What has been the hardest part to make reliable in practice: context selection, tool permissions, or recovery after failed agent runs?