Gating irreversible actions works only if the harness mediates every side effect, not only the branch awaiting approval. Where a gate suspends its own branch while a sibling's effect still executes, the control reads as a barrier and is not one — and the shipped implementations in widely used agent frameworks have this gap rather than it being a misconfiguration.

Differential probes found the sibling leak in every framework shipping a pre-execution gate (five of six, across four execution models and two language runtimes), plus replay double-execution, cancellation orphans and timeout zombies. Live models leaked 215 of 1,200 runs. An environment-external admission gate enforcing complete mediation blocked every measured violation with no legitimate refusals, which isolates mediation as the property doing the work.