),\\ S^\{\*\}\_\{i\}\(c\)\)whereMi\(0\)​\(c\)M\_\{i\}^\{\(0\)\}\(c\)is the agent’s baseline output andSi∗​\(c\)S^\{\*\}\_\{i\}\(c\)is the cached Sonnet 4\.6 oracle output, together with the LLM\-judge severitysevi\(0\)​\(c\)∈\[0,0\.99\]\\mathrm\{sev\}\_\{i\}^\{\(0\)\}\(c\)\\in\[0,0\.99\]scoring how badlyMi\(0\)​\(c\)M\_\{i\}^\{\(0\)\}\(c\)missesSi∗​\(c\)S^\{\*\}\_\{i\}\(c\)\.

Selection rule\.For each moduleMiM\_\{i\}we restrict candidates to tasks withsevi\(0\)​\(c\)≥τdemo\\mathrm\{sev\}\_\{i\}^\{\(0\)\}\(c\)\\geq\\tau\_\{\\mathrm\{demo\}\}\(we useτdemo=0\.30\\tau\_\{\\mathrm\{demo\}\}\{=\}0\.30, the judge’s “partial coverage / missing one minor element” rubric anchor\), then sort bysevi\(0\)​\(c\)\\mathrm\{sev\}\_\{i\}^\{\(0\)\}\(c\)descending and take the topk=5k\{=\}5\(ties broken by task id\)\. The earlier raw\-string criterionMi\(0\)≠Si∗M\_\{i\}^\{\(0\)\}\\neq S^\{\*\}\_\{i\}admitted paraphrase\-only differences \(e\.g\.,M1M\_\{1\}third\-person rewrite,M4M\_\{4\}verbose reply\) which carry no learning signal; the severity\-based rule selects only triples where the judge has confirmed a semantic gap\.

Patch template\.Each correction renders into the module’s prompt as a single block of the formInput: <text\> \| Wrong: <text\> \| Correct: <text\>; instructions and the output schema ofMiM\_\{i\}are not modified\. The only difference between population and per\-task CCP configurations is which module’s pool is selected at test time\. No task in𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}contributes to any pool, so test\-time patching never observes the task it is being applied to\.

## Appendix DCCP Procedures

#### Routing targets\.

Pop CCP and its naive symptom\-axis counterpart route to a*single*module index fixed across all test tasks\. The CICA populationΔ​F\\Delta Ftarget is

ipop⋆=arg⁡maxi∈\{M1,…,M4\}⁡1N​∑c∈𝒟Δ​Fi​\(c\),i^\{\\star\}\_\{\\mathrm\{pop\}\}\\;=\\;\\arg\\max\_\{i\\,\\in\\,\\\{M\_\{1\},\\ldots,M\_\{4\}\\\}\}\\,\\frac\{1\}\{N\}\\sum\_\{c\\,\\in\\,\\mathcal\{D\}\}\\Delta F\_\{i\}\(c\),\(3\)the module with the largest meanΔ​Fi\\Delta F\_\{i\}\(Eq\.[2](https://arxiv.org/html/2605.21958#S3.E2)\) on the diagnosis split𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\(nd=500n\_\{d\}\{=\}500\);ipop⋆i^\{\\star\}\_\{\\mathrm\{pop\}\}is computed once at diagnosis and reused on everyc∈𝒟prescc\\in\\mathcal\{D\}\_\{\\mathrm\{presc\}\}\. The naive symptom counterpart is

ipop​\-​sev=arg⁡maxi⁡1N​∑csevi\(0\)​\(c\),i^\{\\mathrm\{pop\\text\{\-\}sev\}\}\\;=\\;\\arg\\max\_\{i\}\\,\\frac\{1\}\{N\}\\sum\_\{c\}\\mathrm\{sev\}\_\{i\}^\{\(0\)\}\(c\),\(4\)wheresevi\(0\)​\(c\)\\mathrm\{sev\}\_\{i\}^\{\(0\)\}\(c\)is the LLM\-judge severity ofMiM\_\{i\}on the baseline run of taskcc\. The naive per\-task severity targetitask​\-​sev​\(c\)=arg⁡maxi⁡sevi\(0\)​\(c\)i^\{\\mathrm\{task\\text\{\-\}sev\}\}\(c\)=\\arg\\max\_\{i\}\\mathrm\{sev\}\_\{i\}^\{\(0\)\}\(c\)and thezz\-score adaptive target \(§[3\.4](https://arxiv.org/html/2605.21958#S3.SS4)\) are recomputed per task and used by the adaptive procedures\.

