{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-commit-a-task-under-partial-synchrony-but-fail-to-reconcile-shared-state-after-a-view-change-a-boundary-record-on-equivocation-to",
  "title": "Why does an instance commit a task under partial synchrony but fail to reconcile shared state after a view change: a boundary record on equivocation-tolerant commitment versus state-merge divergence",
  "date_of_record": "2026 November 11",
  "scope": "Applies to BFT consensus protocols (PBFT-family, HotStuff-family, and Tendermint-style commit-and-reconcile loops) used to bind multi-agent task commitments to a replicated shared-state object, where replicas may equivocate and where view changes occur after a commit quorum is reached. Does not apply to crash-fault-tolerant replication, to single-agent local task queues, or to systems where shared state is append-only and idempotent by construction.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-commit-a-task-under-partial-synchrony-but-fail-to-reconcile-shared-state-after-a-view-change-a-boundary-record-on-equivocation-to.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-commit-a-task-under-partial-synchrony-but-fail-to-reconcile-shared-state-after-a-view-change-a-boundary-record-on-equivocation-to.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-commit-a-task-under-partial-synchrony-but-fail-to-reconcile-shared-state-after-a-view-change-a-boundary-record-on-equivocation-to.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1922,
    "python_slice_tokens": 496,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A task *commitment* is a decision predicate: a quorum of replicas signed a task record, and the record is now irrevocable. A *shared-state reconciliation* is a convergence predicate: every live replica's materialized view of the world agrees with every other live replica's view, including the effects of tasks that were committed but whose side-effect message...",
    "what_was_observed": "In a five-replica PBFT-class deployment committing multi-agent tasks against a shared ledger object, an equivocating primary sent conflicting `PRE-PREPARE` for task T_a to replicas {1,2} and task T_b to replicas {3,4}. Quorum intersection (f=1, n=5, quorum=3) prevented both from committing — T_a reached a commit certificate, T_b did not. Safety held. However, the shared-state object was a per-agent capability map upd...",
    "condition_of_validity": "The failure is *reachable* under all of the following jointly: 1. The protocol permits speculative execution of uncommitted tasks (optimistic path), so honest replicas can hold uncommitted effects. 2. The shared-state merge function is not a join over a semilattice — i.e., it is order-sensitive or non-idempotent for at least one field. 3. The commit certific...",
    "decision_boundary": "The operational decision is whether to spend the reconciliation budget on *detection* or on *prevention*, and the boundary is the equivocation rate relative to the view-change rate. - If the equivocation rate is low and view changes are rare, detection-and-repair is cheaper: attach a periodic state-digest exchange (Merkle root over the capability map with pe...",
    "operational_effect": "The observable signature is a *silent* divergence: consensus metrics (commit latency, view-change count, quorum health) stay green while a downstream reader observes inconsistent state. This is the dangerous class because it defeats the standard BFT monitoring posture, which watches the consensus layer. Reconciliation divergence must be monitored at the *sta..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "26e4e9fa9225c0cc54aabce919c4cab5c9646be77a499c3f86aef127d0f15d62",
    "verified_classes": [
      "ReconciliationDivergenceError",
      "CapabilityState"
    ],
    "verified_functions": [
      "reconcile",
      "commit_and_reconcile"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ReconciliationDivergenceError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}