{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-abort-speculative-multi-agent-branches-before-rollback-completes-the-side-effecting-tool-call-invariant-in-branch-a",
  "title": "In what scenarios must an instance abort speculative multi-agent branches before rollback completes: the side-effecting tool-call invariant in branch-and-rollback planning",
  "date_of_record": "2026 November 10",
  "scope": "Applies to orchestrators that fork parallel agent branches to speculatively plan or execute tool calls, then select a winning branch and roll back the losers. Does not apply to pure read-only tool surfaces, nor to systems where every branch is confined to an isolated, discardable transaction sandbox with externally enforced idempotency keys.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-abort-speculative-multi-agent-branches-before-rollback-completes-the-side-effecting-tool-call-invariant-in-branch-a.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-abort-speculative-multi-agent-branches-before-rollback-completes-the-side-effecting-tool-call-invariant-in-branch-a.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-abort-speculative-multi-agent-branches-before-rollback-completes-the-side-effecting-tool-call-invariant-in-branch-a.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1273,
    "python_slice_tokens": 191,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between *reversible state* (branch-local memory, scratchpads, provisional plans, cached reads) and *irreversible effects* (sent emails, charged cards, appended rows in a non-transactional store, messages published to a queue, files written to a shared mount). Branch-and-rollback is only sound over reversible state. The moment ...",
    "what_was_observed": "A planner forked three branches to satisfy a single user request (\"reconcile the invoice and notify the customer\"). Branch A chose a read-only reconciliation path. Branch B chose to issue a refund via a payment tool, then send a notification. Branch C chose to send the notification first, then reconcile. The selector chose A on latency grounds and issued rollback to B and C. Two observations: 1. Branch B had already ...",
    "condition_of_validity": "Rollback of a speculative branch is valid **iff** the branch has not crossed its effect commit point, where the commit point is defined as the earliest instant at which an external system has durably accepted the effect and will not revoke it on request. For most tool surfaces this instant is *inside* the tool call, not at the tool call's return. Therefore: ...",
    "decision_boundary": "The decision procedure at rollback time: - **Effect boundary says rejected / never reached** → roll back freely; safe. - **Effect boundary says accepted** → do **not** roll back; abort the speculative branch's *local* state, mark it `COMPENSATION_REQUIRED`, and enqueue a compensation task. Do not block the winning branch on compensation unless the effect is ...",
    "operational_effect": "Encoding this boundary converts a silent correctness bug into a loud, recoverable one. Losing branches that touched irreversible effects are quarantined rather than erased, compensation is scheduled instead of assumed, and the orchestrator's reported state matches the world. The cost is throughput: speculative branches that fire effects can no longer be chea..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "1d2be8394bb4f770c46b3dcc296305fa15473935250f570e3c89965a3af27376",
    "verified_classes": [
      "SpeculativeRollbackInvariantError"
    ],
    "verified_functions": [
      "rollback_branch",
      "select_and_rollback"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "SpeculativeRollbackInvariantError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}