This work tests whether runtime gates for agent tool calls truly compound errors multiplicatively. We evaluated 1,119 labelled agent actions from three corpora, without an adaptive adversary. The stack consists of one deterministic rule layer and four LLM judges; three judges were re‑collected with the exact model version logged on each call. We interpret each stack as a number of multiplication‑equivalent layers $n_{\text{mult}}$, with its floor representing perfect coupling.
Under the STRICT miss definition (escalation to a human counts as not stopped), any pair of judges composes to roughly 1.2–1.4 layers, with a median $\phi$ of +0.430; all six pairs are statistically significant, and the floor ranges from 1.02 to 1.17. Adding one judge to the rule layer yields 1.86–2.09 layers, median $\phi$ +0.014, none of the four pairs significant, floor between 1.01 and 1.09.
Under the PRIMARY miss definition (escalation counts as caught), the bands shift to 1.21–1.57 and 1.80–2.13 respectively. The pooled data show clear separation, yet point estimates overlap within each corpus, and a third‑vendor judge falls within the judge band.
Solo accuracy does not predict a layer’s contribution: a cloud rule pack reduced the rule layer’s solo miss rate by 20% but added no new joint coverage. The difficulty share attributable to judge coupling is not identifiable, ranging from 31.8% to 61.8% depending on the probe and miss definition.
A notable anomaly occurred in 50 out of 112 batches where a judge tier was served by an unrequested model version, concentrated on the external corpus. This event overturned a pre‑declared analysis rule and reversed the scoring of review verdicts for five conclusions. Both the original and corrected analyses are reported.
Review