A tool call that times out is a failure the agent can see and route around. A tool call that hands back a cached error page, a stale record or a negative price arrives in exactly the expected shape, and gets consumed as fact. Outcome Monitors check each result against invariants mined from unrelated traces or read off public schemas, and on a violation they block nothing: the raw result is passed through with a short receipt naming the broken property and listing public tools that could get the value another way. Completion under injected faults goes from 10.9% to 28.1% across four models — and stripping just the tool list out of the receipt erases the whole gain.
The paper's split is between explicit failures, which the runtime surfaces as errors, and implicit ones, which do not look like failures at all. Its hardest cases come from a published production-incident taxonomy: an error page returned as the body of a successful response, a reference silently substituted for another record, a write that reports success and changes nothing. Step through the shapes and watch what the raw interface gives the agent, and what a mined contract catches.
The pattern in the detection numbers is worth holding onto: faults that corrupt a value — a field that shifted, a state that went stale, a write that did nothing — are caught 83–91% of the time, because a contract can state what the value must satisfy. Faults that corrupt the inside of a string — an error page pasted where the description should be — are caught 22% of the time, because the string is still a string.
An outcome contract is a checkable relationship between what you sent and what came back: the identifier you passed echoes in the result, a price stays positive, a status comes from a known set, a total still equals the sum of its parts, timestamps stay ordered. Contracts come from one of two places, and the paper runs both against the same tasks — mined from traces of other tasks in a five-fold cross-fit, or read straight off a public API schema. Switch the source and watch what changes.
The schema arm is the cheap one — no trace mining, just the published response shape — and it gets two-thirds of the effect while firing half again as many receipts, most of them naming no alternative tool at all. That is the same lever the next section isolates: a receipt without somewhere to go is close to worthless.
The monitor never blocks a call and never repairs a value. It appends an advisory note to the tool result: a machine-readable violation code with the path and the expected-versus-observed values, a human-readable line about the broken property, and a list of public tools that could get the same value another way. The paper then re-runs the study with parts of that note removed. Build a receipt below and watch the measured completion delta move.
Every null contrast in this panel had the power to detect about an 18-point effect, so these are not underpowered near-misses — vaguer wording and later delivery genuinely do not matter. What matters is whether the agent is handed somewhere else to go. Detection alone, delivered perfectly, is worth about a point.
Across six frozen studies the size of the gain tracks one thing: how often the faulted agent finished the task anyway. Where the corrupted value blocks completion, the receipt is worth 15 to 28 points. Where the agent could finish regardless — a missing field it did not need, a total it never read — the effect is zero, with rescues and harms cancelling out. Drag the baseline slider to see which regime you are in.
On clean runs with no fault at all the monitor is neutral: 74 of 114 completions in both arms, sixteen false-trigger receipts, five paired rescues and five paired harms. It is not a free win, but it is not a tax either — and the reviewer-loop alternative the paper ports for comparison buys a third of the effect for roughly five times the cost.
The shape in production: an agent calls a handful of partner APIs, and some small fraction of those calls come back well-formed and wrong — a cached page, a stale record, a zero where a price should be. Set your volume, how often a call returns a silently bad value, and how often that bad value is the thing that blocks the task. Detection recall per family is the paper's; the recovery rate applied is the paper's blocked-regime gain.
The number that should decide whether you build this is the middle column: how many of your silent failures are value-shaped — a price, a status, an identifier, a total — versus buried inside free text. The first kind is a twenty-line schema assertion. The second is still an open problem in this paper.