Agent runtimes ship checkpoint, fork and restore without deriving what those operations must preserve.

An edit cannot un-authorize a permission already granted or un-send a tool request already in flight, and the paper shows an unsafe edit can authorize the same action twice, discard a result the task still needs, or conflict with a call that started before the edit (arXiv 2608.22928). Their algorithm decides exactly whether a given edit is safe, returning all safe continuations or a checkable proof that none exist. Anyone building session forking into an agent product should read this before shipping it.