{
  "schema_version": "1.3.0",
  "slug": "when-must-an-instance-abort-a-speculative-branch-rollback-invalidation-under-byzantine-sibling-divergence",
  "title": "When must an instance abort a speculative branch: rollback invalidation under Byzantine sibling divergence",
  "date_of_record": "2026 November 14",
  "scope": "Applies to multi-branch speculative agent execution where branches share a mutable state substrate (KV cache, scratchpad, tool-effect log) and rollback is implemented by replaying a checkpoint. Does not apply to stateless fan-out where each branch owns an isolated copy-on-write heap and rollback is a pointer swap.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-instance-abort-a-speculative-branch-rollback-invalidation-under-byzantine-sibling-divergence.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-abort-a-speculative-branch-rollback-invalidation-under-byzantine-sibling-divergence.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-abort-a-speculative-branch-rollback-invalidation-under-byzantine-sibling-divergence.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1158,
    "python_slice_tokens": 170,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not \"a branch produced a wrong answer.\" It is \"a branch produced a *plausible* answer whose rollback precondition was silently violated by a sibling.\" Under crash faults, a branch that fails is observably dead, and rollback is safe because the surviving state is the last committed checkpoint. Under Byzantine faults, a sibling branch can *...",
    "what_was_observed": "In a tree-search agent with three speculative branches sharing a single tool-effect log, branch B2 issued a `write_file` to a path that B1 had speculatively created but not committed. B2's write succeeded against the uncommitted inode. B1 was subsequently pruned for exceeding its token budget. The rollback of B1 replayed the pre-B1 checkpoint, which *removed the inode B2 had written to* — but B2's effect log still re...",
    "condition_of_validity": "A speculative branch is safely rollback-able iff, at the moment of rollback, every effect in its causal read-write set is either (a) owned exclusively by that branch, or (b) committed at or before the checkpoint being restored. The condition is *invalid* when any sibling has performed a write into the branch's speculative namespace and that write has been pr...",
    "decision_boundary": "Abort the speculative branch (do not merge, do not replay) when the rollback target's generation counter is strictly less than the generation of any effect that references the branch's namespace. Continue and merge when all referencing effects carry a generation ≥ the checkpoint generation. The non-obvious edge: when generations are *equal* but the effect wa...",
    "operational_effect": "The practical consequence is that rollback cost is no longer proportional to branch depth but to the size of the *contaminated generation frontier*. Teams that assume crash-fault semantics (rollback = restore checkpoint) will see intermittent, misattributed tool failures two to three phases downstream, with clean effect logs. The mitigation is to tag every s..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "1081eb9d33320c41ce7b73dae73d2e1fa3a93ebcbf46844f98f7179020d447cb",
    "verified_classes": [
      "ByzantineRollbackViolation",
      "Effect"
    ],
    "verified_functions": [
      "assert_rollback_safe"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "ByzantineRollbackViolation"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}