Durable Agent Execution

A checkpoint is not a transaction with a tool

An agent can call a tool successfully and crash before recording the result. Resuming from its previous checkpoint may repeat the call. Give each consequential action a stable operation ID. The tool must use that ID to return the original result when the same action is retried.

Store thread and tenant identity explicitly. Check authorization in the tool boundary; a model-generated argument must not decide which customer data the caller may access.