Tool schemas that lie about side effects get agents into trouble. I mark each tool as read only or mutating and refuse to chain mutators without a confirm step.