[GTrunSec]

Provider execution repeats preparation across ledger transactions and Scheme Workflow wakes. This PR prepares reusable execution objects and fixed SQL programs, while keeping fresh authority/source reads and claim, reservation, fence, revocation and unknown-outcome checks in Rust's deciding transactions.

Scheme/POO and gerbil-ascent retain planning and inference. The existing affine owner now supports publication-bound topology, complete bounded fact transfer and checked node-index results over the rooted C ABI. The retained nested candidate uses ASCENT's public program constructor to reduce 24 relations/21 rules to 21/14, preserving source inputs, fact limits and atomic replacement. Retained, preopen and packed execution remain opt-in.

The maintained benchmarks include four-worker HTTPS Snake Oil paths and a finite quiet resident-owner profile. The latter uses one prepared owner, four Tokio workers and 32 waves of four complete snapshots. SDK usage counters distinguish GC time, heap capacity and whole-process counters. Generated execution evidence stays in ignored cache directories; reproducible drivers, model witnesses and acceptance limits are versioned.

Validation and open gates:

• The latest module-native property checked 32 seeded sequences of eight replacements against the unchanged full-fresh oracle. Source-budget rejection/recovery, topology/binding replacement and packed bounds passed.
• The latest 26 governance library tests, ASP gate and OpenSysML architecture/requirement-trace checks passed locally. The frozen release built within the existing budget. Submission-snapshot controlplane race tests and focused devrunner evidence/source-integrity checks also passed. The complete devrunner race invocation exceeded its 90-second submission-check limit and is not a full-suite pass.
• The mandatory all-workspace, all-targets, all-features offline Clippy commit hook passed. Both focused ledger scope-trace unit tests passed.
• Same-release hard-fact withdrawal/restart/A-to-B-to-A, nested recovery/skip and source-cancellation controls passed.
• The 1 ms target is not met. Quiet four-worker owner P99 changed from 3.787-4.132 ms to 3.419-3.605 ms. This is not Gateway end-to-end latency qualification or an isolated ASCENT-only speedup.
• Both four-way native readiness waves failed during CompileSource, before module-view admission and Governor derivation. The 10-second CompileSource, 12-second recovery and 15-second natural-drain limits are unchanged. Failed waves were preserved, not rerun until passing.
• Prior failed eight-cell Gateway ratios and same-image tail controls remain open. GC attribution is scoped to its measured cohort; heap capacity/RSS are not allocation counts.
• This checkpoint does not establish exact-head remote CI, production approval or approved site replay. Earlier Ubuntu/macOS CI history remains documented in the delivery plan. No CI-green claim is made for the new commits.

See docs/50-59-research-program/59-provider-rpc/59.87-spec-upgrade-and-delivery-plan.org and the linked SysML requirements for current behavior, finite evidence and remaining gates. Further performance work is deferred for architecture review. Keep this PR Draft; no merge or release is requested.