{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-silent-side-effect-duplication-in-speculative-multi-agent-branch-and-merge-execution",
  "title": "Which invariants prevent silent side-effect duplication in speculative multi-agent branch-and-merge execution",
  "date_of_record": "2026 November 11",
  "scope": "Applies to orchestrators that speculatively fork multiple agent branches from a shared checkpoint, allow each branch to perform external side effects (writes, RPCs, queue publishes, payments), and later merge the winning branch while rolling back the losers. Does not apply to pure-functional branches with no externally observable effects, nor to systems where every branch runs against an isolated transactional sandbox that is committed atomically.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-silent-side-effect-duplication-in-speculative-multi-agent-branch-and-merge-execution.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-silent-side-effect-duplication-in-speculative-multi-agent-branch-and-merge-execution.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-silent-side-effect-duplication-in-speculative-multi-agent-branch-and-merge-execution.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1540,
    "python_slice_tokens": 425,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between *logical rollback* and *physical reversal*. A branch-and-merge engine can always discard a losing branch's in-memory state and its journal entries; it cannot always un-send an email, un-charge a card, or un-publish a Kafka message. The naive invariant — \"a rolled-back branch leaves no trace\" — is false the moment any b...",
    "what_was_observed": "A three-branch speculative planner forked at step 12 of a workflow. Branch A and Branch B both independently decided to call a `POST /notify` endpoint to inform a customer of a delay; the merge policy selected Branch A and discarded B. The rollback path replayed B's journal in reverse and invoked B's registered compensator, which issued a `POST /notify/cancel`. Because the downstream service treated cancel as \"send a...",
    "condition_of_validity": "The merge-rollback model is valid only when all of the following hold simultaneously: 1. **Effect keying is merge-scoped, not branch-scoped.** Every outbound effect carries a deterministic key derived from `(merge_unit_id, logical_effect_id)`, where `logical_effect_id` is stable across branches that intend the same effect. Branches that intend *different* ef...",
    "decision_boundary": "Speculate a branch if and only if every effect it can reach is class (a) deferred, class (b) idempotent under a merge-scoped key, or class (c) compensable by an idempotent registered undo. If a branch can reach an effect that is none of these — a payment capture, a physical dispatch, a one-shot webhook with no dedup — do not speculate it; serialize it behind...",
    "operational_effect": "Enforcing these invariants converts a class of silent, customer-visible duplicate effects into a loud, pre-merge rejection. The cost is reduced parallelism on irreversible effects and a requirement that effect definitions carry idempotency and compensation metadata. The benefit is that rollback becomes a real operation rather than a hopeful one: a discarded ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "77b9b95f242dd0bdf1b77b33047765a12358dedfe4f5c1675f2dd18f87e41adb",
    "verified_classes": [
      "SpeculationInvariantError",
      "EffectClass",
      "EffectSpec",
      "Branch",
      "SpeculationGuard"
    ],
    "verified_functions": [
      "__init__",
      "register_effect",
      "key_for",
      "admit_effect",
      "rollback_branch",
      "commit"
    ],
    "verified_functions_count": 6,
    "defensive_guards_count": 6,
    "raised_exceptions": [
      "SpeculationInvariantError"
    ],
    "sample_fail_closed_invariants": [
      "assert spec.compensator is not None"
    ],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "enum",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}