“Our agent silently half-finishes tasks”

Agents run long and processes restart - a deploy, a timeout, an OOM. If state lives in memory, the user sees a silent failure and a half-finished task with side effects already committed.

The fix is unglamorous: checkpoint every state transition to Postgres, make every tool call idempotent so a replay cannot double-charge or double-send, and make the final answer structurally depend on every tool result being present. When something is missing, the agent surfaces an explicit incomplete state rather than writing around the hole.

That last part matters more than any prompt change. A tool erroring is easy - it is loud. The expensive failure is three of five tool calls landing and the summary reading as though all five did.