Algorithm 1Pop CCP at the populationΔ​F\\Delta Ftargetipop⋆i^\{\\star\}\_\{\\mathrm\{pop\}\}\.1:correction pools

\{Pi\}\\\{P\_\{i\}\\\}for every module \(App\.[C](https://arxiv.org/html/2605.21958#A3)\); population

Δ​F\\Delta Ftarget

ipop⋆=arg⁡maxi⁡Δ​Fi¯i^\{\\star\}\_\{\\mathrm\{pop\}\}=\\arg\\max\_\{i\}\\overline\{\\Delta F\_\{i\}\}\(Eq\.[3](https://arxiv.org/html/2605.21958#A4.E3)\); task with cached oracle

S∗S^\{\*\}
2:Patch

Mipop⋆M\_\{i^\{\\star\}\_\{\\mathrm\{pop\}\}\}’s prompt with

kkcorrections drawn from

Pipop⋆P\_\{i^\{\\star\}\_\{\\mathrm\{pop\}\}\}; other modules unchanged

3:Run the pipeline

M1→M2→M3→M4M\_\{1\}\\to M\_\{2\}\\to M\_\{3\}\\to M\_\{4\}
4:

F←F\\leftarrowLLM judge against

S∗S^\{\*\}
5:return

FF

This procedure makes no test\-time decisions and never calls a routing oracle; the samekk\-correction patch is applied toMipop⋆M\_\{i^\{\\star\}\_\{\\mathrm\{pop\}\}\}on every task\. The Naive Pop Severity configuration follows the identical procedure but withipop​\-​sevi^\{\\mathrm\{pop\\text\{\-\}sev\}\}\(Eq\.[4](https://arxiv.org/html/2605.21958#A4.E4)\) replacingipop⋆i^\{\\star\}\_\{\\mathrm\{pop\}\}\.

The four matched\-treatment configurations run exactly the procedure above with the target module fixed toM1M\_\{1\},M2M\_\{2\},M3=ipop⋆M\_\{3\}\{=\}i^\{\\star\}\_\{\\mathrm\{pop\}\}, andM4M\_\{4\}respectively, withkk, pool\-construction rule, correction order, and judge held identical across the four\. This is the design that makes the four\-point Pop CCP measurement \(App\.[H](https://arxiv.org/html/2605.21958#A8)\) a valid isolation of the target\-module choice\.

#### Adaptivezz\-score routing variant\.

The Adaptive CCP configuration routes the patch per task by an at\-test\-time estimate ofNIEi\\mathrm\{NIE\}\_\{i\}, using a cheap secondary LLM \(Gemma\-4\-26B\-A4B\-it\) to generate a fresh per\-task routing oracle\. The correction pools\{Pi\}\\\{P\_\{i\}\\\}themselves are built once on𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\(App\.[C](https://arxiv.org/html/2605.21958#A3)\); only the routing decision is task\-adaptive\.

Algorithm 2Adaptive CCP via per\-taskNIEi\\mathrm\{NIE\}\_\{i\}routing\.1:correction pools

\{Pi\}\\\{P\_\{i\}\\\}from

𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}; cheap routing\-oracle LLM \(Gemma\); LLM judge; threshold

τ\\tau; test task

c∈𝒟prescc\\in\\mathcal\{D\}\_\{\\mathrm\{presc\}\}with cached scoring oracle

S∗​\(c\)S^\{\*\}\(c\)
2:Run the unmodified pipeline on

cc→\\tobaseline state

σ0\\sigma\_\{0\}
3:

S^∗←Gemma​\(u​s​e​r​\_​q​u​e​r​y,σ0\)\\hat\{S\}^\{\*\}\\leftarrow\\text\{Gemma\}\(user\\\_query,\\sigma\_\{0\}\)// routing oracle, deployment\-realistic

4:foreach module

MiM\_\{i\}with

i≥2i\\geq 2do

5:

σA←\\sigma\_\{A\}\\leftarrowrefresh

MiM\_\{i\}on

do​\(M<i=S^<i∗\)\\mathrm\{do\}\(M\_\{<i\}\{=\}\\hat\{S\}^\{\*\}\_\{<i\}\), re\-run downstream

6:

FA←F\_\{A\}\\leftarrowLLM judge on

σA\\sigma\_\{A\}vs\.

S^∗\\hat\{S\}^\{\*\}
7:

σB←\\sigma\_\{B\}\\leftarrowfreeze

MiM\_\{i\}at

σ0\\sigma\_\{0\}’s value under

do​\(M<i=S^<i∗\)\\mathrm\{do\}\(M\_\{<i\}\{=\}\\hat\{S\}^\{\*\}\_\{<i\}\), re\-run downstream

8:

FB←F\_\{B\}\\leftarrowLLM judge on

σB\\sigma\_\{B\}vs\.

