Migrate Jim rope byte coordinates off GraphQL Int narrowing

[flyingrobots]

Classification

Width-preservation debt at the transitional GraphQL/Wesley boundary.

Problem

Jim's authoritative rope facts use non-negative u64 byte lengths and coordinates. The GraphQL corridor maps Int to signed Rust i32, so PR #282 correctly added a pre-admission obstruction when a checkpoint basis exceeds i32::MAX.

That obstruction preserves truth, but it leaves an artificial ~2 GiB capability ceiling and repeats narrowing seams anywhere rope byte coordinates cross the generated contract.

Evidence

• Checkpoint contract uses GraphQL Int
• Native pre-admission bound check
• Echo generator's current Int → i32 mapping
• Wesley #651: fixed-width deterministic contract extensions

Why it matters

Byte positions are authoritative coordinates, not presentation integers. A lossy or artificially narrow ABI either rejects valid rope states or tempts callers to cast, truncate, or create a side channel.

Constraints

• Keep the current checked conversion and typed obstruction until a width-preserving ABI exists.
• Never truncate, wrap, stringify ad hoc, or copy native identity/codec logic into TypeScript.
• Preserve deterministic little-endian encoding and explicit negative-value rejection.
• If Edict supersedes this GraphQL corridor first, solve the width contract in Edict and close this compatibility migration honestly.

Acceptance criteria

• Resolve or consume the fixed-width profile from Keep Wesley profile-neutral for deterministic contract extensions wesley#651, or document the equivalent Edict-native type.
• Inventory authoritative rope byte lengths, offsets, and ranges that cross the generated ABI.
• Replace GraphQL Int at those authority boundaries with an explicitly width-preserving non-negative type.
• Regenerate Rust and TypeScript-facing artifacts without manual edits.
• Remove only narrowing checks that become provably unnecessary.
• Witness zero, i32::MAX, i32::MAX + 1, and u64::MAX or the declared maximum.
• Negative and out-of-domain wire inputs fail closed before admission.
• Existing create/replace/checkpoint identities and receipts remain opaque.

Related

• Keep Wesley profile-neutral for deterministic contract extensions wesley#651 is the canonical generic platform issue; this issue is Jim's adoption slice.
• Slice: Add branded coordinate adapters for UTF-8 bytes, UTF-16, and line columns #227 covers coordinate adapters inside the product, not the generated wire-width contract.
• Route checkpoint declarations through Echo #282 introduced the correct temporary checkpoint bound.

[coderabbitai]

🔗 Related PRs

#15 - feat(contract): add text buffer optic GraphQL model [closed]
#35 - docs(method): bad-code card for hand-edits in generated rope codec [closed]
#265 - CR-01: Separate checkpoints from Echo anchor authority [merged]
#280 - Add runtime-backed causal range evidence [merged]
#282 - Route checkpoint declarations through Echo [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!