Retrying a timed-out tool call can make an AI agent refund the same order twice

"A timeout describes what the caller observed. It does not prove what the external provider did," the post says ^[2]. Its author does not treat this as a model problem or as AI hallucination. The post describes the underlying problem as distributed-systems uncertainty at the boundary between intent and external effect ^[11]. The worked example is a refund. The same failure covers a second email, booking, order, paid resource or deployment ^[10].

Agents do not change the underlying problem. They add ways to repeat. The post counts eight ^[1] and says each one can be reasonable on its own ^[12]. The danger comes when one of them crosses a side-effecting boundary without carrying the identity and outcome of the logical action ^[12]. I think that rules out guarding at any single layer. A framework's retry counter has no view of a supervisor redispatch or a checkpoint resume ^[4]. A user typing "try that again" is a retry path too, and nobody attached a counter to it ^[4].

The post's fix separates two identities. Transport identity answers which attempt this is. Logical identity answers which real-world action it is ^[6]. Request IDs, tool-call IDs, trace IDs, retry counters and timestamps usually identify attempts ^[5]. A key like refund / order_123 should stay the same across every retry of that one refund, even as each attempt gets a new request ID ^[5].

The second half of the design is the best part of the post. The operation identity has to be bound to the fields that change the effect: amount, destination, message body, recipient, resource configuration ^[7]. The example reuses send_invoice_4821 with [email protected] on attempt 1 and [email protected] on attempt 2 ^[7]. That pair must produce a conflict or a new intentional operation. Otherwise the deduplication layer collapses two distinct actions into one ^[7].

The execution model has at least three outcome states. The rule the post calls critical is "UNKNOWN is not permission to execute again." ^[8] "This sounds conservative because it is," it adds ^[13]. The cost falls on liveness. When provider truth is unavailable, a high-impact operation may stay blocked until a human or a trusted system resolves it ^[9]. The post accepts that cost where a duplicate would be expensive or irreversible ^[9].

The post leaves the resolution step to that human or trusted system ^[9]. The logical identity is what would let a machine do the check. The question for the payment provider is whether refund / order_123 exists. Attempt 2's request ID cannot ask that question ^[5][6].