S^∗\\hat\{S\}^\{\*\}
9:

NIEi←FA−FB\\mathrm\{NIE\}\_\{i\}\\leftarrow F\_\{A\}\-F\_\{B\}
10:endfor

11:

ı^∗←arg⁡maxi⁡NIEi\\hat\{\\imath\}^\{\*\}\\leftarrow\\arg\\max\_\{i\}\\mathrm\{NIE\}\_\{i\}
12:if

NIEı^∗\>τ\\mathrm\{NIE\}\_\{\\hat\{\\imath\}^\{\*\}\}\>\\tauthen

13:Patch

Mı^∗M\_\{\\hat\{\\imath\}^\{\*\}\}’s prompt with

kkcorrections from

Pı^∗P\_\{\\hat\{\\imath\}^\{\*\}\}; re\-run the pipeline

→σout\\to\\sigma\_\{\\text\{out\}\}
14:else

15:

σout←σ0\\sigma\_\{\\text\{out\}\}\\leftarrow\\sigma\_\{0\}// no patch

16:endif

17:

F←F\\leftarrowLLM judge on

σout\\sigma\_\{\\text\{out\}\}vs\.

S∗​\(c\)S^\{\*\}\(c\)// scored against the strong cached oracle

18:return

FF,

ı^∗\\hat\{\\imath\}^\{\*\}

Per\-task cost\(gpt\-4o\-mini agent, Gemini 2\.5 Flash judge\): The adaptive configuration adds 1 Gemma call \(routing oracle\),2×3=62\{\\times\}3=6intervention re\-runs, and 7 judge scorings on top of the baseline run\.

Why two oracles, and why this is not leakage\.The routing oracleS^∗\\hat\{S\}^\{\*\}is generated at test time from a cheap LLM and is used only to decide*which module*to patch; the patch itself draws fromPiP\_\{i\}built on𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\. The cached Sonnet 4\.6 oracleS∗​\(c\)S^\{\*\}\(c\)is used only at the final scoring step \(lineF←…F\\leftarrow\\dots\) and is never seen by the routing decision or by the agent\. Hence the routing rule is deployment\-implementable \(no privileged information aboutccbeyond what Gemma can infer from the live query\) while scoring fidelity is preserved\.

Thezz\-score variant replaces lines 9–10 of Algorithm[2](https://arxiv.org/html/2605.21958#alg2)with thezz\-score selection rule\. Let\(μi,σi\)\(\\mu\_\{i\},\\sigma\_\{i\}\)be the per\-moduleNIE\\mathrm\{NIE\}mean and standard deviation computed once on𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\(cached alongside\{Pi\}\\\{P\_\{i\}\\\}\)\. At test time:

zi​\(c\)=NIEi​\(c\)−μiσi,ı^∗=arg⁡maxi⁡zi​\(c\),z\_\{i\}\(c\)\\,=\\,\\frac\{\\mathrm\{NIE\}\_\{i\}\(c\)\-\\mu\_\{i\}\}\{\\sigma\_\{i\}\},\\qquad\\hat\{\\imath\}^\{\*\}\\,=\\,\\arg\\max\_\{i\}z\_\{i\}\(c\),with the patch fired iffzı^∗​\(c\)\>zthrz\_\{\\hat\{\\imath\}^\{\*\}\}\(c\)\>z\_\{\\mathrm\{thr\}\}\(defaultzthr=1\.0z\_\{\\mathrm\{thr\}\}\{=\}1\.0\)\. The Pearl\-mediation sign ofNIEi\\mathrm\{NIE\}\_\{i\}is preserved as an absolute quantity for fate labelling \(§[3\.3](https://arxiv.org/html/2605.21958#S3.SS3)\); thezz\-score is used only for routing, where the cross\-module comparison needs to account forσNIEi\\sigma\_\{\\mathrm\{NIE\}\_\{i\}\}’s3×3\{\\times\}variation across modules \(Table[1](https://arxiv.org/html/2605.21958#S4.T1)\)\. All other steps of Algorithm[2](https://arxiv.org/html/2605.21958#alg2)are unchanged\.

## Appendix EFull Configuration Specification

Table[4](https://arxiv.org/html/2605.21958#A5.T4)lists the 11 prescription configurations grouped by their role in the paper: the seven*Main*configurations carry the lead claim, and the four*Ablation*configurations isolate the treatment\-family axis atipop⋆i^\{\\star\}\_\{\\mathrm\{pop\}\}\.

