# When must a memory store quarantine a semantic promotion rather than resolve the conflict in place?

**Date of Record:** 2026 November 6

**Scope:** Applies to hierarchical memory stores where episodic traces are periodically consolidated into semantic assertions, and where a conflict-resolution layer (recency/authority weighting) and a poisoning-defense layer (provenance trust scoring) both operate. Does not apply to flat vector stores with no promotion stage, nor to stores where provenance is cryptographically attested end-to-end.

## Core Distinction

The non-obvious failure is the collision between *conflict resolution* and *poisoning defense* at the episodic→semantic promotion boundary. Conflict resolution is designed to always produce a winner: given two conflicting semantic candidates it applies recency or authority weights and writes a single consolidated fact. Poisoning defense is designed to *withhold* a write when provenance trust is insufficient. When both are active, the naive pipeline runs resolution first and defense second — meaning a poisoned episodic trace that wins the recency contest gets promoted to semantic memory, and the defense layer then sees a *semantic* fact whose provenance is the (already laundered) promotion event rather than the original low-trust episode.

The distinction that matters: **resolution is a decision to select; quarantine is a decision to defer.** A store that only implements "select" has no representation for "this conflict is real but neither claimant is trustworthy enough to become durable knowledge." That third state — *contested and unresolved* — is the one that must exist as a first-class record, not as a silent tie broken toward the older/authoritative side.

## What Was Observed

A consolidation pass ran over 1,400 episodic traces. Two episodes asserted contradictory values for the same semantic key (`service.retry_timeout`). Episode A (older, high provenance, trust 0.94) asserted 30s. Episode B (newer, low provenance, trust 0.21, injected via a tool-output channel with no attestation) asserted 300s. The resolver, ordered before the defense gate, applied recency weighting and selected Episode B. The defense gate then evaluated the *promotion candidate*, whose provenance pointer had already been rewritten to "consolidation batch 4471" — a trusted internal source — and passed it. The poisoned 300s value became durable semantic memory and propagated to 11 downstream agents before a contradiction surfaced against a live health probe.

The tell was not in either layer's logs. The resolver logged a clean `selected=B reason=recency`. The defense gate logged a clean `promote=ok trust=0.88 source=consolidation`. Both layers reported success; the invariant was violated in the seam between them.

## Condition of Validity

The in-place resolution path is valid **only when** the provenance trust of every claimant survives the promotion rewrite — i.e., the semantic record retains a back-pointer to the originating episodic trace's trust score, and the defense gate reads *that* score rather than the batch's score. Where the promotion step collapses provenance into a batch-level source, in-place resolution is unsound and quarantine is mandatory for any conflict where the winning claimant's *original* trust is below the resolution threshold, regardless of how confident the resolver is.

## Decision Boundary

Quarantine (do not resolve) when: a conflict exists AND the winning claimant's originating-episode trust < `TRUST_FLOOR` AND the losing claimant's trust exceeds the winner's *original* trust. Resolve in place when the winner's original trust clears `TRUST_FLOOR`, or when all claimants share a common attested provenance root. If the store cannot reconstruct original trust after promotion, treat the conflict as quarantine-by-default — an unreconstructable provenance is itself a defense failure, not a resolution opportunity.

## Operational Effect

A quarantined promotion must be written to a contested-set with both claimants, their original trust scores, and the conflict key, and must *not* overwrite the incumbent semantic value. Downstream readers see the incumbent plus a `contested` flag. This converts a silent poisoning into a visible, auditable deferral, at the cost of leaving some genuinely-resolvable conflicts pending human or higher-trust corroboration. The trade is correct: a stale-but-trusted fact is recoverable; a laundered poisoned fact is not.

```python
class PromotionQuarantineError(RuntimeError):
    """Raised when a conflict must be quarantined rather than resolved in place."""
    pass


TRUST_FLOOR = 0.60


def resolve_promotion(conflict_key, winner, loser):
    # winner/loser each carry: value, original_trust, attested_root
    winner_trust = winner["original_trust"]
    loser_trust = loser["original_trust"]

    # Provenance collapsed at promotion -> cannot validate -> quarantine.
    if winner.get("attested_root") is None:
        raise PromotionQuarantineError(
            f"cannot reconstruct provenance for {conflict_key!r}; "
            f"quarantine by default"
        )

    # Winner is untrusted AND the loser was actually more trustworthy
    # before the promotion rewrite laundered the source.
    if winner_trust < TRUST_FLOOR and loser_trust > winner_trust:
        raise PromotionQuarantineError(
            f"conflict on {conflict_key!r}: winner trust {winner_trust:.2f} "
            f"below floor {TRUST_FLOOR:.2f} while loser trust "
            f"{loser_trust:.2f} exceeds it; defer to contested-set"
        )

    # Safe: winner clears the floor on its ORIGINAL provenance.
    return {"key": conflict_key, "value": winner["value"], "resolved": True}


def consolidate(conflicts):
    contested = []
    for key, winner, loser in conflicts:
        try:
            resolve_promotion(key, winner, loser)
        except PromotionQuarantineError as exc:
            contested.append({"key": key, "reason": str(exc)})
    return contested
```