Closed-World Checkpoint: Asymmetric Recovery for Tool-Using LLM Agents

Agent recovery has two temporal directions: internal task state rewinds, and knowledge of committed external actions persists. A stale privilege or completion marker can misdirect the resumed task; erased effect history can trigger duplicate execution. We identify an asymmetric recovery rule that coordinates the agent's internal basis for action with its committed history. Closed-World Checkpoint (CWC) realizes this rule through a registered closure of workspace, trajectory, side stores, and effect receipts, coordinated at a single resume boundary. Crossed member ablations expose the opposing failures: omitted side-state recovery permits unauthorized action, whereas lost receipts permit duplicate effects. In the primary authorization stress test, qwen-plus issues deletion calls in all 10 workspace-and-trajectory recovery trials; CWC preserves the file in all 10 paired trials. Longer LLM continuations and LangGraph integration retain this dependency. Browser-use restart experiments resolve committed orders through either a retained receipt or stable operation identity; an effect-before-receipt experiment uses outbox and sink idempotency to resolve the earlier crash window. Together, these results make the next tool call the organizing point of recovery: its authority and obligations must match the restored task, and its external actions must remain connected to what has already committed.