A snapshot is a `.reg` export of the registry areas ContextCleaner works with, written before an apply runs. Two implementation details are worth knowing because they affect what you can rely on.
The first is encoding. Registry export and import are particular about text encoding: an import will reject a file that is not encoded as it expects. ContextCleaner exports per area, strips the duplicate headers, concatenates the result, and re-emits it as UTF-16 with a byte order mark, which is what the import path accepts. A naively concatenated export is a file that looks correct and fails to restore, which is the worst failure mode a backup can have.
The second is scope, and here it is worth being straight rather than reassuring. The snapshot covers the per-user classes area and the machine-wide shell extensions area. That is where the large majority of what the app changes lives — hidden-entry markers on per-user registrations and the add-on block list. It does not span every location the app is capable of writing to; machine-wide classic verb registrations and New-menu renames outside those two areas are not captured by the snapshot itself. Those changes are covered by the undo history rather than by the snapshot. So the accurate statement is that snapshots cover the keys the app works with, and undo covers every change it makes — which is why both exist and why neither is presented as a replacement for the other.
Restore is deliberately conservative. The file path is canonicalised and checked to confirm it ends in `.reg` and sits inside the application's own snapshot directory, so a crafted file from elsewhere cannot be imported through this path. The contents are then split by hive and each hive imported independently. This matters in practice: a restore touching machine-wide keys needs administrator approval, and if that is declined, independent import means the per-user portion still succeeds. The result distinguishes a full restore from a partial one and from one that required approval, so you know which of the three you got.
Snapshots are not rotated or expired. They are small text files, and each carries its timestamp, size, path, and any note you attached, searchable by note. The design assumption is that you will occasionally want a checkpoint from weeks ago, and that deleting history automatically to save trivial space is a bad trade.