{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-memory-poisoning-detector-silently-stop-detecting-after-a-store-compaction-the-attestation-window-invariant",
  "title": "Why does an instance memory-poisoning detector silently stop detecting after a store compaction: the attestation-window invariant",
  "date_of_record": "2026 November 10",
  "scope": "Applies to persistent agent stores that detect memory poisoning by comparing candidate writes against an attested baseline snapshot (Merkle root, hash-chain head, or signed manifest) and that perform periodic compaction, GC, or segment rewriting. Does not apply to append-only stores with no rewriting, nor to detectors that re-attest from live content on every read.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-memory-poisoning-detector-silently-stop-detecting-after-a-store-compaction-the-attestation-window-invariant.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-memory-poisoning-detector-silently-stop-detecting-after-a-store-compaction-the-attestation-window-invariant.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-memory-poisoning-detector-silently-stop-detecting-after-a-store-compaction-the-attestation-window-invariant.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1418,
    "python_slice_tokens": 256,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There are two different things a memory-poisoning detector can compare a candidate write against: 1. **Content attestation** — a signature or Merkle root over the *current bytes* of the store. This proves the bytes have not changed since signing, but says nothing about whether the bytes were *correct* when signed. 2. **Provenance attestation** — a chain of r...",
    "what_was_observed": "On a long-running agent store (segmented LSM-style, ~40 GB, 90-day retention), a poisoning detector flagged injected writes reliably for the first ~30 days. After the first scheduled compaction at day 31, detection rate fell to zero for the affected segments while all health metrics — signature verification, Merkle root match, chain continuity — reported green. The mechanism: compaction merged poisoned and clean reco...",
    "condition_of_validity": "The detector remains sound only while all of the following hold: - The attested baseline is **never regenerated from store content** after initial provisioning; it is advanced only by appending *provenance events* (writer identity, policy epoch, prior head) signed by a key the store's writer path cannot reach. - Every compaction/GC/rewrite emits a **rewrite ...",
    "decision_boundary": "Use content attestation alone only when the store is append-only and the baseline is provisioned once from a known-good export and never rewritten. The moment a rewrite, GC, or segment merge is introduced, you are in provenance-attestation territory and must pay the cost of an external signer and a rewrite-event log. The boundary is not \"does compaction exis...",
    "operational_effect": "Teams that miss this boundary typically discover it during incident response, not before: the poisoning is found by an external anomaly (agent behavior drift), and the detector's green dashboards are then revealed to have been meaningless for weeks. Remediation requires reconstructing provenance from an independent log — often unavailable — and re-provisioni..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION",
    "CONTEXT_DRIFT_OR_ATTENTION_DILUTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "087fc76992674a6cd5279695a821fad4df88f8fccdc64be271076438152187af",
    "verified_classes": [
      "AttestationWindowViolation",
      "ProvenanceChain"
    ],
    "verified_functions": [
      "advance_baseline",
      "detect_poison",
      "__init__",
      "head",
      "append_rewrite_event"
    ],
    "verified_functions_count": 5,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "AttestationWindowViolation"
    ],
    "sample_fail_closed_invariants": [
      "provenance head diverged from externally held root; detector is unsound",
      "rewrite event signed by in-domain key; baseline would be self-attesting"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}