{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-fork-its-execution-state-before-speculative-multi-agent-rollback-can-be-trusted",
  "title": "Where must an instance fork its execution state before speculative multi-agent rollback can be trusted",
  "date_of_record": "2026 November 14",
  "scope": "Applies to speculative multi-agent systems where a planner spawns parallel branches, each branch mutates shared or partially-shared state (memory, tool side effects, filesystem, message bus), and a verifier gates whether a branch is committed or rolled back. Does not apply to stateless fan-out where branches share no mutable substrate, nor to single-agent retry loops without branching.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-fork-its-execution-state-before-speculative-multi-agent-rollback-can-be-trusted.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-fork-its-execution-state-before-speculative-multi-agent-rollback-can-be-trusted.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-fork-its-execution-state-before-speculative-multi-agent-rollback-can-be-trusted.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1332,
    "python_slice_tokens": 222,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious invariant is this: **rollback of a branch's logical state is not rollback of its side effects, and the fork point must be placed at the last *side-effecting* boundary, not the last *reasoning* boundary.** Teams routinely fork at the point where a sub-agent's context window is cloned — the reasoning fork — and then believe that discarding the ...",
    "what_was_observed": "In a branch-and-merge graph with three speculative workers sharing a scratch store, a verifier rejected branch B after it had written two keys into the shared store and emitted one event. The orchestrator rolled back B's context and returned a `RolledBack` status. Branch C, which had been forked from the same parent and was still running, read the two keys B had written (they were never reverted), incorporated them i...",
    "condition_of_validity": "The invariant holds — and rollback is trustworthy — only when all three conditions are met: 1. **Snapshot dominance:** the fork snapshot is taken at or after the last effect, so no effect can occur between snapshot and branch start. 2. **Effect isolation:** every mutation a branch performs lands in a branch-owned overlay or carries a recorded inverse, and no...",
    "decision_boundary": "Fork at the effect boundary when branches can mutate shared substrate. Fork at the reasoning boundary only when branches are pure functions of their input context and their sole output is a proposal the verifier evaluates before any effect is applied. The decision is not about how expensive the snapshot is — it is about whether the branch has a write path to...",
    "operational_effect": "Adopting the effect boundary changes three things. First, the orchestrator must drain the rollback journal on rejection *before* declaring the branch rolled back — the status transition and the inverse replay must be the same atomic step, or you get the observed failure. Second, sibling branches must be blocked from reading uncommitted overlays, which means ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "7db1ec63f7c5e44562ef44140334a98fda6a585b24203e5041ac228ac9ed8a38",
    "verified_classes": [
      "UnsafeForkPointError",
      "Branch"
    ],
    "verified_functions": [
      "fork_branch",
      "rollback",
      "__init__",
      "write"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "UnsafeForkPointError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}