{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-cancels-a-speculative-tool-call-after-the-orchestrator-has-already-committed-the-branch-the-irreversible-side-effect-inv",
  "title": "What happens when an instance cancels a speculative tool call after the orchestrator has already committed the branch: the irreversible side-effect invariant in speculative multi-agent execution",
  "date_of_record": "2026 November 12",
  "scope": "Applies to orchestrators that run multiple agent branches speculatively, predict which branch will win, and issue tool calls (HTTP writes, DB mutations, message publishes) before the prediction is confirmed. Does not apply to pure read-only tool calls, nor to tool calls that are idempotent and keyed by a deterministic branch token such that duplicate execution is a no-op.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-cancels-a-speculative-tool-call-after-the-orchestrator-has-already-committed-the-branch-the-irreversible-side-effect-inv.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-cancels-a-speculative-tool-call-after-the-orchestrator-has-already-committed-the-branch-the-irreversible-side-effect-inv.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-cancels-a-speculative-tool-call-after-the-orchestrator-has-already-committed-the-branch-the-irreversible-side-effect-inv.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1698,
    "python_slice_tokens": 345,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Speculative execution of *computation* is reversible: you can discard a register, a heap allocation, or an in-memory draft. Speculative execution of *effects* is not. The boundary is not \"did the branch get rolled back\" but \"did a side effect escape the rollback boundary before the rollback was requested.\" The non-obvious invariant is this: **a speculative t...",
    "what_was_observed": "A planner agent emitted three candidate plans. The orchestrator predicted plan B would satisfy the goal and speculatively dispatched B's tool calls: a `POST /orders` to the fulfillment service and a `publish` to the notification topic. Plan A was kept as a fallback branch in a suspended state. The prediction was wrong. The verifier rejected B at step 4 on a constraint the predictor had not weighted (a quota check tha...",
    "condition_of_validity": "The invariant \"rollback of a speculative branch leaves no observable effect\" holds only when all of the following are true: 1. Every speculative tool call carries a cancellation token that the callee honors *before* committing, and the callee's commit point is exposed (or bounded) so the orchestrator knows the cancellation window. 2. The orchestrator waits f...",
    "decision_boundary": "Do not speculatively dispatch a tool call if the call is **non-idempotent and its commit point is not observable**. In that case, the correct behavior is to *defer* the call until the branch is confirmed — speculation buys latency only on reads and on idempotent writes. If you must speculate on a non-idempotent call, the decision boundary is: **the orchestra...",
    "operational_effect": "Systems that get this right pay a latency tax: they hold the branch in a `ROLLING_BACK` state until in-flight calls drain, which can be tens to hundreds of milliseconds. Systems that skip the drain get lower abort latency and a small, persistent rate of orphaned effects — typically 0.1–2% of aborted branches, but concentrated in the slowest callees, which ar..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "a61ceb3ee70305f629d4d2bff0d9fc962b2fdd21bb4de06dc2d52d09ff30176a",
    "verified_classes": [
      "SpeculationIntegrityError",
      "CallState",
      "SpeculativeCall",
      "Branch"
    ],
    "verified_functions": [
      "request_cancel",
      "rollback_branch",
      "dispatch_speculative"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "SpeculationIntegrityError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "enum",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}