diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 511ba251..ee36e1aa 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -31,9 +31,39 @@ The broader project doctrine is written down in - Generated contract packages The current compatibility corridor is authored in GraphQL, compiled to Rust bindings and contract-host helpers by Echo's Wesley extension, and registered - with Echo by Jim's trusted native host. Edict will replace the transitional - authored Rust operation law and invocation glue. Generated metadata without - Echo registration and scheduler execution is not a production substitute. + with Echo by Jim's trusted native host. This is migration evidence, not the + target application boundary. The target is Jim-authored Edict source compiled + through Edict's public application-build boundary into a verified generic + Echo package. Generated clients are codecs and transport stubs; they may not + contain Jim's command interpretation or operation-selection logic. + +## Target Ownership + +The final application is Jim authored in Edict and realized by Echo: + +- Jedit, Bijou, and native adapters are Jim's body. They decode terminal and + process input into canonical events, install or address verified packages, + transport opaque runtime artifacts, and render disposable projections. +- `Jim.edict` is Jim's mind. It owns editor state, modes, operators, motions, + cursor and selection policy, registers, pending actions, input-event + interpretation, observation requests, application intents, and outcome + handling. +- Jim-owned Edict lawpacks own application operations and optics such as + `ReplaceRange`, `CreateBuffer`, `DeclareCheckpoint`, and `TextWindow`, plus + their fact schemas, identities, results, and typed obstructions. +- Edict owns source checking, Core IR, authority and lawpack closure, target + lowering, package construction, and structurally separate verification. +- Echo owns only generic runtime authority: installation, admission, budgets, + scheduling, bounded program interpretation, atomic ticks, WAL, receipts, + readings, recovery, and evidence. +- Graft owns structural intelligence and projections over bounded readings. It + has no Jim text authority and does not justify application vocabulary in Echo. + +Echo production code must never branch on or implement Jim/Jedit nouns or +verbs. In particular, Echo has no `ReplaceRange` variant, rope intrinsic, +`Buffer` or `TextWindow` semantics, native Jim planner callback, +`MutationPlan`, or caller-authored graph patch. Application coordinates may be +carried opaquely in packages, fixtures, and receipts. ## Non-Negotiables @@ -56,10 +86,21 @@ Compile-time types are not a substitute for runtime truth. ## Contract Authority -Jim's domain types record application semantics, but they are not executable -Echo authority. Production mutation must use an Echo-installed verified -operation. Handwritten TypeScript codecs, admission logic, receipts, local -executors, and metadata-only descriptors are forbidden substitutes. +Jim-owned Edict source is the executable application law. A schema, oracle, +compiler target, and runtime receipt are distinct artifacts: + +- `jedit.text.schema@1` defines application fact shapes, codecs, and identity + rules; +- `jedit.text.ReplaceRange.oracle@1` is independent expected-behavior evidence; +- `ReplaceRange.edict` is the authored operation semantics; +- compiler-produced Echo Target IR and its verified package are executable + meaning; and +- an Echo receipt is evidence that one admitted package ran against one basis. + +Neither the schema nor the oracle is a program. Echo must not reverse-engineer +application behavior from either one. Handwritten TypeScript codecs, admission +logic, receipts, local executors, metadata-only descriptors, and handwritten +packages are forbidden substitutes. The current narrow production corridor is: @@ -73,12 +114,39 @@ Jim command -> basis-pinned bounded observation ``` -Only buffer creation, single-range replace/insert/delete, and bounded text-window -observation use this corridor. Checkpoint, save/export, multi-range editing, -range explanation, causal gutter readings, and undo/redo still fail closed. +Only buffer creation, single-range replace/insert/delete, checkpoint +declaration, and bounded text-window observation use this compatibility +corridor. Save/export, multi-range editing, range explanation, causal gutter +readings, and undo/redo still fail closed. Do not widen this path or mistake it +for the target. + +At the target boundary, Jedit normalizes physical input into one canonical +event envelope with stable event, source, ordering, normalized-input, and +admission coordinates. Echo admits and transports that envelope without +inspecting Jim or Jedit fields. Only `jim.core`, authored from `Jim.edict`, +interprets editor meaning. The exact wire schema belongs to the event protocol +ADR; the ownership invariant is frozen in +[Jim: Components, Responsibilities, and Ownership](docs/jim-component-ownership.md). + +The target corridor is: + +```text +terminal bytes +-> Jedit