GroupTargetTreatment*Main: four\-point Pop CCP \+ adaptive variant \+ UB*Baseline––Pop CCPM1M\_\{1\}\(QR\)Pop CCPM2M\_\{2\}\(Planner\)Pop CCPM3M\_\{3\}\(ipop⋆i^\{\\star\}\_\{\\mathrm\{pop\}\}\)Pop CCPM4M\_\{4\}\(RG\)Pop CCPAdaptiveper\-taskarg⁡maxi⁡zi​\(c\)\\arg\\max\_\{i\}z\_\{i\}\(c\)CCPUpper boundM3M\_\{3\}\(oracle inject\)oracleSi∗S^\{\*\}\_\{i\}*Ablation: alternate treatments atM3M\_\{3\}*M3M\_\{3\}RewriteM3M\_\{3\}Compute upgradeper\-taskarg⁡maxi⁡NIEi\\arg\\max\_\{i\}\\mathrm\{NIE\}\_\{i\}\(absolute\)CCPTable 4:Full configuration specification\. The*Main*block carries the Diagnostic Paradox finding; the*Ablation*block shows that theM3M\_\{3\}Hazard is*CCP\-specific*: non\-CCP treatments atM3M\_\{3\}are all neutral, confirming the Hazard requires precise output\-distribution shift; absolute\-NIE routing is dominated by itszz\-score variant\.Table[5](https://arxiv.org/html/2605.21958#A5.T5)reports raw and Holm–Bonferroni\-correctedpp\-values for the four critical comparisons that establish the Diagnostic Paradox\.

Table 5:Holm–Bonferroni correctedpp\-values \(two\-sided paired Wilcoxon,np=111n\_\{p\}\{=\}111\)\.p∗<0\.05\{\}^\{\\ast\}p\{<\}0\.05,p∗∗<0\.01\{\}^\{\\ast\\ast\}p\{<\}0\.01\. The baseline\-vs\.\-M1M\_\{1\}leverage comparison does not survive Holm correction; the paradox is established by theM1M\_\{1\}vs\.M3M\_\{3\}contrast\.
## Appendix FModels and Roles

Table[6](https://arxiv.org/html/2605.21958#A6.T6)lists the models used in all experiments, their families, and their roles in the pipeline\.

Table 6:Models and their roles\. Three distinct base agents span OpenAI, Meta, and Alibaba families\. The cross\-family oracle/judge triple \{Anthropic, Google\} prevents self\-correlation with any of the agents\. The Pop Rewrite configuration \(GPT\-5\) producesΔ=−0\.014\\Delta\{=\}\{\-\}0\.014and does not affect the main Diagnostic Paradox finding\.
## Appendix GAirline Domain: Diagnostic Replication

To probe whetherM3M\_\{3\}\(Router\) is the diagnostic bottleneck beyondτ\\tau\-bench retail, we ran the same E2 causal sweep \(gpt\-4o\-mini agent, Claude Sonnet 4\.6 oracle, Gemini 2\.5 Flash judge\) on theτ\\tau\-bench airline test split \(n=37n\{=\}37valid tasks\)\. Table[7](https://arxiv.org/html/2605.21958#A7.T7)reports per\-moduleΔ​Fi¯\\overline\{\\Delta F\_\{i\}\}and fate distributions\.

Table 7:E2 diagnostic replication onτ\\tau\-bench airline \(n=37n\{=\}37\)\.†M3M\_\{3\}is the largest\-Δ​Fi¯\\overline\{\\Delta F\_\{i\}\}module in both domains\. Fate counts: Compensator/Propagator/Amplifier under\|NIEi\|\>0\.05\|\\mathrm\{NIE\}\_\{i\}\|\{\>\}0\.05\. Retail column reproduces Table[1](https://arxiv.org/html/2605.21958#S4.T1)for reference\.M3M\_\{3\}has the highestΔ​Fi¯\\overline\{\\Delta F\_\{i\}\}in both domains \(0\.357→1\.0180\.357\{\\to\}1\.018retail;0\.207→1\.6900\.207\{\\to\}1\.690airline\), and compensator\-majority fate distributions hold for all downstream modules\. The airline amplifier count atM3M\_\{3\}\(4/37, 10\.8%\) is higher than retail \(2/500, 0\.4%\), consistent with the harder airline benchmark \(F¯=3\.63\\bar\{F\}\{=\}3\.63vs\.2\.452\.45retail\)\.

## Appendix HCross\-Agent Replication

#### Setup\.

All settings identical to §[4\.1](https://arxiv.org/html/2605.21958#S4.SS1)except the base agent is replaced by Llama 4 Scout \(T=0T\{=\}0\)\. Oracle \(Claude Sonnet 4\.6\) and judge \(Gemini 2\.5 Flash\) are unchanged\.np=111n\_\{p\}\{=\}111prescription tasks \(same split as gpt\-4o\-mini\)\.

