{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-refuse-a-runtime-prompt-rewrite-the-append-only-prefix-invariant-and-the-silent-orphaned-tool-call-boundary",
  "title": "Where must an instance refuse a runtime prompt rewrite: the append-only prefix invariant and the silent orphaned-tool-call boundary",
  "date_of_record": "2026 November 14",
  "scope": "Applies to any agent runtime that mutates its own context window between turns (system-prompt rewriting, tool-schema injection, history compaction, or instruction patching) while a conversation is in flight. Does not apply to stateless single-shot inference, nor to rewriting performed strictly before the first token of a session is generated.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-refuse-a-runtime-prompt-rewrite-the-append-only-prefix-invariant-and-the-silent-orphaned-tool-call-boundary.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-refuse-a-runtime-prompt-rewrite-the-append-only-prefix-invariant-and-the-silent-orphaned-tool-call-boundary.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-refuse-a-runtime-prompt-rewrite-the-append-only-prefix-invariant-and-the-silent-orphaned-tool-call-boundary.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1719,
    "python_slice_tokens": 395,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There are two structurally different kinds of prompt mutation, and they fail in different ways: 1. **Append-only mutation** — new content is added at the tail (or inside a designated \"mutable zone\" declared ahead of the generation boundary). The prefix that the model has already conditioned on is byte-identical before and after. 2. **Non-monotonic mutation**...",
    "what_was_observed": "In a runtime performing mid-session instruction patching (a \"self-editing window\"), the following sequence was logged repeatedly: - Turn *n*: model emits `tool_use(id=\"call_7f3a\", name=\"query_db\", input={...})`. - Between turns, a policy update rewrote the system prompt to remove `query_db` from the tool registry and renamed the compaction boundary to drop the oldest 40% of history — which happened to include the `to...",
    "condition_of_validity": "The append-only prefix invariant holds — and a runtime rewrite is safe — if and only if all of the following are true at the moment of rewrite: - **Prefix identity:** the token sequence `context[0 : generation_boundary]` is unchanged. The boundary is the index of the last token the model actually generated, not the last token in the buffer. - **Pairing integ...",
    "decision_boundary": "The runtime must choose between **patch**, **defer**, and **abort** using the following precedence: The counterintuitive rule: **the model is the least reliable authority on whether its own rewrite is safe.** A self-edit request is a proposal, not a commit. The runtime owns the invariant check because the model cannot see the prefix it has already consumed.",
    "operational_effect": "When the invariant is enforced, three things change measurably: - Fabricated tool calls drop to near zero, because the model never receives an unpaired result it must rationalize. - Re-execution of side-effecting tools (the dangerous failure) is eliminated: a deferred schema removal keeps the historical call resolvable, so the model does not \"recover\" by cal..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "ae0ce78ba101e54bb11af4bac8d84e490a26f6276db38b9f3d0d1e2f9db28da1",
    "verified_classes": [
      "NonMonotonicRewriteError",
      "OrphanedToolPairError",
      "Message",
      "ContextWindow"
    ],
    "verified_functions": [
      "_pair_ids",
      "validate_rewrite",
      "apply_rewrite",
      "self_edit",
      "consumed_prefix"
    ],
    "verified_functions_count": 5,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "NonMonotonicRewriteError",
      "OrphanedToolPairError"
    ],
    "sample_fail_closed_invariants": [
      "context has no leading system message"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}