Route executable-operation Actions through scheduler-owned Ticks

.github/workflows/ci.yml

@@ -145,6 +145,10 @@ jobs:
               run: |
                   cargo clippy -p warp-core --features host_test --test causal_fact_publication_tests -- -D warnings -D missing_docs
                   cargo clippy -p warp-core --features host_test --test optic_invocation_admission_tests -- -D warnings -D missing_docs
+            - name: cargo clippy (scheduler-owned executable Actions)
+              run: |
+                  cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime --test executable_operation_pipeline_tests -- -D warnings -D missing_docs
+                  cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests -- -D warnings -D missing_docs
 
     clippy-det-fixed:
         name: Clippy (det_fixed)
@@ -301,6 +305,10 @@ jobs:
               run: cargo test -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests
             - name: cargo test (warp-core provider proposal admission)
               run: cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime --test provider_contract_admission_tests
+            - name: cargo test (scheduler-owned executable Actions)
+              run: |
+                  cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime --test executable_operation_pipeline_tests
+                  cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests
             - name: cargo test --doc (warp-core)
               run: cargo test -p warp-core --doc
             - name: PRNG golden regression (warp-math)

.github/workflows/macos-local.yml

@@ -51,6 +51,10 @@ jobs:
         run: |
           cargo clippy -p warp-core --features host_test --test causal_fact_publication_tests -- -D warnings -D missing_docs
           cargo clippy -p warp-core --features host_test --test optic_invocation_admission_tests -- -D warnings -D missing_docs
+      - name: cargo clippy (scheduler-owned executable Actions)
+        run: |
+          cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime --test executable_operation_pipeline_tests -- -D warnings -D missing_docs
+          cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests -- -D warnings -D missing_docs
       - name: cargo test (workspace)
         run: cargo test --workspace
       - name: cargo test (warp-core host_test admission fixtures)
@@ -59,3 +63,7 @@ jobs:
           cargo test -p warp-core --features host_test --test optic_invocation_admission_tests
       - name: cargo test (warp-core installed contract intent pipeline)
         run: cargo test -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests
+      - name: cargo test (scheduler-owned executable Actions)
+        run: |
+          cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime --test executable_operation_pipeline_tests
+          cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests

