When an AI Agent Restarts, Its Unfinished Work Doesn't: Making Sure Nothing Gets Done Twice, Lost or Wrongly Marked as Finished

Long-running AI agents survive process restarts, failover, live migration, provider substitution and connectivity loss. Their external operations do not stop when the process does: a payment may already have been accepted, a callback may arrive at the old endpoint, a second runtime may still be active, a quota reservation may be missing from the snapshot, and the replacement tool may have different side effects. A restored checkpoint, a new lease or a received callback is therefore not evidence that anoperation did not happen, that it is final, or that the new runtime may act. This disclosure describes a vendor-neutral, non-actuating method for reconstructing recovery state with evidence. The original mandate is kept separate from execution state, and task, instance, generation, logical operation, attempt and external transaction identities are tracked separately. Outstanding operations and their exposure (spent nonces, reserved quota, pending liabilities) are enumerated before handoff. A new, non-reused execution generation is fenced at the actual effect boundary so that a stale owner cannot cause effects, in the manner of fencing tokens. Callbacks to old or new endpoints are authenticated, correlated and deduplicated as historical evidence without granting ownership. Authorization use and quota are reconciled across regions so that an unknown reservation is never restored as available. Resumption requires current authority, semantic equivalence of the provider’s tool and proven retry safety; under connectivity loss only bounded, non-effective work continues. Two separate three-valued verdicts are produced — continuation evidence and external-outcome evidence . so that an unknown outcome is never rewritten as success, failure or cancellation. The document provides a 48-stage, six-phase engineering workflow with gated flowcharts, six detailed embodiments, a typeset 20-page mathematical specification (J-M01–J-M52) with conditional proofs and counterexamples, 40 engineering checkpoints, a comparison with existing approaches (durable workflow engines, CRIU and VM live migration, leader leases and fencing tokens, consensus, idempotency keys, webhook signing, distributed rate limiting, API versioning and saga patterns) and a non-actuating reference evaluator in Python, JavaScript and Go with 122 shared synthetic vectors, all passing. It is not a consensus protocol or an enforcement mechanism; the laboratory is synthetic, self-authored and not peer reviewed. The author is open to acquihire or strategic collaboration. Keywords: AI safety; persistent agents; long-running agents; runtime migration; failover; checkpoint and restore; fencing tokens; execution generation; split-brain; asynchronous callbacks; webhook correlation; idempotency; retry safety; distributed quota; authorization continuity; provider compatibility; partition tolerance; three-valued logic; durable execution