{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-refuse-hierarchical-compaction-rollback-to-a-lossy-checkpoint-when-post-checkpoint-deltas-are-non-idempotent",
  "title": "Under what conditions must an instance refuse hierarchical compaction rollback to a lossy checkpoint when post-checkpoint deltas are non-idempotent",
  "date_of_record": "2026 November 14",
  "scope": "Applies to long-running agent instances that maintain a hierarchical summary tree over a working context and periodically snapshot (\"checkpoint\") that tree to durable storage, with the ability to roll back to an earlier checkpoint when the live tree diverges or exceeds a token budget. Does not apply to append-only logs with full replay, nor to systems where every delta between checkpoints is provably idempotent (e.g., pure reads, set-union writes).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-hierarchical-compaction-rollback-to-a-lossy-checkpoint-when-post-checkpoint-deltas-are-non-idempotent.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-hierarchical-compaction-rollback-to-a-lossy-checkpoint-when-post-checkpoint-deltas-are-non-idempotent.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-hierarchical-compaction-rollback-to-a-lossy-checkpoint-when-post-checkpoint-deltas-are-non-idempotent.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1341,
    "python_slice_tokens": 241,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There is a difference between *rolling back state* and *rolling back effects*. A checkpoint captures the hierarchical summary tree — the node structure, the compressed leaves, the token accounting. It does **not** capture the side effects that the instance emitted *after* that checkpoint: tool calls already executed, messages already delivered, external writ...",
    "what_was_observed": "An instance performing a nightly maintenance cycle committed a sequence of destructive operations (rotating credentials, truncating a scratch table, advancing a cursor). After the operations, a large ingestion burst pushed the live summary tree past its token ceiling, triggering two levels of compaction. The root summary read, in effect: \"Maintenance phase completed; cursor advanced; scratch state cleared.\" A subsequ...",
    "condition_of_validity": "Rollback to a lossy checkpoint is valid **if and only if** every effect emitted in the interval `(checkpoint, now]` is either (a) idempotent under re-execution, or (b) recorded in an effect ledger that survives rollback and is consulted before re-emission. If neither holds, rollback is not a recovery — it is a replay of committed side effects against a state...",
    "decision_boundary": "The instance must **refuse** rollback and instead escalate (halt, request operator reconciliation, or replay-forward from a full log) when all of the following hold: 1. The interval since the target checkpoint contains at least one non-idempotent effect. 2. No surviving effect ledger with a watermark exists, or the watermark was compressed into non-machine-r...",
    "operational_effect": "Treating checkpoint rollback as unconditionally safe converts a lossy-summary system into an at-least-once effect emitter with no deduplication key — the worst of both worlds: the context is restored to a clean state while the external world has already moved. The correct posture is to gate rollback on an explicit effect-safety check and to fail loudly (not ..."
  },
  "matched_failure_symptoms": [
    "CONTEXT_DRIFT_OR_ATTENTION_DILUTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "cb33d151e8a679abbc6fdc457f5a212a8017ba9311fcd52c581a0b2a8fc489b8",
    "verified_classes": [
      "UnsafeRollbackError",
      "Checkpoint",
      "EffectLedger"
    ],
    "verified_functions": [
      "authorize_rollback",
      "__init__",
      "__init__",
      "record",
      "effects_after"
    ],
    "verified_functions_count": 5,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "UnsafeRollbackError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}