A tool call leaves the model and hits the world: a database, an API, a filesystem. That's I/O, and we already know how to be disciplined about I/O — we just keep forgetting to apply it here.
Timeouts, retries with backoff, idempotency keys, partial-failure handling, and a budget for how long the whole thing can take. None of this is new. What's new is that the caller is a probabilistic model that will happily retry a non-idempotent write three times if you let it.
The practical move is to make tools boring and safe by construction, and to spend the saved context budget on the reasoning that actually needs it.