A hash with a hole in it
Our change detector digests inode metadata to decide whether to look. Leave one field out of that digest and an agent can edit a file without any checkpoint ever noticing.
Tagged
Container-ness is the wrong question
We wanted to know when we could serve an agent's workspace with kernel overlayfs instead of our own FUSE server. Asking "are we in a container?" gets that wrong in both directions.
The delete that wasn't there
Two filesystems spell "this file is deleted" differently. We read one of those spellings straight into a branch that discarded it, and nothing errored — the next restore resurrected every file the agent had removed.