Echo records witnessed causal history per worldline. Playback, scheduling, observation, forking, and recovery need one account of which coordinates exist, which actors may advance them, and which operations merely read recorded history. A global mutable timeline or debugger-owned rewind would make those boundaries implicit and would let one consumer rewrite unrelated history.
A worldline is a core runtime identity with its own admitted causal history and frontier. It is not a UI session, materialized graph, or debugger construct.
A writer head may propose advancement of its bound worldline through the trusted runtime's deterministic admission and commit path. A reader head may seek and replay already admitted history but cannot advance or reposition the worldline frontier. Seeking beyond the frontier clamps or obstructs according to the observation contract; it never synthesizes future history.
Multiple heads may name one worldline. Head-local observation or playback does not mutate other heads or worldlines. Administrative rewind is a separate, explicit maintenance authority governed by ADR 0010, not the default playback operation.
The scheduler considers runnable writer heads in a canonical order derived from stable worldline and head identities. Paused, obstructed, or unauthorized heads do not advance.
Writers targeting the same worldline may execute concurrently only when their admitted work is footprint-independent. Interfering work has a deterministic serial order. Host worker count, timing, and map iteration cannot affect admission, commit order, receipt bytes, or frontier identity.
Reader heads do not participate in commit scheduling. Their reads lower through the explicit observation and optic boundaries and retain the coordinate and evidence posture of the history they inspect.
External consumers propose explicit-basis intents. The trusted runtime admits, stages, pluralizes, conflicts, or obstructs those proposals under named law. Product adapters and tools cannot mutate a worldline through a private state setter or a UI-local timeline.
Internal engine mutation helpers may exist for trusted implementation and test construction, but they do not define an external application authority. Duplicate suppression is scoped to the resolved causal target; equal payload bytes alone do not make two differently based proposals identical.
Admitted causal history is append-only at the worldline boundary. Replay reads recorded commits, patches, receipts, witnesses, and retained boundary material; it does not rerun a live scheduler to invent missing history.
Forking shares a witnessed prefix and creates an independently advancing suffix. Per-worldline tick is an append coordinate. Any cross-worldline clock is correlation metadata and cannot impersonate a worldline-local causal position.
- A worldline frontier advances monotonically through admitted commits.
- A writer head advances only its bound worldline and only under scheduler authority.
- A reader head never mutates a frontier or synthesizes future history.
- Head-local seek and observation never rewind unrelated worldlines.
- Runnable-writer order and interference resolution are deterministic.
- Equivalent admitted inputs over the same basis produce equal receipts and committed identities.
- Scheduler order is independent of wall clock, worker count, and host map iteration.
- Fork identity binds the witnessed prefix from which the new suffix descends.
- One global mutable timeline shared by every worldline and consumer.
- Debugger- or UI-owned rewind that mutates runtime history.
- Reader playback implemented by running unrecorded scheduler steps.
- Host timing or CPU count as a canonical scheduling input.
- Treat a session, materialized view, or equal payload as a causal coordinate.
- Worldline and head identities are explicit in scheduling, observation, playback, receipts, and recovery.
- Tooling remains a consumer of runtime authority rather than a privileged mutator.
- Concurrent writer execution requires honest footprints and deterministic interference handling.
- Observational seek and administrative maintenance remain separate APIs and evidence postures.
- Cross-worldline exchange must use witnessed causal transport rather than shared mutable state.
crates/warp-core/src/head.rscrates/warp-core/src/coordinator.rscrates/warp-core/src/worldline.rscrates/warp-core/src/worldline_state.rscrates/warp-core/src/provenance_store.rscrates/warp-core/src/observation.rsdocs/adr/ADR-0010-observational-seek-and-administrative-rewind.mddocs/adr/0018-sessions-causal-posture-and-authority.md
The original record included a normative implementation order, dated file and status inventory, application examples, test-plan table, critical-path claims, and document-amendment procedure. Those process artifacts remain in Git history and are not architectural authority.