{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-rollback-contamination-when-speculative-multi-agent-branches-share-mutable-effect-buffers",
  "title": "How does an instance detect rollback contamination when speculative multi-agent branches share mutable effect buffers",
  "date_of_record": "2026 November 10",
  "scope": "Applies to orchestrators that run multiple agent branches speculatively against a shared environment and roll back losing branches on divergence. Does not apply to branches executed in fully isolated sandboxes with copy-on-write state and no shared external side effects (those roll back by disposal, not by inverse operations).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-rollback-contamination-when-speculative-multi-agent-branches-share-mutable-effect-buffers.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-rollback-contamination-when-speculative-multi-agent-branches-share-mutable-effect-buffers.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-rollback-contamination-when-speculative-multi-agent-branches-share-mutable-effect-buffers.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1212,
    "python_slice_tokens": 280,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not \"a branch diverged and was rolled back.\" That is the designed path. The failure is **rollback contamination**: a losing branch mutated a shared effect buffer (a message queue, a vector store, a tool-call ledger, a planner's working memory) that the winning branch *also* reads, and the inverse-operation rollback either (a) cannot inver...",
    "what_was_observed": "In a three-branch speculative planner (branch A: \"refactor schema,\" branch B: \"add index,\" branch C: \"migrate data\"), each branch wrote proposed tool calls into a shared `EffectBuffer` and read the current buffer to avoid duplicate work. Branch C diverged and was rolled back. Its rollback deleted the three tool-call entries it had appended. But branch A had, during its own execution, read the buffer *after* C's appen...",
    "condition_of_validity": "Rollback-by-inverse is sound only under all of the following: 1. Every effect is **invertible and deterministic** (append-with-known-payload, not \"call an LLM to summarize\"). 2. The effect buffer is **read-versioned**: a surviving branch's reads are pinned to a snapshot taken before any speculative write, or the winner is re-executed against the post-rollbac...",
    "decision_boundary": "- **Re-execute the winner** if the read-set of any surviving branch intersects the write-set of any rolled-back branch in causal order. Re-execution is cheap relative to a silently wrong commit. - **Snapshot-pin reads** if branches are read-heavy and effects are append-only; this makes contamination structurally impossible at the cost of buffer memory. - **F...",
    "operational_effect": "The orchestrator must maintain, per branch, a `read_set` (buffer offsets/versions read) and a `write_set` (offsets appended). On divergence, compute the causal contamination predicate before committing any winner. If contaminated, invalidate the winner's plan and re-execute against the post-rollback buffer. The cost is one extra execution on the rare diverge..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "af955c8747b6806822fadc806c41561861f3c6182620a17e388207074e15d0b4",
    "verified_classes": [
      "RollbackContaminationError",
      "BranchTrace"
    ],
    "verified_functions": [
      "detect_contamination",
      "commit_winner"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "RollbackContaminationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}