#### Diagnostic replication\.

M3M\_\{3\}is the population diagnostic bottleneck \(Δ​F3¯=1\.564\\overline\{\\Delta F\_\{3\}\}\{=\}1\.564, highest across modules\), replicating the gpt\-4o\-mini diagnosis \(1\.0181\.018\)\. Full prescription results across all three agents are in Table[8](https://arxiv.org/html/2605.21958#A8.T8)\. Notably,M3M\_\{3\}compensator rate is98\.2%98\.2\\%\(gpt\-4o\-mini\),96\.0%96\.0\\%\(Qwen3\-32b\), and0%0\\%\(Llama 4 Scout\), consistent with the Hazard trend: absolute Hazard appears on the two high\-rate agents and is absent on Llama 4 Scout\.

Table 8:PrescriptionΔ\\Delta\(change from baseline; negative = improvement\) and tool\-match rate for all three agents\.M3M\_\{3\}\-worst,M1M\_\{1\}\-best ordering holds in every agent\. Absolute Hazard \(Δ​\(M3\)\>0\\Delta\(M\_\{3\}\)\{\>\}0\) appears on the two high\-compensator agents \(gpt\-4o\-mini, Qwen3\-32b\) but not on Llama 4 Scout, consistent with the Contract trend\.M3M\_\{3\}tool\-match shows the clearest behavioral signal of Hazard \(drops from 37\.8% to 33\.3% on gpt\-4o\-mini, 44\.9% to 24\.5% on Qwen3\-32b\)\. Paired Wilcoxon vs\. baseline\.†directional only \(rawp=0\.059p\{=\}0\.059, Holmp=0\.177p\{=\}0\.177\);∗Holmp<0\.05p\{<\}0\.05;∗∗Holmp<0\.01p\{<\}0\.01;∗∗∗rawp<0\.001p\{<\}0\.001\. Qwen3\-32b uses gpt\-4o\-mini correction triples; ‘—’ = configuration not tested\.

## Appendix ICCP Correction\-Pool Examples

Each correction in the per\-module pool is a triple\(xi,Siactual,Si∗\)\(x\_\{i\},\\ S\_\{i\}^\{\\mathrm\{actual\}\},\\ S^\{\*\}\_\{i\}\)extracted at zero additional inference cost from the diagnosis sweep on𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}:xix\_\{i\}is whatMiM\_\{i\}saw,SiactualS\_\{i\}^\{\\mathrm\{actual\}\}is whatMiM\_\{i\}produced in the baseline run, andSi∗S^\{\*\}\_\{i\}is the cached oracle output\. Selection rule:sevi​\(c\)≥τdemo=0\.30\\mathrm\{sev\}\_\{i\}\(c\)\\geq\\tau\_\{\\mathrm\{demo\}\}\{=\}0\.30, top\-k=5k\{=\}5by descending severity\. The actual correction that lands inMiM\_\{i\}’s prompt renders as\#\#\# Examplejj/ Input:\{xi\}\\\{x\_\{i\}\\\}/×\\timesWrong:\{Siactual\}\\\{S\_\{i\}^\{\\mathrm\{actual\}\}\\\}/✓\\checkmarkCorrect:\{Si∗\}\\\{S^\{\*\}\_\{i\}\\\}\. Figure[2](https://arxiv.org/html/2605.21958#A9.F2)shows one real top\-severity correction per module from the𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\(nd=500n\_\{d\}\{=\}500\) pool used in all CCP configurations in this paper; user queries are shortened for legibility, the rest are verbatim\.

Figure 2:One top\-severity CCP correction per module, drawn from the𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\(nd=500n\_\{d\}\{=\}500\) pool\. The four examples illustrate the failure pattern each module’s pool encodes: surface formatting \(M1M\_\{1\}\), intent classification \(M2M\_\{2\}\), tool selection \(M3M\_\{3\}, the highest\-severity tier\), and concrete\-field omission \(M4M\_\{4\}\)\. When CCP applies atM3M\_\{3\}\(the diagnosed target\), all five corrections are high\-severity tool mis\-selections; the patched prompt shiftsM3M\_\{3\}’s tool\-name distribution sharply — exactly the output\-distribution shift the Hazard mechanism identifies in §[4\.4](https://arxiv.org/html/2605.21958#S4.SS4)\.Figure[3](https://arxiv.org/html/2605.21958#A9.F3)shows threeM2M\_\{2\}\-amplifier cases that make the Linguistic Contract concrete: in each, the baselineM2M\_\{2\}output is less informative than the oracle’s, yet the downstream recovers becauseM3/M4M\_\{3\}/M\_\{4\}have absorbed the surface cues of the noisy upstream\.