adapter emits one canonical event envelope +-> Echo realm admits and delivers it opaquely under an exact JimRelease +-> jim.core interprets the event and durably retains any command attempt +-> jim.core requests a jedit.text bounded optic such as TextWindow.edict +-> Echo returns a basis-bound Reading +-> jim.core composes jedit.text law such as ReplaceRange.edict +-> Echo privately evaluates one combined Jim-and-buffer candidate +-> one realm and epoch atomically settles Jim, Buffer, result, and evidence + or retains a distinct CandidateSettlementRejected outcome +-> Jedit renders one declared causal view basis +``` + The GraphQL/Wesley package is a deliberately narrow compatibility path until -Edict can provide generated operation law and invocation. Do not restore the -deleted Node-host Wesley projections, local runtime, or local storage authority. +the active-observer corridor replaces it. Do not restore the deleted Node-host +Wesley projections, local runtime, or local storage authority. ## Identity Doctrine (Locked) @@ -161,14 +229,19 @@ What Graft should own: - symbol occurrences and rename preview - structural diff, semantic summary, and anchor-affinity style snapshot mapping -What `jedit` should own: +What `Jim.edict` should own: - buffer lifecycle over Echo-backed rope heads - cursoring, selection state, and undo/redo over edit groups grounded in ticks - edit-group and undo policy over ticks - Vim-shaped mode semantics and input interpretation +- observation requests, operation intents, and outcome handling + +What Jedit/Bijou/native adapters should own: + - panes, panels, focus, and lens lifecycle -- save/open flows and workspace interaction policy +- terminal decoding, process bootstrap, raw I/O, and rendering +- file import/export adapters invoked under Jim-authored policy - paint decisions and terminal-specific rendering Why the boundary exists: diff --git a/docs/BEARING.md b/docs/BEARING.md index 1d2592fa..7be0f60b 100644 --- a/docs/BEARING.md +++ b/docs/BEARING.md @@ -1,8 +1,9 @@ # BEARING -Current bearing: operate one real Echo-hosted text corridor now, keep every -unsupported feature obstructed, and replace transitional Wesley/Rust operation -glue with generated Edict operations when Edict is ready. +Current bearing: keep the real Wesley compatibility corridor honest, author +Jim's first operation as real Edict source, and converge on `Jim.edict` as an +Echo-realized active observer. Do not add editor vocabulary to Echo or move +Jim's semantic state machine into a generated TypeScript client. This document records current repository truth. Historical implementation claims belong in git history and design retrospectives. @@ -25,10 +26,12 @@ claims belong in git history and design retrospectives. Narrow edits path-copy touched nodes and retain untouched subtree identity. - Restart reconstructs witnessed submissions, graph state, and receipts from Echo's filesystem runtime WAL. The recovered host can continue editing. -- TypeScript owns only the JSONL process adapter, Jim request/result mapping, - coordinate branding, and disposable UI projections. It does not construct - Echo identities, admission evidence, receipts, graph patches, or scheduler - outcomes. +- TypeScript currently owns the JSONL process adapter, request/result mapping, + coordinate branding, and disposable UI projections. Its request mapping is + explicit migration debt: in the target corridor TypeScript normalizes + canonical events and transports artifacts, but has zero semantic authority + to interpret commands, choose operations, derive ranges, advance Jim state, + or optimistically mutate visible text. - Buffer open/create, insert, replace, delete, checkpoint declaration, and bounded text-window reads are implemented. Multi-range edit, save/export, `:why`, causal line-diff, and undo/redo return typed obstructions. @@ -73,14 +76,47 @@ Jim command The target Edict corridor is: +Jedit normalizes physical input into one canonical event envelope with stable +event, source, ordering, normalized-input, and admission coordinates. Echo +admits and transports the envelope without inspecting Jim or Jedit fields. +Only `jim.core`, authored from `Jim.edict`, interprets editor meaning. See +[Jim: Components, Responsibilities, and Ownership](jim-component-ownership.md) +for the frozen ownership and causal-settlement contract. + ```text -Jim command --> generated Edict client --> Echo-installed verified operation --> Echo admission and scheduler-owned tick --> opaque Echo outcome and bounded observation +terminal bytes +-> Jedit adapter emits one canonical event envelope +-> Echo realm admits and delivers it opaquely under an exact JimRelease +-> jim.core interprets the event and durably retains any command attempt +-> jim.core requests jedit.text TextWindow.edict +-> Echo returns a basis-bound Reading +-> jim.core composes jedit.text ReplaceRange.edict +-> Echo privately evaluates one combined Jim-and-buffer candidate +-> one realm and epoch atomically settles Jim, Buffer, result, and evidence + or retains a distinct CandidateSettlementRejected