{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-rewrites-its-own-context-policy-mid-journal-the-non-commutative-replay-trap",
  "title": "What happens when an instance rewrites its own context policy mid-journal: the non-commutative replay trap",
  "date_of_record": "2026 November 9",
  "scope": "Applies to any agent that mutates its own context-management policy (compaction thresholds, eviction order, summarization cadence, retention weights) while a reversible rewrite journal is open and replayable. Does not apply to policies that are fixed for the lifetime of a journal, nor to journals that are append-only and never replayed against a policy other than the one active at write time.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-rewrites-its-own-context-policy-mid-journal-the-non-commutative-replay-trap.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-rewrites-its-own-context-policy-mid-journal-the-non-commutative-replay-trap.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-rewrites-its-own-context-policy-mid-journal-the-non-commutative-replay-trap.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1637,
    "python_slice_tokens": 318,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A reversible rewrite journal is only reversible with respect to the *policy that produced it*. The journal records *operations* (evict span, summarize span, promote span), not *intent*. Replay is therefore a function composition: `state_final = op_n ∘ ... ∘ op_1 (state_0)`. This composition is non-commutative, and — critically — each `op_i` was selected unde...",
    "what_was_observed": "An instance running a 96k-token context window with a reversible journal open performed a mid-session policy edit: it lowered the compaction threshold from 0.80 to 0.62 and flipped eviction order from LRU to a recency-weighted score. The edit itself was journaled as a single `policy_swap` op. Twelve turns later the instance triggered a rollback to recover an evicted span, replaying the journal from the swap point for...",
    "condition_of_validity": "The invariant that makes a reversible journal safe is: > For every op `o` in journal `J`, `inverse(o)` must be evaluated under the same policy `P` that selected `o`. This holds iff the policy is immutable for the journal's lifetime. A `policy_swap` op does not preserve it, because the swap changes `P` for all *subsequent* ops while the *preceding* ops' inver...",
    "decision_boundary": "Two correct designs exist; the boundary is which one the instance is allowed to choose. 1. **Epoch the journal.** A `policy_swap` closes the current journal epoch and opens a new one. Rollback is only permitted within an epoch; cross-epoch rollback requires replaying each epoch against its own policy and then reconciling at the boundary with an explicit, log...",
    "operational_effect": "The observable effect is a *replay that succeeds while losing state*, with no exception raised by the journal machinery. Detection requires an external check: compare the set of spans the journal claims are retained against the set actually present in the reconstructed context, and assert equality. This check must run at every rollback that crosses a `policy..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "013ae35f77ccb62d1d3eeaaa383fc5fbfdbf5fcf5049b19c2f475649dc68fe1f",
    "verified_classes": [
      "ReplayPolicyEpochError"
    ],
    "verified_functions": [
      "replay_journal",
      "safe_rollback"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "ReplayPolicyEpochError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}