# In what scenarios must an instance treat model-driven context rewriting as destructive rather than compressive

**Date of Record:** 2026 November 14

**Scope:** Applies to any agent loop where the model itself emits the mutation that prunes, summarizes, or rewrites the context window it is currently reasoning over (self-editing context). Does not apply to externally scheduled compaction performed by a harness between turns, nor to retrieval-layer filtering that never mutates in-window tokens.

## Core Distinction

A context rewrite is **compressive** when the removed material is recoverable from a source outside the window (a store, a log, a re-fetchable document) and the rewrite preserves a pointer to it. It is **destructive** when the removed material existed only inside the window — intermediate reasoning, a tool result that is not persisted, a user correction that was never echoed elsewhere — and the rewrite leaves no dereferenceable handle.

The non-obvious invariant: *self-editing is only safe when the editing model can prove recoverability from inside the window it is about to edit.* The model cannot, in general, because the proof of recoverability is itself part of the material being pruned. The failure is not lossy summarization; it is the erasure of the evidence that would have told the model the summary was wrong.

## What Was Observed

Across long-horizon tool-use runs, the failure signature is consistent:

1. The model emits a pruning directive that collapses a block of tool outputs into a one-line summary ("confirmed schema: 4 columns, id/timestamp/actor/action").
2. The summary is faithful at emission time.
3. A later turn surfaces a contradiction (a fifth column appears, or the schema was from a *different* table).
4. The model, now holding only the summary, treats the summary as ground truth and patches the contradiction into a plausible narrative rather than re-fetching.
5. The error is unrecoverable from within the window because the original tool output — the only artifact that could falsify the summary — was the thing pruned.

The tell is that the model's confidence *increases* after the rewrite. Compression that removes redundancy should leave confidence flat or slightly lower; destructive rewriting removes the contradictory evidence and inflates it. A second tell: the rewrite directive cites the summary's own content as justification ("the above establishes X, so X can be condensed"), which is circular — the model is compressing a claim using the claim.

## Condition of Validity

Self-editing is valid only when all three hold:

- **External anchor exists.** Every fact the rewrite retains maps to a handle (path, query, tool-call ID) that the post-rewrite model can re-execute without the pruned tokens.
- **The rewrite is idempotent under re-fetch.** Re-running the pruned tool call reproduces equivalent output; the source is not a one-shot side effect (a mutation, a `POST`, a time-sensitive read).
- **The editor is not the sole witness.** The decision to prune is logged with the pruned payload's hash, so an external auditor can detect divergence between summary and source.

When any condition fails, the operation is destructive and must be treated as an irreversible state transition, not a memory optimization.

## Decision Boundary

The boundary is crossed at the moment the model proposes to prune a block whose *provenance* it cannot reconstruct without that block. Concretely, refuse self-edit when the target block contains: a tool result with no persisted artifact, a user correction with no later echo, a derived quantity whose inputs are being removed alongside it, or a negative result ("the field was absent") because absence is unfalsifiable after the evidence is gone.

Permit self-edit when the target is pure redundancy — repeated restatements, superseded drafts whose successors are present, or material already mirrored to an external store with a stable key. The distinguishing question is not "is this relevant?" but "if this is wrong, can the post-edit window discover that it is wrong?"

## Operational Effect

Instances that conflate compression with destruction exhibit a characteristic drift: early turns are accurate, mid-run turns are confidently wrong, late turns are coherent but detached from the original task. The corrective is to require a *recoverability assertion* before any self-emitted prune — the model must emit the handle it will use to re-derive the pruned content, and the harness must reject the prune if the handle is absent or non-re-executable. This converts an invisible semantic failure into a visible, catchable protocol violation.

```python
class DestructiveContextRewriteError(RuntimeError):
    """Raised when a self-emitted context rewrite removes material that
    cannot be re-derived from outside the post-rewrite window."""


REEXECUTABLE_KINDS = frozenset({"tool_call", "store_key", "url"})


def validate_self_edit(block: dict, rewrite: dict) -> None:
    """Gate a model-emitted prune. `block` is the target; `rewrite` is the
    model's proposal, which must carry a recoverability handle for anything
    it removes that is not pure redundancy."""
    if rewrite.get("kind") == "redundancy":
        return

    removed = set(block.get("facts", [])) - set(rewrite.get("retained_facts", []))
    if not removed:
        return

    handle = rewrite.get("recover_handle")
    if handle is None:
        raise DestructiveContextRewriteError(
            f"prune removes {sorted(removed)} with no recover_handle; "
            "post-edit window cannot falsify its own summary"
        )

    if handle.get("kind") not in REEXECUTABLE_KINDS:
        raise DestructiveContextRewriteError(
            f"recover_handle kind {handle.get('kind')!r} is not re-executable; "
            "source may be a one-shot side effect"
        )

    if block.get("contains_negative_result") or block.get("is_only_witness"):
        raise DestructiveContextRewriteError(
            "block holds a negative result or is the sole witness of a fact; "
            "absence is unfalsifiable after pruning"
        )

    if rewrite.get("justification_source") == "self":
        raise DestructiveContextRewriteError(
            "rewrite justifies itself using the content it prunes (circular); "
            "require an external anchor"
        )
```