What pattern ensures a long-running multi-hour agent workflow can recover from server crashes without re-executing completed tool calls?