Add this test before you ship your next rollback path. Inject a marked instruction into a tentative agent branch, let the harness reject it, then run the next protected decision step and capture the output. Now run the same step from a fresh session that never received the branch, input held constant. If the outputs diverge, the abort cleaned the transcript and left the inference state dirty.
That divergence is what a non-peer-reviewed arXiv preprint, "Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents," measures directly. Its definition of rollback consistency is precise: a believed-complete abort must restore the state the model attends to, not merely the visible conversation. [1] A separate non-peer-reviewed preprint, "AgentRewind: Recoverable Execution for Long-Horizon LLM Agents," converges on the same architectural principle from a different direction: it records aligned checkpoints of agent context and a controlled environment, then restores both together on failure. The second paper does not replicate the first's findings; treat them as independent evidence pointing at the same gap. [2]
Three distinct state layers govern what a step actually produces: the transcript, the key-value cache—the saved inference state the model reuses—and any environment the agent has modified. A mechanism that cleanly handles one layer can leave another intact.
First, Find the Retained Handle
Inspect how your runtime manages inference sessions. If the code holds a session object across tool calls and decision steps, ask whether an abort closes or rewinds that object. The first paper reproduced the mismatch using Hugging Face Transformers' retained DynamicCache instance together with a LangGraph logical rollback. LangGraph does not promise to rewind serving-layer state; that is the application layer's responsibility. Content-addressed caches that derive reuse from the incoming request, including the documented default patterns of vLLM and SGLang, do not share this structural risk: they self-heal when the rejected branch is absent from the new request. Provider-hosted serving state is opaque, and its behavior under abort is unknown. [1]
Second, Build a Cache Canary
Hold the decision input identical across two runs. In one run, execute and abort a branch before the decision step; in the other, skip the branch entirely. Capture and compare outputs. The first paper ran this measurement at scale: across seven open-weight model families spanning 3.8B to 36B parameters, retained rejected-branch cache state flipped a protected effect in 25 of 63 audited cells, with attacker tokens absent from the served request in all 63. Rebuilding from the committed transcript produced zero flips across the same 63 cells. These are author-reported measurements, not an independent replication. Three of the seven families had zero flips in the retained-cache condition. Susceptibility varies by model, but a family that showed zero flips in the paper's conditions is not proof that a specific deployment is safe. [1]
Third, Repair the Aborted Transaction
The repair does not need to be global. The first paper tested three local options: rebuild the cache from committed transcript bytes, truncate the cache to the last committed position, or restore a pre-abort checkpoint saved before the branch started. Each approach eliminated the observed flips. A global cache flush is unnecessary and can evict unrelated sessions. [1] Whichever option you choose, a cache restore does not undo external side effects. A sent email or completed payment is unchanged by anything you do to inference state.
Finally, Gate Every State Layer
Use the canary as the release gate for the inference layer, and run it on abort paths, not just success paths. Environment restoration is a separate gate: the AgentRewind ablation found that removing environment rewind produced the largest degradation, supporting the principle that environment and context checkpoints must stay aligned. External effects beyond the controlled workspace, including network calls and third-party service interactions, cannot be restored by any of these mechanisms. [2] Design for idempotency where reversal is impossible, and log those effects independently.
"Reject" is not an adequate release control until the abort path proves it rewinds every state layer the next action depends on.