Does tool_error flag a single failed tool call?

No. tool_error watches a tool’s failure rate over time, not any individual call, so one failure sitting inside a tool’s normal error rate doesn’t move the statistic far enough to fire.

Most tools fail sometimes: a timeout, a malformed request, a flaky dependency. Treating every one of those as an incident would bury a real problem under noise from calls that were never going to cross any bar. Evidence instead accumulates call by call against each tool’s own baseline, and it’s a rate that’s shifted, several failures clustering where the tool used to be reliable, that crosses the threshold and becomes a finding.

That also means it won’t catch a single high-stakes failure the moment it happens; a lone bad call inside an otherwise healthy rate is invisible to this classifier by design. Catching one specific failure regardless of the surrounding rate is a different kind of check.