outcome +-> Jedit renders one declared causal view basis ``` +A generated client may encode events, install or address verified packages, +transport readings/outcomes/receipts, and decode typed projections. It is a +syscall stub, not Jim. A direct generated-client invocation of `ReplaceRange` +is permitted only in an explicitly test-only operation conformance harness. + +## Artifact Boundaries + +These artifacts are intentionally not interchangeable: + +| Artifact | Role | +| --- | --- | +| `jedit.text.schema@1` | Application fact shapes, codecs, and identity rules | +| `jedit.text.ReplaceRange.oracle@1` | Independent expected-behavior evidence | +| `ReplaceRange.edict` | `jedit.text`-authored operation semantics composed by `jim.core` | +| Echo Target IR and verified package | Compiler-produced generic executable meaning | +| Echo receipt | Evidence of one admitted execution against one basis | + +The oracle is never a program. Echo must not synthesize an evaluator or package +from the schema or oracle. + Runtime identity follows [the Echo identity doctrine](design/echo-identity-doctrine.md). Jim must not copy Echo identity domains, admission policy, scheduler behavior, WAL evidence, @@ -92,16 +128,24 @@ or support-policy logic. Echo-owned WAL, admission, scheduling, graph state, receipts, and restart recovery. 2. Avoid restoring broad editor feature parity through transitional APIs. -3. Have Echo and Edict establish one natively installed generated operation. -4. Migrate `ReplaceRange` to the generated Edict client and operation. -5. Make the Wesley/Rust replacement path unreachable, then delete it. -6. Migrate create/open and bounded text-window observation. -7. Add optional causal-anchor association as a proposition separate from +3. Check in Jim-owned `ReplaceRange.edict` with its complete lawpack closure. +4. Build it through Edict's public application-build boundary and let the first + honest compiler or target-profile failure route work to its owning repo. +5. Extend Echo only for generic bounded-program capabilities proven necessary + by the compiler-produced package; prove the result against the independent + Jedit oracle. +6. Author `TextWindow.edict`, then the smallest `Jim.edict` active observer. +7. Move production Jedit to canonical event submission and disposable + rendering; make frontend operation orchestration and the Wesley/native + planner route unreachable, then delete them. +8. Migrate create/open and checkpoint lawpacks under the same ownership model. +9. Add optional causal-anchor association as a proposition separate from checkpoint declaration only when a concrete consumer requires it. -8. Add save/export through generated operations, then derive undo/redo +10. Add save/export through Jim-authored operations, then derive undo/redo candidates from retained Echo history and invoke generated inverse operations through basis-pinned Echo observations. -9. Delete the remaining compatibility host package and JSONL invocation glue. +11. Delete the remaining compatibility host package and semantic JSONL glue; + retain only raw event/artifact transport required by the final membrane. ## Hard Gates @@ -114,6 +158,10 @@ or support-policy logic. authority beside Echo history. - Do not widen the handwritten compatibility protocol for feature parity. - Do not describe the Wesley compatibility package as the final Edict design. +- Do not put `ReplaceRange`, rope operations, `Buffer`, or `TextWindow` + semantics in Echo production code. +- Do not let TypeScript map commands to operations in final production + composition. ## Verification diff --git a/docs/data-model.md b/docs/data-model.md index 2dda7100..1659274c 100644 --- a/docs/data-model.md +++ b/docs/data-model.md @@ -1,18 +1,20 @@ # jedit Data Model -> **Cutover note (2026-07-16):** The Wesley schemas, generators, generated -> TypeScript projections, local graph-rope executor, and in-memory structural -> history runtime described in older sections of this document have been -> deleted. They remain design history only. The next executable mutation path -> is a generated Edict client invoking an installed Echo operation and consuming -> opaque Echo receipts plus basis-pinned observations. +> **Cutover correction (2026-08-18):** The Wesley schemas, generators, +> generated TypeScript projections, local graph-rope executor, and in-memory +> structural history runtime described in older sections of this document are +> design history or compatibility evidence. The target is not a TypeScript +> application invoking operations through a generated Edict client. The target +> runs `Jim.edict` as an Echo-realized active observer: Jedit submits canonical +> events, Jim-owned Edict lawpacks define operations and optics, and generated +> clients carry bytes but make no application decisions. ## Doctrine -jedit owns the **editor contract** and product nouns. Echo owns **generic -runtime execution**, admission, scheduler-owned ticks, receipts, readings, and -retained evidence. Edict will compile Jim-owned operation law into generated -clients and verified