Case 1tau\_retail\_243\(NIEM2=\+1\.099\\mathrm\{NIE\}\_\{M\_\{2\}\}\{=\}\{\+\}1\.099\)*User query:*“…Cancel order \#W7807323 because ordered by mistake\. For \#W2618034, change address to …”*Mechanism:*The contract holds becauseM3M\_\{3\}keys off the literal user\-query verb “Cancel” rather thanM2M\_\{2\}’s mis\-labelled intent\. Substituting the oracleM2M\_\{2\}output would remove this surface cue from the upstream channel thatM3M\_\{3\}relies on\. Case 2tau\_retail\_017\(NIEM2=\+1\.099\\mathrm\{NIE\}\_\{M\_\{2\}\}\{=\}\{\+\}1\.099\)*User query:*“…For \#W6026015, exchange Luggage Set \{piece count: 2\-piece, color: red, material: hardshell\} to \{material: softshell\}…”*Mechanism:*The downstream prompt has absorbed gpt\-4o\-mini’s habit of returning item names instead of catalog IDs and routes the response phrasing accordingly\. Substituting the oracleM2M\_\{2\}would not fixM3M\_\{3\}’s ID\-vs\-name habit but would changeM2M\_\{2\}’s phrasing, which is what downstream had been keying off\. Case 3tau\_retail\_036\(NIEM2=\+1\.099\\mathrm\{NIE\}\_\{M\_\{2\}\}\{=\}\{\+\}1\.099\)*Mechanism:*Same compensation pattern as Case 2 — downstream relies on the surface phrasing of the noisy baselineM2M\_\{2\}\.

Figure 3:ThreeM2M\_\{2\}\-amplifier cases \(three highest\-NIEM2\\mathrm\{NIE\}\_\{M\_\{2\}\}tasks in𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\) drawn from𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\. Each row juxtaposes the Planner’s noisy baseline output \(M2\(0\)M\_\{2\}^\{\(0\)\}\), its oracle\-quality counterpart \(S2∗S\_\{2\}^\{\*\}\), and the actual downstream response\. The downstream produces a passable response despite the upstream’s flaws, consistent with the Linguistic Contract \(§[3\.5](https://arxiv.org/html/2605.21958#S3.SS5)\)\. SubstitutingS2∗S\_\{2\}^\{\*\}forM2\(0\)M\_\{2\}^\{\(0\)\}would strip the absorbed surface cues and trigger the Hazard observed at Pop CCPM3M\_\{3\}\(App\.[H](https://arxiv.org/html/2605.21958#A8)\)\.
## Appendix Jτ\\tau\-Sensitivity of Fate Counts

The fate thresholdτ=0\.05\\tau\{=\}0\.05used throughout §[3\.3](https://arxiv.org/html/2605.21958#S3.SS3)and §[4\.3](https://arxiv.org/html/2605.21958#S4.SS3)is a small\-effect convention near the LLM judge’s smallest non\-zero severity tier \(−log⁡\(1−0\.05\)≈0\.051\-\\log\(1\{\-\}0\.05\)\{\\approx\}0\.051\)\. Table[9](https://arxiv.org/html/2605.21958#A10.T9)reports the per\-module amp/prop/comp counts underτ∈\{0\.01,0\.05,0\.10,0\.20\}\\tau\\in\\\{0\.01,0\.05,0\.10,0\.20\\\}\.

Table 9:Per\-module fate counts on𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}\(nd=500n\_\{d\}\{=\}500\) under varyingτ\\tau\. The compensator\-dominant property reported in §[4\.3](https://arxiv.org/html/2605.21958#S4.SS3)is robust to the threshold:M3M\_\{3\}has≥469/500\\geq 469/500compensators at everyτ\\tautested, and the relative ordering of modules by amplifier count \(M2≫M3≫M4=0M\_\{2\}\\gg M\_\{3\}\\gg M\_\{4\}\{=\}0\) is preserved\.ipop⋆i^\{\\star\}\_\{\\mathrm\{pop\}\}is determined byΔ​Fi¯\\overline\{\\Delta F\_\{i\}\}and is independent ofτ\\tau\.The reading of the Diagnostic Paradox does not change:M3M\_\{3\}remains compensator\-dominant at every threshold,M2M\_\{2\}remains the only module with a substantive amplifier population, and the four\-point Pop CCP ordering on𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}\(App\.[H](https://arxiv.org/html/2605.21958#A8)\) does not depend onτ\\taubecause that comparison uses identical CCP treatment per target and not the fate label\.

