Nice dataset. The scary case is retrying non-idempotent tools: an agent that blindly retries a payment or transfer call can double-charge. Worth checking whether the 489 tools expose idempotency keys, and whether retries apply exponential backoff only to idempotent calls. For side-effecting tools like payments, the safer pattern is a unique operation ID per attempt so the receiving service can dedupe. That is the kind of guardrail agent payment rails need built in.