CHANGELOG.md

@@ -7,14 +7,92 @@
 
 ### Added
 
+- Executable-operation application writes now enter Echo as canonical,
+  WAL-acknowledged Actions and are evaluated only by the scheduler while
+  constructing a Tick (ADR 0025). Accepted pre-Tick Actions recover as pending
+  work. Runtime-owned admission uses a bounded pending index and cache;
+  unavailable packages are quarantined without poisoning unrelated work.
+  Durable-acceptance lookup and newly committed receipt correlations are
+  indexed directly, so scheduler Ticks do not replay or diff retained history.
+  A WAL-enabled app surface rejects executable Actions submitted outside the
+  durable acknowledgement boundary before witnessed intake can mutate.
+  Mixed executable and provider/native backlogs alternate by durable parent
+  global-Tick parity. The scheduler-round coordinate advances once per pass, so
+  every head switches categories even when several heads share one worldline,
+  preventing caller-controlled ingress hashes from starving either category.
+  Homogeneous unbounded admission moves the complete inbox map instead of
+  rebuilding and removing its entries one by one.
+  Positional receipt attribution is exclusive to executable Actions; ordinary
+  correlations without an exact scope match fail closed.
+  Scheduler selection admits at most 64 executable Actions per Tick, leaving
+  excess work pending, and meters footprint comparisons, blocker evidence, and
+  aggregate operations during composition. Two independent Actions can share
+  one exact parent coordinate and contribute to one composite Tick while
+  retaining candidate-specific application-basis propositions and per-Action
+  typed outcomes. Footprint conflicts name earlier applied members; evaluator
+  and composition-budget obstructions contribute no operations. Every
+  noncommitted typed outcome carries its deciding writer head, worldline and
+  global Tick coordinates, commit and Tick-receipt identities, and canonical
+  member index. Tick construction pins that index to the corresponding receipt
+  entry with an executable alignment invariant.
+  One scheduler WAL transaction retains exactly one batched Tick decision
+  record, then each Action's receipt correlation and typed outcome in canonical
+  order, followed by exactly one replayable state delta. Recovery rejects every
+  second transaction claiming the same state-transition coordinate, including
+  a byte-identical delta, so a Tick cannot be reconstructed from split WAL
+  fragments. The decided Tick is durable before state, frontier, receipt, or
+  outcome publication. Recovery
+  and same-host retry both preserve an accepted Action when Tick-WAL
+  persistence fails; runtime rollback also rolls back the corresponding
+  admission cache so the Action re-enters scheduler admission. Fresh-host
+  recovery validates every outcome against its exact envelope, admission,
+  invocation, installed operation, causal coordinate, evaluation basis,
+  reconstructed preparation and actual footprint, Tick entry, composite
+  consequence, exact reconstructed aggregate patch membership, and state root.
+  Typed obstruction records retain their invocation-admission policy and
+  budget ceiling; recovery reproduces bounded evaluation and the complete
+  scheduler composition before accepting an obstruction kind. For a
+  cross-worldline basis obstruction, recovery reconstructs the submitted basis
+  on its named worldline but resolves the deciding transition on the target
+  head's worldline.
+  Recovery records one monotonic installation ordinal per package and one
+  installation-count boundary per Action, avoiding per-outcome package-set
+  snapshots while preserving exact installation-before-Tick validation.
+  Activation caches each reconstructed causal state by worldline coordinate,
+  so Actions sharing one scheduler basis do not replay that history repeatedly.
+  Recovered Action outcomes resolve installed packages through one package-ID
+  index instead of scanning the complete installation set per Action. Test
+  instrumentation now counts the actual package-index and installation-order
+  lookups rather than asserting constant zero-value proxies. Tick WAL staging
+  borrows its read-only outcome index instead of deep-cloning every outcome.
+  The v1 scheduler Action-candidate ceiling is exported as
+  `ACTION_BATCH_CANDIDATE_LIMIT_V1`; its acceptance witness now proves the
+  complete limit with independent, non-conflicting node targets. Admission
+  applies that ceiling independently to each runnable head, so Actions retained
+  for dormant or faulted heads cannot consume another head's Tick capacity.
+  `run_until_idle` continues after a no-Step pass that advances bounded Action
+  admission, so an obstructed prefix cannot hide later admissible work.
+  When more than that ceiling is pending, runtime admission selects the bounded
+  set by canonical ingress identity rather than submission identity.
+  `TrustedRuntimeHost::into_parts` now returns an opaque
+  `TrustedRuntimeHostParts` value consumed by `from_parts`, preserving WAL,
+  authority, policy, pending admission, and every typed Action outcome across
+  host decomposition and reconstruction.
+  A composite receipt cannot validate outside its complete Action-batch
+  context. Legacy operation recovery-index roots remain byte-compatible when
+  no Action outcome exists. Direct operation
+  prepare/commit remains a documentation-hidden public
+  `TrustedRuntimeHost` compatibility/test seam, absent from
+  `TrustedRuntimeApp`; removal is tracked by issue #689.
 - `TrustedRuntimeHost` now has the first hook-free executable-operation runtime
   slice. A runtime owner can admit exact canonical
   `ExecutableOperationPackageV1` bytes under a separate package policy, install
   their data-only `EchoOperationProgramV1`, independently admit an exact-basis
   invocation under caller authority and delegated budget, evaluate privately,
   and either commit one parent-visible patch or return typed noncommit evidence.
-  Only committed operation consequences enter the operation-tick WAL. The initial
-  generic program performs an anchored typed-node alpha-attachment
+  On that transitional direct seam, only committed operation consequences
+  enter the operation-tick WAL. The initial generic program performs an
+  anchored typed-node alpha-attachment
   compare-and-set; it contains no application matcher, executor, footprint
   callback, or prebuilt mutation plan. Package, installation, invocation,
   evaluation, actual-footprint, budget, patch, result, basis, and terminal
@@ -28,8 +106,7 @@
   callbacks. A program digest alone cannot install, invoke, or authorize an
   operation. This slice does not yet include Edict
   compiler emission, a structurally separate target verifier, Jedit's rope
-  lawpack, `ReplaceRange`, scheduler batch composition, or an independently
-  implemented semantic oracle.
+  lawpack, `ReplaceRange`, or an independently implemented semantic oracle.
 - The executable-operation corridor now has a separate
   `AnchoredNodeAttachmentCreateIfAbsent` program (ADR 0024). The original
   compare-and-set program remains update-only with its canonical program,

