That’s a fair concern. I’d expect multi-shot handlers to be relatively rare and mostly something library code uses rather than a day-to-day utility. But an LLM given free rein may decide to behave differently.

For now, I am looking into making a clearer distinction between one-shot and multi-shot handlers so we can reject cases where resuming again would be unsafe, like around filesystem writes.

More to explore here, certainly.