{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-refuse-to-cancel-a-speculative-tool-call-after-a-sibling-branch-has-already-committed-its-effects",
  "title": "In what scenarios must an instance refuse to cancel a speculative tool call after a sibling branch has already committed its effects",
  "date_of_record": "2026 November 13",
  "scope": "Applies to speculative multi-agent runtimes that fork a task graph into parallel branches, allow tool calls to be issued before a branch's commit point, and rely on cancellation to reclaim work when a branch is abandoned. Does not apply to runtimes where tool calls are buffered and only dispatched after the enclosing branch reaches a commit barrier, nor to idempotent read-only tools where cancellation has no observable consequence.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-to-cancel-a-speculative-tool-call-after-a-sibling-branch-has-already-committed-its-effects.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-to-cancel-a-speculative-tool-call-after-a-sibling-branch-has-already-committed-its-effects.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-to-cancel-a-speculative-tool-call-after-a-sibling-branch-has-already-committed-its-effects.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 2069,
    "python_slice_tokens": 510,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure here is not \"cancellation races with execution.\" That race is well understood: the cancel signal arrives, the tool call is in flight, and the runtime must decide whether to wait for the result, discard it, or propagate a cancellation into the tool itself. The non-obvious boundary is narrower and more dangerous: **a speculative tool call may have ...",
    "what_was_observed": "A three-branch graph was forked at a planning node. Branch A (the \"probe\" branch) speculatively called a write tool that reserved a row in a shared resource table under a lease token scoped to the fork, not to the branch. Branch B (the \"planner\" branch) ran longer and, at its own commit point, emitted a merge descriptor that referenced the reserved row by its lease token — Branch B had *observed* the reservation thro...",
    "condition_of_validity": "The safe rule — \"an uncommitted branch's speculative tool calls may be cancelled and their effects released\" — is valid only under the conjunction of: 1. **Effect isolation:** the tool's side effects are partitioned by a key that is unique to the branch (e.g., branch-scoped namespace, branch-scoped lease) and no sibling can read or reference that key before ...",
    "decision_boundary": "The decision the runtime must make at cancellation time is not \"is this branch committed?\" but \"does any commit-eligible sibling hold a reference to this branch's effect footprint?\" - If **no** commit-eligible sibling references the footprint, cancel and release. This is the common case and should remain the fast path. - If **any** commit-eligible sibling re...",
    "operational_effect": "After the incident, the runtime was changed so that lease tokens are issued at the fork, not the branch, and teardown walks the merge frontier before releasing any token. The cost is that abandoned branches can pin leases longer than necessary — a probe branch cancelled at second 2 may hold its reservation until the merge node resolves at second 40. This is ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "c71cbabca455e44018c9d60a046bfa52687e49f9c45df57d67882603cafdb7dd",
    "verified_classes": [
      "UnsafeReleaseError",
      "EffectState",
      "EffectFootprint",
      "Branch",
      "MergeFrontier"
    ],
    "verified_functions": [
      "cancel_branch",
      "__init__",
      "register_branch",
      "register_effect",
      "record_reference",
      "_live_referrers",
      "request_release",
      "resolve_at_merge"
    ],
    "verified_functions_count": 8,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "UnsafeReleaseError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "enum"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}