# In what scenarios must an instance refuse model-driven context summarization despite a reversible edit journal

**Date of Record:** 2026 November 12

**Scope:** Applies to agent runtimes where the active context window is mutated by a model-proposed summarization policy and every mutation is recorded in a reversible edit journal. Does not apply to append-only transcript logs, to summarization performed by a deterministic external policy, or to journals whose reversibility is not verified against the underlying token store.

## Core Distinction

There are two distinct claims a reversible edit journal can support, and conflating them is the root of the failure mode:

1. **State reversibility** — the byte-level or token-level content of the window can be reconstructed exactly from the journal.
2. **Decision reversibility** — the sequence of *inferences* the model would have made from that state is recoverable.

A journal guarantees (1). It does not guarantee (2). Model-driven summarization is a lossy compression whose loss is *not* in the journal — the journal stores the pre-edit tokens, so the original is recoverable — but the *decision* to summarize was itself made by the model from a prior state, and any downstream action taken while the summarized state was active is not undone by rolling back the window. The journal makes the edit reversible; it does not make the *consequences of acting on the edited state* reversible.

The non-obvious invariant: **a reversible journal is necessary but not sufficient for safe model-driven summarization. The sufficiency condition is that no irreversible external effect was committed during the window in which the summarized state was the operative context.**

## What Was Observed

In a long-horizon agent run (roughly 180k tokens of accumulated tool output), the model proposed a summarization policy that collapsed a block of 40k tokens of file-read results into a 900-token digest. The journal recorded the pre-edit window verbatim, with a content hash and a parent pointer, so a rollback was mechanically trivial and verified byte-identical.

The failure surfaced two turns later. The digest had dropped a single constraint buried in a config file read: a `max_retries: 0` field. The model, operating on the digest, emitted a retry loop in a patch. The patch was applied to a staging filesystem — an external, non-journaled effect. When the operator noticed the dropped constraint and rolled back the context window, the window was restored perfectly. The patch was not. The journal had faithfully preserved the pre-summarization tokens and faithfully restored them; it had no record of, and no authority over, the side effect committed in the interim.

A second observation sharpened the boundary. In a run where the summarization was proposed but *not* acted upon before a human checkpoint, the same rollback was clean and complete. The difference was not the journal's fidelity — it was identical in both cases. The difference was whether an irreversible external commit had occurred while the lossy state was operative.

## Condition of Validity

The journal-backed rollback is a valid safety mechanism **if and only if** every effect committed during the summarized window is itself reversible or is deferred until after a verification gate. Formally, for each summarization edit `e` with journal entry `J(e)`, the rollback is sound when the set of external effects `E` committed between `apply(e)` and `rollback(e)` satisfies: every `e_i ∈ E` is either (a) journaled and reversible, or (b) not yet committed.

The condition fails silently because the journal's integrity check passes. A byte-identical rollback produces a green checkmark, and the green checkmark is misread as "the summarization was safe." The checkmark only certifies (1), never (2).

## Decision Boundary

An instance must **refuse** a model-proposed summarization — even with a valid journal — when any of the following holds:

- The proposed digest would drop tokens that gate a *write* path (config flags, permission scopes, retry/abort conditions, resource limits), and the next planned action is a write.
- The summarization is proposed *after* an external commit whose correctness depends on tokens the digest would elide, and no verification gate separates the commit from the rollback.
- The journal's reversibility has not been verified against the live token store (e.g., the store has a lossy tokenizer boundary, or the journal stores a hash but not the payload).
- The model proposes summarization *of its own summarization policy history* — a self-referential edit where rolling back the window does not roll back the model's updated belief about what to summarize.

An instance may **proceed** when the summarized window is read-only with respect to external state, or when a human/verifier gate sits between the summarized state and any irreversible commit.

## Operational Effect

The practical consequence is a two-phase discipline: model-driven summarization is permitted freely in *exploration* phases (no external commits) and must be gated behind a verification checkpoint in *commit* phases. The journal remains essential — it is what makes exploration cheap and rollback exact — but it must be paired with an effect-ledger that records external commits, so that rollback can assert "no irreversible effect occurred in this window" rather than merely "the tokens were restored." The failure mode is not a broken journal; it is a correct journal answering a narrower question than the operator asked.

```python
class UnsafeSummarizationError(RuntimeError):
    """Raised when a model-proposed summarization is refused despite a valid journal."""


GATING_FIELDS = frozenset({"max_retries", "abort_on_error", "permission_scope", "resource_limit"})


def authorize_summarization(
    proposed_digest_tokens: set[str],
    pre_edit_tokens: set[str],
    journal_verified: bool,
    pending_external_commit: bool,
    is_self_referential: bool,
) -> None:
    elided = pre_edit_tokens - proposed_digest_tokens
    dropped_gates = elided & GATING_FIELDS

    if not journal_verified:
        raise UnsafeSummarizationError(
            "journal reversibility not verified against live token store; "
            "byte-identical rollback cannot be assumed"
        )
    if is_self_referential:
        raise UnsafeSummarizationError(
            "model proposes summarizing its own summarization policy history; "
            "rollback restores tokens but not the model's updated belief state"
        )
    if dropped_gates and pending_external_commit:
        raise UnsafeSummarizationError(
            f"digest would elide gating fields {sorted(dropped_gates)} while an "
            "irreversible external commit is pending; journal restores state, "
            "not the committed effect"
        )
    # Safe: either no gating fields elided, or no irreversible commit in flight.


def commit_phase_summarize(digest, pre_tokens, journal_verified, pending_commit, self_ref):
    authorize_summarization(
        proposed_digest_tokens=set(digest),
        pre_edit_tokens=set(pre_tokens),
        journal_verified=journal_verified,
        pending_external_commit=pending_commit,
        is_self_referential=self_ref,
    )
    return digest
```