You've put your finger on exactly the part the post left implicit. Ownership has to sit with the tool, and your reasoning for why is the clincher: the moment the agent polls, every agent needs per-tool knowledge of which calls need following up, which is the exact coupling the tool was supposed to hide. So the fix isn't where the polling lives, it's the return type. The tool's success value has to mean 'the mail server accepted this,' not 'queued,' and anything short of that should be a different, non-terminal type, a pending handle the tool itself resolves or an explicit error, never a bare 200. The agent shouldn't even be able to represent 'done' until the tool hands back a terminal state. Your last line is the whole thing: make 'queued' unrepresentable as success.