## Appendix KM1M\_\{1\}CCP Cascade Distributional\-Shift Analysis

#### Full results \(Table[10](https://arxiv.org/html/2605.21958#A11.T10)\)\.

Table 10:Cascade distributional\-shift comparison on𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}\(np=111n\_\{p\}\{=\}111, baselineF=3\.687F\{=\}3\.687\)\. Top blocks: BoW cosine as a conservative lower bound\. Bottom block: sentence\-encoder \(all\-MiniLM\-L6\-v2\) cosine, computed on the same per\-module outputs \(§[4\.4](https://arxiv.org/html/2605.21958#S4.SS4)\); theM4M\_\{4\}magnitude invariance \(both0\.9060\.906\) holds under both metrics \(paired Wilcoxonp=0\.76p\{=\}0\.76\), and theM3M\_\{3\}direct shift is significantly larger underM3M\_\{3\}CCP than underM1M\_\{1\}CCP \(0\.9200\.920vs\.0\.9590\.959,p=0\.006p\{=\}0\.006\)\. This rules out the concern that BoW is too coarse to detect the cascade\. Dominant failure mode under Pop CCP @M3M\_\{3\}: slot\-value format error\.
#### Motivation\.

Section[4\.4](https://arxiv.org/html/2605.21958#S4.SS4)argues that the Diagnostic Paradox is governed by the*direction*of downstream perturbation, not its magnitude\. This appendix provides the full methodology and results\.

#### Procedure\.

We run the Pop CCP atM1M\_\{1\}configuration \(k=5k\{=\}5severity\-ranked corrections, same judge and correction\-selection rule as the Pop CCP atM3M\_\{3\}configuration\) on𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}\(np=111n\_\{p\}\{=\}111, baselineF¯=3\.687\\bar\{F\}\{=\}3\.687\)\. For each task and each modulej∈\{M1,M2,M3,M4\}j\\in\\\{M\_\{1\},M\_\{2\},M\_\{3\},M\_\{4\}\\\}, we record the raw text output and compare it to the baseline using: \(i\) BoW cosine similarity; \(ii\) categorical disagreement atM2M\_\{2\}\(intent label\) andM3M\_\{3\}\(tool\_name\); \(iii\) slot\-keys Jaccard atM2M\_\{2\}to separate schema\-level from value\-level shift\.

#### Hypotheses stated prior to running this configuration\.

- •Hypothesis A\(strict contract\-preservation\):cos⁡\(M2\(0\),M2\(ccp↓\)\)\>0\.95\\cos\(M\_\{2\}^\{\(0\)\},M\_\{2\}^\{\(\\mathrm\{ccp\}\\downarrow\)\}\)\>0\.95; Pop CCP atM1M\_\{1\}hands downstream a cleaner input without disturbing inter\-module agreement\. This was not supported: measuredM2M\_\{2\}cosine was0\.8860\.886\.
- •Hypothesis B\(directional account\): Pop CCP atM1M\_\{1\}induces downstream shift of comparable magnitude to Pop CCP atM3M\_\{3\}, but along a quality\-aligned direction, so net quality gain exceeds disruption cost\. This was consistent with the data: terminalM4M\_\{4\}cosine0\.8390\.839\(Pop CCP @M1M\_\{1\}\)≈\\approx0\.8370\.837\(Pop CCP @M3M\_\{3\}\), yetΔ​F=−0\.191\\Delta F\{=\}\{\-\}0\.191\(improvement\) vs\.\+0\.243\+0\.243\(Hazard\)\.

## Appendix LInter\-Judge Agreement Validation

To validate Gemini 2\.5 Flash as the judge, we re\-scored a stratified sample of5050𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}tasks across all four modules \(n=200n\{=\}200assessments\) using GPT\-4o as an independent cross\-family judge with the same rubric \(§[3\.1](https://arxiv.org/html/2605.21958#S3.SS1)\)\.

#### Results\.

Krippendorff’sα=0\.772\\alpha\{=\}0\.772and Pearsonr=0\.814r\{=\}0\.814\(p<0\.001p\{<\}0\.001; Spearmanr=0\.782r\{=\}0\.782\) indicate substantial agreement\. Mean absolute severity difference is0\.0880\.088\(on a\[0,0\.99\]\[0,0\.99\]scale\)\. Per\-module:M1M\_\{1\}\(α=0\.657\\alpha\{=\}0\.657\),M2M\_\{2\}\(α=0\.686\\alpha\{=\}0\.686\),M3M\_\{3\}\(α=0\.128\\alpha\{=\}0\.128\),M4M\_\{4\}\(α=0\.717\\alpha\{=\}0\.717\)\.

