During a 20-minute backend outage, lookup_order returned an empty result list, the same response it gives when no order matches. The agent told dozens of customers that their order "does not exist in our system," which generated complaints. What change most directly prevents this?

Answer: B — Have lookup_order report access failures as errors (isError true, transient, retryable) and return an empty list only when a query succeeds but finds no matching order.

The root cause is that the tool merges two different outcomes: an access failure that needs a retry decision and a valid empty result (task 2.2). Once they're distinct, the agent can retry or tell the customer about a temporary problem instead of denying the order exists. Asking customers to re-check (a) blames them during an outage, and the agent still can't tell the two cases apart. Calling twice (c) fails during any outage longer than a few seconds and wastes calls on the ordinary not-found case. A health-check tool plus blanket escalation (d) adds a call to every conversation and overloads humans during the outage, all to work around an ambiguous response that structured errors fix at the source.