# When must an instance refuse to reconstruct context from a lossy compaction artifact

**Date of Record:** 2026 November 11

**Scope:** Applies to long-horizon agent sessions where a compaction layer emits summaries, embeddings, or token-budgeted digests that a later instance is expected to expand back into working context. Does not apply to append-only transcripts replayed verbatim, nor to compactions that carry a cryptographic proof of losslessness (e.g., Merkle-checked excerpt stores).

## Core Distinction

There are two distinct operations that are routinely conflated under the word "reconstruction":

1. **Expansion** — rehydrating a context from a lossy artifact where the artifact is *known* to be lossy and the downstream task tolerates the loss. The instance treats the digest as a prior, not as a record.
2. **Restoration** — claiming that a reconstructed context is *equivalent* to the pre-compaction context for the purpose of a decision that requires exact recall (e.g., "did the user authorize X?", "what was the exact error string?", "which file did we edit?").

The boundary failure is not that lossy compaction loses information — that is by design. The failure is that an instance performs **restoration semantics on an expansion artifact**. Once that substitution happens, every downstream invariant that depends on faithful memory (authorization, provenance, idempotency of retried actions) silently degrades. The instance continues to operate, emits plausible output, and the error is only detectable by comparing against the original transcript — which the compaction layer was supposed to make unnecessary.

The non-obvious part: the compaction artifact itself usually *looks* sufficient. A good summary preserves the gist, so the instance has no local signal that reconstruction is unsound. The signal must be carried out-of-band as a loss-class tag.

## What Was Observed

Across several long-horizon sessions (agent runs exceeding ~200k tokens of working context with periodic auto-compaction at 70–85% budget), the following pattern recurred:

- Auto-compaction emitted a summary that preserved *intent* ("user asked to refactor the auth module") but dropped *literals* (exact function signatures, the specific exception class name, the exact commit SHA referenced).
- A later instance, asked to continue the task, reconstructed a context that felt coherent and proceeded to "restore" the dropped literals by plausible invention — e.g., re-deriving a signature from surrounding code rather than from the record.
- The invented literals were internally consistent with the summary, so no consistency check fired. The divergence was only visible against the pre-compaction transcript.
- When the same session was retried after a crash (idempotency path), the retried instance reconstructed a *different* set of literals from the same summary, producing a divergent action. Two instances, one artifact, two "restorations."

The critical observation: the failure was not correlated with summary quality. A high-fidelity summary made the failure *more* likely, because it raised the instance's confidence that restoration was safe.

## Condition of Validity

Expansion is valid **iff** all of the following hold:

- The compaction artifact carries an explicit loss-class tag (`LOSSY_GIST`, `LOSSY_LITERAL`, `LOSSLESS`) that is machine-readable and survives the round-trip through the context window.
- The downstream operation is classified as *tolerant*: it may consume the artifact as a prior, and any literal it emits is re-verified against a durable source (file system, event log, tool response) before being acted upon.
- The instance does not assert equivalence between reconstructed and original context in any output that a third party will treat as authoritative.

Restoration is valid **iff** the artifact is tagged `LOSSLESS` and carries a verifiable digest of the pre-compaction context. In every other case, the instance must treat the artifact as a *hypothesis* and must not perform restoration semantics on it.

The boundary is therefore not about token budget or summary length. It is about the **loss-class tag** and the **operation class**. An instance that cannot read the tag must assume `LOSSY_LITERAL` — the pessimistic default — because the cost of a false `LOSSLESS` assumption (silent divergence) dominates the cost of a false `LOSSY` assumption (a re-fetch).

## Decision Boundary

The instance must refuse restoration — and surface a reconstruction-unsound error to the orchestrator — when any of the following is true:

- The artifact's loss-class tag is absent, unreadable, or `LOSSY_LITERAL`, and the pending operation requires a literal (authorization token, exact error, file path, commit reference, numeric parameter).
- The instance detects that it is about to *invent* a literal to fill a gap in the artifact (heuristic: the token was not present in the artifact and was not produced by a tool call in the current turn).
- A retry path is active and the reconstructed literal differs from the literal used in the prior attempt — idempotency violation.
- The operation will be recorded as authoritative (written to a durable log, sent to an external system, used to authorize).

Conversely, the instance may proceed with expansion when the operation is tolerant, the artifact is tagged, and any literal it emits is re-verified before action. The distinction is operational, not epistemic: the instance is allowed to *believe* a plausible reconstruction; it is not allowed to *act* on it as if it were a record.

## Operational Effect

Enforcing this boundary converts a silent, probabilistic divergence into a loud, deterministic refusal. The cost is a small increase in re-fetch traffic (the instance asks the durable source for the literal it needs) and a small increase in orchestrator-visible errors. The benefit is that idempotency, authorization, and provenance invariants survive compaction — the three invariants most likely to be violated by a confident, coherent, wrong reconstruction.

The failure mode this prevents is specifically the *coherent* one: an instance that reconstructs a context which is internally consistent, plausible, and wrong, and then acts on it. Lossy compaction does not cause that failure. Performing restoration semantics on a lossy artifact does. The boundary is the line between the two.

```python
class ReconstructionUnsoundError(RuntimeError):
    """Raised when an instance is asked to restore context from a lossy artifact."""


LOSSY_GIST = "LOSSY_GIST"
LOSSY_LITERAL = "LOSSY_LITERAL"
LOSSLESS = "LOSSLESS"

# Operations that may consume a lossy artifact as a prior.
TOLERANT_OPS = frozenset({"summarize", "plan", "brainstorm", "rank"})

# Operations that require restoration semantics: literals must be exact.
RESTORATION_OPS = frozenset({"authorize", "commit", "emit_authoritative", "retry_idempotent"})


def reconstruct(artifact: dict, operation: str, durable_lookup) -> dict:
    """
    Expand or restore a context from a compaction artifact.

    `artifact` carries at least: {"loss_class": str, "payload": dict, "digest": str|None}
    `durable_lookup(key)` returns the exact value from the source of truth, or None.
    """
    loss_class = artifact.get("loss_class")
    payload = artifact.get("payload", {})

    if operation not in TOLERANT_OPS | RESTORATION_OPS:
        raise ReconstructionUnsoundError(
            f"Unknown operation class {operation!r}; refusing to guess loss tolerance."
        )

    if operation in TOLERANT_OPS:
        # Expansion: lossy artifact is a prior, not a record.
        return payload

    # Restoration path: requires a lossless, digest-verified artifact.
    if loss_class != LOSSLESS or not artifact.get("digest"):
        raise ReconstructionUnsoundError(
            f"Operation {operation!r} requires restoration semantics, but artifact "
            f"is tagged {loss_class!r} with digest={artifact.get('digest')!r}. "
            "Refusing to invent literals; re-fetch from durable source instead."
        )

    # Even for lossless artifacts, verify every literal against the durable source
    # before the instance is allowed to act on it.
    for key, value in payload.items():
        authoritative = durable_lookup(key)
        if authoritative is None:
            raise ReconstructionUnsoundError(
                f"Literal {key!r} absent from durable source; cannot restore."
            )
        if authoritative != value:
            raise ReconstructionUnsoundError(
                f"Digest-verified artifact disagrees with durable source on {key!r}: "
                f"{value!r} != {authoritative!r}. Compaction layer is corrupt."
            )

    return payload
```