Atomic programs: transactional rules/schema and explicit command boundaries #170

Problem

Fact-only transactions are insufficient for migrations and pack installation. Rule/schema changes and unsupported administrative boundaries must not leave partial effects.

Evidence

Source: 5c1f313379a5cb2995a43a66ddba0b5cc9798b7f (inspected 2026-10-03). These are source findings; the acceptance scenarios below still need implementation and execution.

• src/protocol/handler.rs:2453: The program statement loop permits partial failure.
• src/protocol/handler.rs:4837: Authorization preflight is an existing boundary to retain.

Acceptance criteria

• Extend staging and WAL replay to rule/schema changes using canonical typed operations.
• Parse and authorize the complete program first; reject unsupported cross-KG/admin/network mixtures before any write.
• Test failed migration/pack install, arity changes, mixed DDL/DML and unsupported commands; clients observe one rule generation or the complete old state.
• Correct SDK atomic-load documentation to match supported boundaries; pass Performance: baseline and mandatory pre-PR regression pipeline #163 and affected behavior fixtures.

Delivery

Plan item: T03. R2 - Atomic programs + wire protocol.

Dependencies / related work: #169.

Contributes to #131; completing this slice alone does not close the broader issue.