Failover saves the call, not the run. If the provider fails mid-agent run, the second provider starts without knowing which tool calls have already been written, and the retry on a non-idempotent write simply creates the record twice. Without an idempotency key for each tool call and a checkpoint after each write, two providers make you available, but not correctly.