An agent that passes its tests has only ever seen two outcomes from a tool call: success and failure. Production has a third one: unknown.
The call times out. The charge may or may not exist. The transfer may or may not have been submitted. Nothing in the agent's context separates "did not happen" from "happened, and the answer got lost on the way back". In an eval harness that gap never opens, because the stub always answers.
So the agent does the reasonable thing and retries. In a read-only world a retry is free. On money rails a retry is a second intent.
The repair is not a better prompt. It is tool design.
Every writing tool takes an intent key supplied by the caller, and a replay returns the original outcome instead of performing a new one.
Every tool declares whether it is reversible. Irreversible calls do not get blind retries: they get a reconcile step that asks the provider what happened to that intent, and only then decides.
"Unknown" becomes a value the agent can hold and act on, not an exception string it has to interpret.
What that buys you is simple: the retry turns into a read. Correctness stops depending on the model's judgement about an ambiguous error, and that is precisely the part you cannot test, because it varies run to run.
Most reliability work in production agents does not sit in the model. It sits in making the surface it acts on replay-safe.
I went deeper on how I design that layer here: https://polycratia.com/c/01a7696b
If you are running agents against real side effects, it is probably worth checking whether your tool layer returns "unknown" or just collapses it into an error.