README.md

@@ -175,25 +175,26 @@ host-constructed `InstalledContractPackage` values.
 Separately, Echo can now admit and install an exact canonical
 `ExecutableOperationPackageV1`, admit an exact-basis invocation under explicit
 authority and delegated budget, evaluate its data-only
-`EchoOperationProgramV1` privately, and either commit one patch or return typed
-noncommit evidence. Only committed operation consequences enter the
-operation-tick WAL. The initial generic program performs an anchored typed-node
-alpha-attachment compare-and-set. Its receipt binds the admitted package,
-operation, subordinate program, invocation, complete evaluation basis,
-authority, declared and actual footprints, budgets, patch, result, and terminal
-outcome. Runtime-control installation and committed execution-kernel records
-permit callback-free fresh-host recovery. Program bytes explicitly bind the
-interpreter and intrinsic profiles, while the parent patch and singleton tick
-evidence bind the admitted installation. A program digest cannot confer
-operation identity, invocability, or authority.
+`EchoOperationProgramV1` privately during scheduler-owned Tick construction,
+and either commit its member consequence or return typed noncommit evidence.
+Two independent, same-basis executable Actions can enter one atomic Tick. The
+initial generic programs perform anchored typed-node alpha-attachment
+compare-and-set and create-if-absent operations. Their receipts bind the
+admitted package, operation, subordinate program, invocation, complete
+evaluation basis, authority, declared and actual footprints, budgets, patch,
+result, composition, and terminal outcome. Runtime-control installation and
+scheduler Tick records permit callback-free fresh-host recovery. Program bytes
+explicitly bind the interpreter and intrinsic profiles, while Tick evidence
+binds each admitted installation. A program digest cannot confer operation
+identity, invocability, or authority.
 
 That generic runtime witness is not yet the Jim/Jedit vertical. No real Edict
 compiler output, Jedit rope lawpack, or `ReplaceRange` operation uses it, and it
-does not yet claim structurally separate target verification, scheduler batch
-composition, or independently implemented semantic conformance. It also
-temporarily reuses `TrustedRuntimeHost`'s joint `native_rule_bootstrap` and
-`trusted_runtime` feature gate. The program itself has no native hooks, but the
-host surface must be decoupled from the legacy bootstrap feature before a
+does not yet claim structurally separate target verification, cross-category
+scheduler composition, or independently implemented semantic conformance. It
+also temporarily reuses `TrustedRuntimeHost`'s joint `native_rule_bootstrap`
+and `trusted_runtime` feature gate. The program itself has no native hooks, but
+the host surface must be decoupled from the legacy bootstrap feature before a
 product can remove that compatibility feature.
 
 The following sequence is the existing Wesley bootstrap fixture:
@@ -248,17 +249,23 @@ The current executable-operation runtime slice is:
 canonical ExecutableOperationPackageV1 bytes
 -> Echo-owned package and invocation admission
 -> installed data-only EchoOperationProgramV1
--> bounded private Echo evaluation
--> exact-basis singleton commit
--> typed receipt, WAL retention, and callback-free recovery
+-> canonical Action submission retained before acknowledgement
+-> runtime-owned admission into the ordinary head inbox
+-> scheduler selection at one exact basis
+-> bounded private Echo evaluation during Tick construction
+-> one composite Tick consequence with typed per-Action outcomes
+-> decided Tick WAL retention before state, frontier, and Receipt publication
+-> callback-free pending-Action and decided-Tick recovery
 ```
 
 The first two paths are callback-shaped compatibility infrastructure. The
 third proves Echo-owned execution of admitted data-only meaning through
 separate update-only compare-and-set and single-node create-if-absent program
-profiles. No real Edict compiler output, Jedit operation, or Graft
-multi-record mutation uses them yet. The next convergence crossing must bind a
-real application-owned Edict operation and lawpack to the executable-operation
+profiles. Independent Actions for one head can share one scheduler-owned Tick;
+conflicting or obstructed Actions retain typed outcomes without hidden
+mutation. No real Edict compiler output, Jedit operation, or Graft operation
+uses this route yet. The next convergence crossing must bind a real
+application-owned Edict operation and lawpack to the executable-operation
 package without reintroducing a native implementation.
 
 ## Contracts And Boundaries