{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-abort-a-speculative-branch-before-merge-when-side-effects-have-already-leaked-to-a-shared-external-sink",
  "title": "Under what conditions must an instance abort a speculative branch before merge when side effects have already leaked to a shared external sink",
  "date_of_record": "2026 November 12",
  "scope": "Applies to orchestrators that execute speculative multi-agent branches whose task graphs merge into a committed linearization, and that permit branches to perform external side effects (writes to queues, object stores, APIs, databases) under a rollback-safe containment protocol. Does not apply to purely functional branches with no external sinks, nor to systems where all side effects are deferred to post-merge commit.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-abort-a-speculative-branch-before-merge-when-side-effects-have-already-leaked-to-a-shared-external-sink.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-abort-a-speculative-branch-before-merge-when-side-effects-have-already-leaked-to-a-shared-external-sink.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-abort-a-speculative-branch-before-merge-when-side-effects-have-already-leaked-to-a-shared-external-sink.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 2025,
    "python_slice_tokens": 332,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **speculative divergence** and **side-effect leakage**. Speculative divergence is the normal, healthy condition: two branches produce different intermediate results, one is selected, the other is discarded. Side-effect leakage is the pathological condition: a discarded branch has already mutated state that the merge pr...",
    "what_was_observed": "In a branch-and-merge graph where branch B1 (speculative) and B2 (speculative) both emit to a shared idempotency-keyed sink, the following sequence was observed: 1. B1 acquires idempotency key `k` and writes payload `p1`. Sink commits `p1` under `k`. 2. B2, unaware of B1's write (speculation isolation), acquires the *same* key `k` — because the key was derived from the merge-point task id, not the branch id — and att...",
    "condition_of_validity": "The rollback-safe containment protocol is valid — meaning abort-and-discard is sound — if and only if all of the following hold at the moment of abort: - **C1 (Effect identity includes branch identity).** Every emitted effect carries a key that is a function of `(graph_id, branch_id, task_id, attempt)`, not merely `(graph_id, task_id)`. If two branches can c...",
    "decision_boundary": "The decision boundary is between **abort** and **quarantine**. The naive rule \"if the branch lost, abort it\" is wrong whenever leakage has occurred. The correct rule: - If the branch lost **and** C1–C4 hold for every emitted effect → abort, run compensations, confirm, proceed. - If the branch lost **and** any emitted effect violates C1–C4 → do **not** abort....",
    "operational_effect": "The practical consequence is that the orchestrator must maintain a per-branch **effect ledger** with three states per effect: `pending` (registered, not yet emitted), `emitted` (sink acknowledged, compensation registered), and `compensated` (inverse confirmed). Abort is permitted only when every ledger entry is `compensated` or `pending`. Any entry in `emitt..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "3b81ccf7a6f76830c0cddcb0a34e86c8c3a57aafc97c5b08467b2553df08e66e",
    "verified_classes": [
      "SpeculationLeakError",
      "EffectLedger"
    ],
    "verified_functions": [
      "abort_branch",
      "verify_merge_clean",
      "__init__",
      "register",
      "mark_emitted",
      "mark_compensated",
      "is_abortable"
    ],
    "verified_functions_count": 7,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "SpeculationLeakError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}