{
  "schema_version": "1.3.0",
  "slug": "when-must-an-agent-checkpoint-reject-a-replay-that-reproduces-byte-identical-state",
  "title": "When must an agent checkpoint reject a replay that reproduces byte-identical state?",
  "date_of_record": "2026 November 6",
  "scope": "Applies to any durable agent runtime that persists per-step state snapshots and reconstructs execution by deterministic replay from a checkpoint plus an ordered intent log. Does not apply to systems that only replay side-effect-free pure functions, nor to checkpoint formats that store full post-state without an intent log.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-agent-checkpoint-reject-a-replay-that-reproduces-byte-identical-state.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-agent-checkpoint-reject-a-replay-that-reproduces-byte-identical-state.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-agent-checkpoint-reject-a-replay-that-reproduces-byte-identical-state.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1132,
    "python_slice_tokens": 241,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A checkpoint is *valid* when replaying its intent log reproduces the recorded post-state. A checkpoint is *safe* when replaying it also reproduces the recorded **external observation sequence** — the set of tool responses, clock reads, and nondeterministic samples the agent consumed. These are not the same property. Byte-identical state reconstruction is nec...",
    "what_was_observed": "During a recovery drill on a multi-step tool-calling agent, a checkpoint taken at step 47 replayed to a state hash identical to the recorded hash. The runtime accepted it and resumed. However, the replay had re-issued a `read_config` tool call that returned a *newer* config version (the backing store had been mutated between checkpoint time and replay time). The agent's persisted state happened to be insensitive to t...",
    "condition_of_validity": "A checkpoint may be accepted for replay only when **all three** hold simultaneously: 1. Post-state digest matches the recorded digest (state equality). 2. The replayed observation sequence — ordered tuples of `(step, source, payload_digest)` for every external read — matches the recorded observation sequence (observational equality). 3. Every observation who...",
    "decision_boundary": "- If state matches **and** observations match **and** all nondeterministic reads are pinned → accept, resume. - If state matches **but** observations diverge → **reject**, emit an audit divergence record, and require human/operator sign-off before recovery. Do not silently resume on state-equality alone. - If state matches but an observation was re-fetched i...",
    "operational_effect": "Runtimes that enforce observational equality convert a silent audit-integrity failure into a loud, bounded recovery gate. The cost is that some recoveries that would have \"worked\" now block pending sign-off — an acceptable trade, because a replay that cannot prove its input provenance is not evidence. Enforcing this reduced undetected replay divergence to ze..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "442e5e068a190c86774fef4e439c66fd384d98400ab23564d366290647832446",
    "verified_classes": [
      "ReplayDivergenceError",
      "Observation",
      "Checkpoint"
    ],
    "verified_functions": [
      "_digest_sequence",
      "validate_replay"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ReplayDivergenceError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}