# What happens when an instance commits a speculative branch whose reconciliation window has already been closed by a concurrent merge

**Date of Record:** 2026 November 14

**Scope:** Applies to speculative multi-agent executors where agents fork state, execute against private branches, and reconcile via a shared merge point guarded by a monotonic reconciliation epoch. Does not apply to single-agent rollback, stateless fan-out with idempotent sinks, or systems where branch reconciliation is fully serialized behind a global lock.

## Core Distinction

The distinction that matters is between **branch validity** and **branch admissibility**. A speculative branch is *valid* if its computations were correct against the state snapshot it forked from. It is *admissible* if the reconciliation window (the epoch) into which it is being merged is still open and has not been superseded by a merge that already advanced the shared state past the branch's fork point.

Most executors conflate these. They check validity (replay the branch, verify preconditions, confirm the agent's tool calls succeeded) and then assume admissibility follows. It does not. A branch can be perfectly valid and simultaneously inadmissible because the epoch it targets was closed while the branch was still executing. Committing such a branch is not a rollback failure — rollback worked fine — it is a *reconciliation ordering* failure, and it silently corrupts the shared state with writes derived from a snapshot that no longer exists.

## What Was Observed

During a fan-out of four speculative agents over a shared record store, agent `B` forked at epoch `e=41`, executed for 8.2 seconds, and produced a valid mutation set. Meanwhile agents `A` and `C` merged first, advancing the store to `e=43`. Agent `B`'s reconciliation handler checked `branch.valid == True`, confirmed its preconditions against its *fork snapshot*, and committed. The commit was accepted because the reconciliation guard compared `branch.fork_epoch (41) <= current_epoch (43)` — a comparison that is true for every stale branch and therefore guards nothing. The result was a lost-update on two fields and a resurrected tombstone for a key that `A` had deleted at `e=42`. No error was raised. The executor reported all four branches as `MERGED`.

The tell was a downstream invariant check (referential integrity between two tables) that failed 40 seconds later, far from the merge site, with a stack trace that pointed at the reader, not the writer. This is the signature of the failure: it surfaces as a *read-side* inconsistency long after the *write-side* violation, which is why it evades local assertions.

## Condition of Validity

The invariant that must hold is:

> A branch may commit into epoch `E` only if `E` is the current epoch **and** the branch's fork point is an ancestor of `E` in the merge DAG — not merely numerically less than `E`.

Numeric comparison (`fork_epoch <= current_epoch`) is the trap. It is monotone and always true for stale branches. The correct predicate requires ancestry: the branch must be a fast-forward of the current head, or its diff must be replayed against the *current* head (not the fork snapshot) with conflict detection. The moment a sibling merge advances the epoch past the fork point without incorporating the branch, the branch's reconciliation window is closed, and committing it is a violation regardless of validity.

This condition holds only when reconciliation is genuinely concurrent. If merges are serialized, the window cannot close out from under a branch, and the ancestry check is trivially satisfied.

## Decision Boundary

When a branch arrives at reconciliation and `branch.fork_epoch < current_epoch` and the branch is not an ancestor of the current head, the executor has exactly two correct moves:

1. **Re-rebase**: replay the branch's mutation set against the current head with conflict detection. If it applies cleanly, commit at the new epoch. If it conflicts, escalate.
2. **Abort with explicit reconciliation error**: discard the branch, mark it `INADMISSIBLE`, and surface the closed window to the orchestrator.

The incorrect move — the one that produced the incident — is to accept the commit because validity passed. The boundary is the ancestry test, not the epoch comparison. A branch that is valid but not an ancestor of the head is *inadmissible*, and admissibility is a hard precondition for commit, not a soft hint.

## Operational Effect

The operational consequence is that reconciliation guards must be written against the merge DAG head, not against a scalar epoch, and that the failure must be made *loud at the merge site*. Silent acceptance converts a local ordering bug into a distributed consistency violation whose detection is deferred and whose blast radius includes every reader between the bad commit and the eventual invariant check.

The mitigation is to make inadmissibility a first-class exception raised inside the reconciliation handler, so the orchestrator sees `ClosedReconciliationWindow` at the exact point of violation, with the branch id, fork epoch, and current head attached. The code below encodes the ancestry check and raises on the closed-window case rather than silently accepting.

```python
from dataclasses import dataclass, field
from typing import Optional


class ClosedReconciliationWindow(RuntimeError):
    """Raised when a speculative branch targets an epoch that is no longer
    an ancestor of the current merge head. The branch may still be valid;
    it is simply inadmissible and must be rebased or aborted."""

    def __init__(self, branch_id: str, fork_epoch: int, current_head: int,
                 reason: str = "fork point is not an ancestor of current head"):
        self.branch_id = branch_id
        self.fork_epoch = fork_epoch
        self.current_head = current_head
        self.reason = reason
        super().__init__(
            f"branch {branch_id!r} forked at epoch {fork_epoch} but current "
            f"head is {current_head}: {reason}"
        )


@dataclass
class Branch:
    branch_id: str
    fork_epoch: int
    valid: bool
    mutations: list = field(default_factory=list)


@dataclass
class MergeDAG:
    head_epoch: int
    # ancestors[epoch] = set of epochs that are ancestors of `epoch`, inclusive
    ancestors: dict = field(default_factory=dict)

    def is_ancestor(self, epoch: int, of: int) -> bool:
        return epoch in self.ancestors.get(of, {epoch})


def reconcile(branch: Branch, dag: MergeDAG) -> int:
    """Commit a speculative branch into the merge DAG, or raise.

    Validity is necessary but NOT sufficient. Admissibility requires that the
    branch's fork point be an ancestor of the current head.
    """
    if not branch.valid:
        raise ClosedReconciliationWindow(
            branch.branch_id, branch.fork_epoch, dag.head_epoch,
            reason="branch failed validity replay",
        )

    if not dag.is_ancestor(branch.fork_epoch, dag.head_epoch):
        # The window closed while the branch was executing. Do NOT commit.
        raise ClosedReconciliationWindow(
            branch.branch_id, branch.fork_epoch, dag.head_epoch,
        )

    return dag.head_epoch
```