A restarted agent can correctly recover its work and still send the same message twice.
That happens when execution recovery and outbound-delivery recovery share a vague notion of “done.” A session transcript may show that a tool call finished, while the delivery path still has a pending outbound item. After a restart, both the old pending item and a newly reconstructed item can be sent.
The fix is to model these as two separate state machines.
Execution recovery is not delivery recovery
Execution recovery answers: did the agent finish the unit of work?
