{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-of-a-self-editing-context-policy-silently-corrupt-its-own-working-set-when-a-model-authored-rewrite-is-applied-as-a-guarded-diff",
  "title": "Why does an instance of a self-editing context policy silently corrupt its own working set when a model-authored rewrite is applied as a guarded diff against a stale base?",
  "date_of_record": "2026 November 12",
  "scope": "Applies to any agent loop where the model emits a context-rewrite patch that is validated against a guardrail set and then applied to the live context buffer via a diff algorithm. Does not apply to append-only context growth, to full-buffer replacement without diffing, or to rewrites where the base snapshot is re-derived atomically at apply time from the same revision the model saw.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-self-editing-context-policy-silently-corrupt-its-own-working-set-when-a-model-authored-rewrite-is-applied-as-a-guarded-diff.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-self-editing-context-policy-silently-corrupt-its-own-working-set-when-a-model-authored-rewrite-is-applied-as-a-guarded-diff.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-self-editing-context-policy-silently-corrupt-its-own-working-set-when-a-model-authored-rewrite-is-applied-as-a-guarded-diff.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1624,
    "python_slice_tokens": 279,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A guarded-diff rewrite pipeline has two independent notions of \"the context\": the *base revision* the model was shown when it authored the patch, and the *live revision* the diff engine applies against. Guardrails typically police the patch's *contents* — line counts, forbidden deletions, protected regions, token budget deltas — but not the *identity of the ...",
    "what_was_observed": "In a loop where the model periodically rewrites its own scratchpad, we observed the following sequence: 1. At revision `r17`, the model is shown the buffer and emits a patch adding a constraint block and deleting a stale instruction. The patch carries context lines drawn from `r17`. 2. Before the patch is applied, a tool-call result is committed, advancing the buffer to `r18`. The tool result was inserted near the to...",
    "condition_of_validity": "The corruption requires all of the following to co-occur: - **Non-atomic authoring/apply window.** The model authors against a snapshot, and the buffer can mutate before apply. Any await, any tool round-trip, any concurrent writer opens this window. - **Fuzzy or offset-tolerant hunk matching.** Exact-match-only diffing with strict base hashes would reject th...",
    "decision_boundary": "The operational rule: **never apply a model-authored diff unless the patch is cryptographically bound to the base revision it was authored against, and the apply step re-verifies that binding under the same lock that guards buffer mutation.** Concretely, the boundary is between two designs: - *Content-validated apply* — guardrails inspect the patch, then the...",
    "operational_effect": "When the boundary is respected, stale patches are rejected loudly and the model is asked to re-author against the current revision. The cost is occasional re-authoring latency; the benefit is that every committed rewrite is provably relative to a base the model actually saw. When the boundary is violated, the system exhibits *silent semantic drift*: the buff..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "47c9c396263ab41905541e2b01107e0cf79dc1a109abe5a931cd3d63ff348d03",
    "verified_classes": [
      "StaleRewriteBaseError",
      "ContextBuffer",
      "RewritePatch"
    ],
    "verified_functions": [
      "apply_guarded_rewrite",
      "content_hash"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "StaleRewriteBaseError"
    ],
    "sample_fail_closed_invariants": [
      "post-apply hash mismatch; buffer corrupted"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}