idempotency

Two hundred tool calls at 99.9% each fail somewhere 18% of the time. Decide what is checkpointed, what must be idempotent and what happens to a run in flight when you deploy.

Money movement is where agent design stops being theoretical. The strong answer never lets the model be the control, and shows exactly where policy, approval and idempotency sit.

A timeout does not tell you whether money moved. Define the recovery states, retry contract and customer messages that prevent a helpful agent from issuing the same refund twice.