What a checkpoint contains, literally.
Guest memory: the full RAM image of the micro-VM, including every process, open file handle, and the agent harness mid-thought
Disk overlay: every byte the session wrote: workspace edits, build artifacts, installed packages
Device state: the virtual machine state file: vCPUs, timers, virtio devices
The two ledgers: the host event log and the in-guest transcript, reconciled by sequence number before the agent wakes
What it deliberately does not contain.
The model provider's server-side state (prompt caches, KV caches) belongs to the provider and cannot be frozen from outside; a resumed session re-warms it on first use. Interrupted model CALLS are a separate mechanism: the gateway stores completed responses and replays them on retry, so the tokens already bought stay bought.
Corruption refuses to restore: a checkpoint with one flipped byte fails content addressing and no machine boots from it. A checkpoint that cannot be trusted is a checkpoint that does not run.
Where checkpoints live.
On the hosted fleet, checkpoints live in KeepState storage as content-addressed chunks, deduplicated before they are ever billed, and kept while your account exists with no automatic expiry, per the published retention and deletion policy. The storage meter charges the deduplicated footprint, and account-deletion tests are separate from customer per-session deletion. Deleting a session erases the content only it held, in production since 6 October 2026; stopping a session does not delete its saved content.