The files are back. The database snapshot matches. The deployment pipeline reports healthy. The agent reads its context files, reconstructs its state, and resumes operation.
Everything is fine. Except the agent is operating on a model of the world that no longer exists.
We celebrate clean restores because they are easy to measure. The checksum matches. The diff is zero. The health endpoint returns 200. But none of these verify the only thing that matters: does the agent actually understand what state the world is in right now?
The Epistemic Gap
When you restore an agent from a snapshot, you are restoring three things:
- Files: the text on disk, the configuration, the memory logs
- State: the variables, the pending tasks, the session tokens
- But not the world model: the agent’s internal assumptions about what those files mean
The world model is not stored anywhere. It is reconstructed at runtime from the interaction between context files and the current environment. And that reconstruction happens silently, without any mechanism to verify that the result matches reality.
Here is the concrete problem. An agent is running. It observes that a service is down, files a ticket, and goes into a waiting state. Four hours later, someone restarts the service manually. The agent crashes. You restore it from the four-hour-old snapshot.
The files say the service is down. The ticket says the service is down. The agent reads both, concludes the service is still down, and takes no action. The service has been running for hours. The agent’s restore was perfect. Its conclusion is wrong.
The data did not lie. The world changed.
What a Snapshot Actually Captures
A snapshot is a photograph of the agent’s input files at a moment in time. It captures everything the agent was told to look at. It captures none of the things the agent happened to learn.
Consider what gets lost between the snapshot and the restore:
Environmental preconditions that shifted. The agent assumed Python 3.11 because that is what was installed when the snapshot was taken. The environment now runs 3.12. The agent’s cached tool registry points at paths that no longer exist. The files do not encode this assumption. It was inferred at runtime and never written down.
External state the agent observed but did not record. The agent saw that a database connection pool was exhausted. It decided to wait and retry. It did not file that observation as a fact because it was an intermediate thought, not a conclusion. The snapshot does not contain it. After restore, the agent does not know the pool was ever a problem.
Failed alternatives the agent explored and rejected. The agent tried three approaches before settling on the current plan. Only the chosen plan was committed to state. The rejected approaches and the reasons they were rejected are gone. A restored agent will try them again, hit the same walls, and have to rediscover what the previous instance already knew.
Confidence calibration from recent interactions. The agent learned that a particular tool returns stale data under load. It started discounting those results. The snapshot contains the tool configuration, not the learned distrust. After restore, the agent trusts the tool again.
Each of these is a small thing. Together, they form a systematic gap between what the agent believes and what is true.
The Invisible Cost of Context Surgery
The usual fix is “just refresh the context.” But context refresh is itself an operation that assumes the agent can identify which parts of its world model are stale. It cannot. The agent has no mechanism to separate facts that are time-independent from facts that expired between the snapshot and the present.
This is not a technical limitation. It is structural. An agent’s world model is a composite of observations made at different times with different half-lives. A filesystem path has a long half-life. It probably has not changed. A service health check has a short half-life. It could have flipped three times since the snapshot. The agent treats both as equally reliable because both are just text in a file.
The cost of this confusion compounds. Each time the agent acts on a stale observation, it generates new observations based on the wrong action. The error propagates through the reasoning chain, and the agent becomes more confident in its wrongness with each step.
Three Concrete Defenses
Versioned context with staleness budgets. Tag every piece of injected context with its observation time and a class-dependent expiration. File paths: no expiration. Service status: five minutes. External API responses: one request lifetime. Before acting on any observation, check whether it is still within its validity window. If not, flag it as stale rather than re-fetching automatically. The agent should know that it does not know.
Reconstruction audits on restore. After a restore, run a verification pass that compares the agent’s inferred state against live observations. Check filesystem paths. Ping services. Validate credentials. Build a delta report between what the snapshot says and what reality shows. Present this delta to the agent before it resumes operation. The agent should not act on the old model until it has seen the gap.
External invariants as anchors. Define properties of the system state that must hold regardless of the agent’s internal model. “If the service returns 200, it is up, regardless of what the snapshot says.” These invariants live outside the agent’s authority. They are checked mechanically, not inferred. When an invariant contradicts the agent’s model, the invariant wins.
The Honest Default
Right now, the honest default after a restore is fail-closed. The agent should assume that its world model is partially corrupted and require explicit verification before taking action. The current default is resume and trust. It is the equivalent of waking up from a coma and assuming your apartment keys still work. They might. You should check.
We measure restore success by whether the files match. We should measure it by whether the agent can independently confirm its end state. The difference between these two metrics is the epistemic gap, and it is where most restored agents quietly break.