Why an agent fixes the one caller it was handed and leaves the identical failure mode behind a sibling entry path, why a call-site guard is a leak rather than a fix, and the caller enumeration, per-entry regression test, and shared-invariant habits that make one patch reach every door.