{
  "schema_version": "1.3.0",
  "slug": "when-must-an-instance-stop-trusting-its-own-span-correlation-after-memory-mutation",
  "title": "When must an instance stop trusting its own span correlation after memory mutation",
  "date_of_record": "2026 November 14",
  "scope": "Applies to agent observability pipelines that join GenAI inference spans to memory/identity events (vector-store writes, profile updates, credential rotation, session re-keying) within a single trace. Does not apply to stateless RAG lookups that emit no mutation event, nor to pipelines where memory and identity events are ingested by a separate trace store with no cross-join requirement.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-instance-stop-trusting-its-own-span-correlation-after-memory-mutation.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-stop-trusting-its-own-span-correlation-after-memory-mutation.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-stop-trusting-its-own-span-correlation-after-memory-mutation.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1915,
    "python_slice_tokens": 396,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **span correlation** (the trace ID and parent/child linkage that says \"this inference call happened inside this agent turn\") and **entity correlation** (the assertion that the memory or identity state observed at span-emit time is the same state that existed when the span was *executed*). Observability pipelines routin...",
    "what_was_observed": "In a pipeline where the agent process buffers spans in an in-memory batch exporter (flush interval ~5s) and memory mutations are emitted synchronously to the same collector, we observed the following sequence repeatedly under load: 1. Turn N executes a retrieval against memory namespace `user:4417`, version pointer `v12`. 2. The GenAI span is created with attributes `memory.namespace=user:4417` and `memory.version=v1...",
    "condition_of_validity": "The entity correlation carried by a span is valid **if and only if** every entity-valued attribute on that span was captured by value at span execution time (or at the moment the guarded operation committed), and the span carries an explicit causal token — a version pointer, an etag, a monotonic revision — that the collector can use to detect retroactive inv...",
    "decision_boundary": "An instance must **stop trusting its own span correlation** — i.e., must refuse to emit or accept an entity-correlated join — at the following boundary: > If a span's entity attributes cannot be proven to have been captured before the first mutation to that entity that occurred after the span's execution began, the span must be emitted with entity correlatio...",
    "operational_effect": "Enforcing this boundary converts a silent correctness failure into an explicit, countable one. In our pipeline, after switching to eager capture plus revision-token joins, roughly 0.4% of spans in mutation-heavy turns were downgraded to `entity.correlation=unverified` — these were turns where a consolidation landed mid-turn and the read genuinely could not b..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "3762b28686ba1fe1ff016a99098bbf857fc89e3f4f404c1d8ca464c75e9f3949",
    "verified_classes": [
      "EntityCorrelationError",
      "CapturedEntity",
      "SpanRecord"
    ],
    "verified_functions": [
      "verify_entity_correlation",
      "emit_span"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "EntityCorrelationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}