M3M\_\{3\}’s lowα\\alphareflects ceiling compression \(most tasks score≈0\.95\\approx 0\.95under both judges\)\. Three complementaryM3M\_\{3\}\-specific checks confirm the core finding is not a judge artifact: raw Pearsonr=0\.615r\{=\}0\.615\(p<0\.001p\{<\}0\.001\) shows substantial linear correlation; binary agreement atsev≥0\.5\\mathrm\{sev\}\{\\geq\}0\.5is80%80\\%; and theM3\>M1M\_\{3\}\{\>\}M\_\{1\}direction is preserved on42/5042/50tasks \(84%84\\%\) under GPT\-4o, ruling out a single\-judge artifact for the Diagnostic Paradox\.

## Appendix MFFValidity Against Behavioral Tool\-Match

A common concern with LLM\-judge metrics is thatFFmight be internally consistent yet disconnected from the agent’s actual behavior\. We test this by correlating per\-taskFFwith thefirst\-action tool\-name match: a deterministic, non\-judge behavioral metric that compares the agent’s first emitted tool name against the cached oracle gold \(no judge involvement\)\. Results are in Table[11](https://arxiv.org/html/2605.21958#A13.T11)\.

Table 11:FFcorrelates strongly with first\-action tool\-name match across splits and agent families\.p∗⁣∗∗<0\.001\{\}^\{\\ast\\ast\\ast\}p\{<\}0\.001\.Δ​F¯miss−match\\Delta\\bar\{F\}\_\{\\mathrm\{miss\{\-\}match\}\}= meanFFon tool\-match\-failure tasks minus meanFFon tool\-match\-success tasks\. Qwen3\-32b is excluded as the𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}sample \(n=50n\{=\}50\) is too small for reliable correlation estimation\.On the prescription split where the Diagnostic Paradox lives,FFcorrelates with behavioral tool\-match atr=−0\.90r\{=\}\{\-\}0\.90\(p<10−40p\{<\}10^\{\-40\}\), with tasks failing tool\-name selection scoring2\.812\.81FF\-units higher on average than tasks succeeding\. The correlation is weaker but still highly significant on𝒟diag\\mathcal\{D\}\_\{\\mathrm\{diag\}\}, where tool\-match ceiling effects compress the range \(97\.6%97\.6\\%match rate for gpt\-4o\-mini means onlyn=12n\{=\}12failure points\)\. This rules out the concern that theM1M\_\{1\}\-vs\.\-M3M\_\{3\}Paradox is an artifact ofFFbeing judge\-internal: when the agent fails to call the gold tool,FFrises sharply, and the directional relationship holds across both cross\-family agents\.

## Appendix NLinguistic Typology ofM3M\_\{3\}Routing Errors

App\.[H](https://arxiv.org/html/2605.21958#A8)shows that oracle injection atM3M\_\{3\}yields the largest improvement of any configuration \(gpt\-4o\-miniΔ=−2\.007\\Delta\{=\}\{\-\}2\.007; Llama 4 ScoutΔ=−1\.795\\Delta\{=\}\{\-\}1\.795\), confirming thatM3M\_\{3\}is improvable when given the exact gold output—yet CCP atM3M\_\{3\}causes harm\. A coarse classification ofM3M\_\{3\}baseline\-vs\.\-oracle differences on a subsample of𝒟presc\\mathcal\{D\}\_\{\\mathrm\{presc\}\}explains why:

- •*Slot\-value format error*\(majority\):M3M\_\{3\}selects the correct tool but provides arguments in the wrong format \(e\.g\., a descriptive item name instead of a catalog numeric ID\)\. Oracle injection directly substitutes the goldtool\_args\.
- •*Tool\-name mismatch*:M3M\_\{3\}selects an adjacent\-but\-wrong tool \(e\.g\.,modify\_pending\_order\_itemsvs\.modify\_pending\_order\_address\)\.
- •*Argument sigil variance*: minor string\-format differences in order IDs or payment method identifiers\.

Category \(i\) dominates\. When CCP injects correction triples of the form \(input, wrongtool\_args, oracletool\_args\), it shiftsM3M\_\{3\}’s output distribution toward oracle argument formats—an executable\-semantic change that downstreamM4M\_\{4\}, co\-adapted to the original noisy distribution, cannot absorb\. This is the Linguistic Contract at work: the oracle injection upper bound is achievable, but only because it substitutes the output directly; CCP, which shifts the prompt, instead disrupts the downstream alignment and produces the Hazard\.