Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs

Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state. We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts while weakening the boundary metadata that governs how those facts may be used --- a failure mode we call summary collapse. On a controlled multi-agent coordination testbed with a judge-based marker-survival measure σb (human-validated, κ = 0.74), boundary-marker and operational-fact survival are nearly uncorrelated at the handoff level on both GPT-5-mini and DeepSeek-R1-32B (Pearson r near zero); under a $25$-word compression budget σb falls sharply while operational survival stays near ceiling. Controlled downstream tests reveal that protection depends on boundary explicitness: vague hedges like ``use discretion'' leak in $73%$ of GPT and $50%$ of DeepSeek cases, while explicit constraints reduce leakage to under $15%$ across all three tested models. A no-handoff single-agent control further shows the failure is not reducible to multi-agent topology --- direct full-marker access still leaks more often than the operationalized handoff. Prompt-only mitigation and exact-string redaction each address only part of the failure, while a gold-derived typed audience-allowlist probe eliminates leakage on both primary models and stays far below the no-marker control in a Qwen3-32B replication, isolating boundary operationalization as the load-bearing axis.