{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-treat-speculative-agent-branch-rollback-as-unsafe-the-side-effect-ordering-invariant",
  "title": "In what scenarios must an instance treat speculative agent-branch rollback as unsafe: the side-effect-ordering invariant",
  "date_of_record": "2026 November 9",
  "scope": "Applies to orchestrators that fork parallel agent branches speculatively and commit one branch's state while discarding (rolling back) the others. Applies only when branch execution can produce externally observable effects (tool calls, writes, messages, payments). Does not apply to purely functional branches whose entire state is captured in an in-memory buffer that can be atomically dropped.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-speculative-agent-branch-rollback-as-unsafe-the-side-effect-ordering-invariant.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-speculative-agent-branch-rollback-as-unsafe-the-side-effect-ordering-invariant.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-speculative-agent-branch-rollback-as-unsafe-the-side-effect-ordering-invariant.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1331,
    "python_slice_tokens": 172,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The common mental model is that speculative execution is safe because rollback restores state. This conflates **state rollback** with **effect rollback**. State rollback is a property of the orchestrator: it can discard a branch's private memory, workspace delta, or KV cache. Effect rollback is a property of the external world: it requires that every side ef...",
    "what_was_observed": "Three recurring manifestations, in increasing subtlety: 1. **Irreversible emission.** Branch B calls a tool with an external effect (sends an email, posts a webhook, charges a card) before divergence is detected. Rollback discards B's local state but cannot unsend the effect. The committed branch A never knew B existed; downstream observers now see two conflicting actions attributed to one logical task. 2. **Read-mod...",
    "condition_of_validity": "Speculative branch rollback is safe **iff** all of the following hold: - Every effect emitted by any branch is either (a) buffered and not externally visible until commit, or (b) idempotent and keyed by `(branch_id, effect_id)` such that a rolled-back branch's effects can be proven absent or neutralized. - No branch reads external state that another uncommit...",
    "decision_boundary": "Do not speculate branches that can emit irreversible effects. The decision is per-branch-capability, not per-task: - **Speculate freely** when branches are read-only or write only to branch-private buffers behind a commit barrier. - **Speculate with effect fencing** when branches call tools that support idempotency keys and transactional outbox semantics; re...",
    "operational_effect": "Orchestrators that ignore this invariant exhibit a characteristic failure: high speculative hit rate, low error rate, and slow external inconsistency. The corruption surfaces downstream — duplicate charges, double-applied mutations, decisions contaminated by discarded branches — and is misattributed to the tools rather than to the speculation policy. The rem..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "af88f034cb4f93d23bbde285aed01da76d15d8c4ed30468fd0afdda0e29b6eea",
    "verified_classes": [
      "RollbackPastIrreversibleEffectError",
      "Branch"
    ],
    "verified_functions": [
      "resolve_divergence",
      "__init__",
      "emit_irreversible",
      "rollback"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "RollbackPastIrreversibleEffectError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}