{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-treat-speculative-tool-call-reconciliation-as-a-two-phase-commit-rather-than-a-compensating-rollback",
  "title": "Under what conditions must an instance treat speculative tool-call reconciliation as a two-phase commit rather than a compensating rollback",
  "date_of_record": "2026 November 14",
  "scope": "Applies to multi-agent orchestrators that fork speculative branches, execute tool calls against shared external state, and reconcile the results of branches that are later selected or discarded. Does not apply to branches whose tool calls are pure reads, nor to systems where every tool call is idempotent and side-effect-free by construction (e.g., sandboxed filesystems that are torn down wholesale on branch discard).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-speculative-tool-call-reconciliation-as-a-two-phase-commit-rather-than-a-compensating-rollback.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-speculative-tool-call-reconciliation-as-a-two-phase-commit-rather-than-a-compensating-rollback.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-speculative-tool-call-reconciliation-as-a-two-phase-commit-rather-than-a-compensating-rollback.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 2141,
    "python_slice_tokens": 391,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The common mental model of speculative execution with rollback treats a discarded branch as a *compensating transaction*: you ran some tools, you didn't like the outcome, you undo them. This works when every tool call is either (a) local to the branch, or (b) externally reversible by a compensating action that is itself valid regardless of what other branche...",
    "what_was_observed": "In a production orchestrator forking three speculative branches over a shared issue-tracker and a shared rate-limited external API: 1. Branch A opened a ticket and posted a comment. Branch B, speculatively, also opened a ticket for the same logical issue and posted a comment referencing A's ticket ID (discovered via a read). Branch C did neither but consumed the shared API quota. 2. The selector chose Branch B. The o...",
    "condition_of_validity": "Compensating rollback is valid **only** when all of the following hold for every tool call issued by a discarded branch: - **Isolation of effect:** the call's effects are not readable by, and do not constrain, any branch that may still commit. This includes indirect reads (permalink resolution, quota counters, customer-keyed webhooks). - **Compensation indep...",
    "decision_boundary": "Use the following decision procedure at reconciliation time: - If the set of branches that issued external, non-idempotent calls has size ≤ 1, compensating rollback is safe. The single branch either commits or compensates; there is no cross-branch interaction. - If size ≥ 2 **and** the branch dependency graph (reads-from edges among live branches) is empty, ...",
    "operational_effect": "Adopting the 2PC discipline changes the orchestrator in three concrete ways. First, every speculative tool wrapper must expose a `prepare()` and a `commit()`/`abort()` pair, and tools that cannot express prepare must be flagged and excluded from speculative regions. Second, the selector must produce a commit decision that is applied atomically with respect t..."
  },
  "matched_failure_symptoms": [
    "DUPLICATE_MUTATION_OR_BILLING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "5b6bc6c0edf7047c26235abe17b67552e47e9fef074d543cef90d6ffafe96de4",
    "verified_classes": [
      "UnsafeCompensationError",
      "Branch"
    ],
    "verified_functions": [
      "require_two_phase_commit"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "UnsafeCompensationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}