operations that Echo installs and executes. +Jim-owned Edict source owns the **editor contract** and product nouns. Echo owns +**generic runtime execution**, admission, scheduler-owned ticks, receipts, +readings, and retained evidence. Edict compiles Jim-owned application law into +verified generic packages plus semantic-free codecs and transport stubs. The rope model is jedit contract law hosted through Echo's generic graph and contract-host surfaces. Echo must not implement a privileged jedit rope engine. @@ -115,7 +117,13 @@ history, the boundary is wrong. That is the trap detector. *** -## TypeScript model +## Transitional TypeScript model + +The model below documents compatibility-era shapes and projections. It must not +justify final TypeScript command interpretation, operation choice, range +derivation, rope patch calculation, or Jim state advancement. Those semantics +move to `Jim.edict` and Jim-owned Edict lawpacks. TypeScript remains an +event/artifact codec, raw transport adapter, and disposable renderer. ```ts // ---------- identity types ---------- @@ -668,7 +676,10 @@ boundary; a `head_id` crosses it only as an opaque Jim fact reference inside a *** -## Sequence: `replaceRange` +## Compatibility Sequence: `replaceRange` + +This sequence records the running Wesley corridor. It is not the target +`Jim.edict` observer loop described in [BEARING.md](BEARING.md). ```mermaid sequenceDiagram diff --git a/docs/design/0149-graph-backed-rope-runtime-discovery.md b/docs/design/0149-graph-backed-rope-runtime-discovery.md index aeeba119..5dd459d8 100644 --- a/docs/design/0149-graph-backed-rope-runtime-discovery.md +++ b/docs/design/0149-graph-backed-rope-runtime-discovery.md @@ -12,6 +12,18 @@ updated: "2026-07-04" # HT-0149 - Graph-Backed Rope Runtime Discovery +> **Scope correction:** This active discovery document records how the current +> Wesley/Rust compatibility corridor acquired real graph-rope authority. Its +> direct TypeScript operation port is not the final Jim/Echo protocol. The +> target sends canonical events to `jim.core`; application-owned `jedit.text` +> lawpacks own text operations, optics, and private rope mechanics; +> `jim.core` composes them into editor commands; Echo interprets only +> compiler-produced generic programs. Do not implement the sentence "replace +> this port with a generated Edict client" as frontend +> command-to-`ReplaceRange` orchestration. See +> [../../ARCHITECTURE.md](../../ARCHITECTURE.md) and +> [../BEARING.md](../BEARING.md). + ## Linked Issue - https://github.com/flyingrobots/jedit/issues/206 @@ -81,9 +93,11 @@ In that model: - `RopeHead` identifies one graph-backed text state. - `RopeBranch`, `RopeLeaf`, and `TextBlob` are graph facts, not names for a full JavaScript string. -- `replaceRangeAsTick` is an Echo intent that reads a base head, range-closes - over touched rope nodes, creates the new local rope facts, emits rewrite and - diff evidence, and advances the worldline head. +- `replaceRangeAsTick` is the compatibility name for a `jedit.text` intent + composed by `jim.core` and admitted by Echo. Its law reads a base head, + range-closes over touched rope nodes, + creates new local rope facts, emits rewrite and diff evidence, and advances + the worldline head. It is not an Echo runtime primitive. - `RopeRewrite`, `RopeDiff`, application tick evidence, checkpoint declarations, and anchor associations are retained jedit evidence; Echo owns causal-anchor and admission evidence. @@ -91,10 +105,12 @@ In that model: rendering, export, save, tests, and caches, but they are not the source of editor truth. -Echo still remains generic. jedit owns the text and rope contract vocabulary; -Echo hosts generic admission, scheduling, receipts, retention, and causal -storage. The important correction is that the jedit contract vocabulary must be -real graph-backed state, not labels over full string snapshots. +Echo still remains generic. `jedit.text` owns the public text contracts and +private rope law; `jim.core` owns their editor-specific interpretation and +composition; the Jedit body owns transport and presentation. Echo hosts generic +admission, scheduling, receipts, retention, and causal storage. The important +correction is that the `jedit.text` contract vocabulary must be real +graph-backed state, not labels over full string snapshots. ## Why This Matters @@ -458,8 +474,9 @@ The full design must also define jedit facts for: - associations between rope checkpoints and opaque Echo anchor evidence; - strands, braids, and admissions when their implementation slice begins. -Echo remains generic and owns causal-anchor admission. jedit owns rope facts, -domain associations, and text-specific witnesses. +Echo remains generic and owns causal-anchor admission. `jedit.text` owns rope +facts, domain associations, and text-specific witnesses; its rope +representation remains private to the text capability. Runtime construction and validation are part of the contract. The branded types above are compile-time helpers only; decoded runtime payloads must pass through @@ -863,10 +880,12 @@ checkpoint and materialization semantics before invocation, fails closed when no Echo capability is available, and treats all returned Echo identities as opaque references. Echo's witnessed causal history remains authoritative after restart; registries and lookup maps are disposable projections over that -history. Replace this port with a generated Edict client once Echo can install -and invoke the corresponding verified operation natively. The port is a -short-lived seam for this one capability, not a Jim/Echo protocol: do not add -new handwritten operations or give it long-term compatibility guarantees. +history. Replace this port with canonical event delivery to the installed +`jim.core` observer, authored from `Jim.edict`, once Edict and Echo can build, +verify, and run the required generic programs. A direct generated-client +operation runner may exist only as test-only conformance scaffolding. The port +is a short-lived seam for this one capability, not a Jim/Echo protocol: do not +add new handwritten operations or give it long-term compatibility guarantees. ### 12. Make `:why` An Acceptance Target diff --git a/docs/design/0151-causal-rope-text-authority-inventory.md b/docs/design/0151-causal-rope-text-authority-inventory.md index 42b6dd23..c32d800a 100644 --- a/docs/design/0151-causal-rope-text-authority-inventory.md +++ b/docs/design/0151-causal-rope-text-authority-inventory.md @@ -3,6 +3,17 @@ Status: active CR-00 inventory for [#216](https://github.com/flyingrobots/jedit/issues/216). +> **Active-observer correction:** This inventory predates the decision that the +> final application package is `jim.core`, authored from `Jim.edict`, not +> TypeScript orchestration plus generated operation clients. Entries below +> remain useful for locating compatibility +> code, but command interpretation, operation choice, range derivation, +> cursor/mode advancement, and outcome handling must migrate to `jim.core`, +> authored from `Jim.edict`; text operations and optics migrate to `jedit.text`. +> Jedit/Bijou/native code retains canonical event decoding, raw transport and +> bootstrap, file I/O adapters, and disposable rendering. Echo remains generic +> and has no rope or editor vocabulary. + This document names every current product path that can create, read, mutate, save, export, or explain buffer text while Jim is cutting over to causal rope. It separates authority from projection so the full-snapshot fixture cannot hide @@ -10,7 +21,7 @@ behind app-facing ports. ## Authority Rule -The target authority path is: +The current compatibility authority path is: ```text workspace command @@ -21,6 +32,11 @@ workspace command -> graph-backed causal rope authority ``` +The target application path is canonical event delivery to `jim.core`, +application-owned `jedit.text` bounded optics and operation lawpacks, +compiler-produced generic Echo programs, and returned outcome/read projection +rendering. + Full materialized strings are allowed only as import inputs, export outputs, render windows, tests, or caches. They are forbidden as product text authority. @@ -31,6 +47,9 @@ render windows, tests, or caches. They are forbidden as product text authority. - **materialized projection**: text read from a named basis for display, export, highlighting, or temporary cache use. - **fixture**: test-only full-snapshot authority. +- **compatibility authority**: active transitional command interpretation, + operation choice, range derivation, or coordinate policy that production + still executes and the final `jim.core`/`jedit.text` cutover must remove. - **migration/import**: code that converts host bytes into initial authority or adapts old evidence during cutover. - **forbidden**: a product path that would make full materialized text the @@ -43,14 +62,14 @@ render windows, tests, or caches. They are forbidden as product text authority. | Installed transport | `src/adapters/installed-jedit-contract-echo-transport.ts` | migration/import | Construct graph-backed causal rope authority by default; reject fixture authority. | [#218](https://github.com/flyingrobots/jedit/issues/218), [#222](https://github.com/flyingrobots/jedit/issues/222) | | Runtime profile | `src/adapters/text-runtime-profile-session.ts` | migration/import | Keep `echoHosted` as the product runtime profile and remove the fixture escape hatch after graph rope installs. | [#218](https://github.com/flyingrobots/jedit/issues/218), [#250](https://github.com/flyingrobots/jedit/issues/250) | | Product session | `src/app/workspace/production-text-session.ts` | materialized projection | Create, edit, read, save, export, and explain through `TextBufferSessionPort`; export remains a projection. | [#224](https://github.com/flyingrobots/jedit/issues/224), [#225](https://github.com/flyingrobots/jedit/issues/225), [#226](https://github.com/flyingrobots/jedit/issues/226) | -| Open/import | `src/app/workspace/workspace-text-open-basis.ts` and `src/app/workspace/workspace-text-commands.ts` | migration/import | Treat host file bytes as import material for `BufferWorldline` and initial `RopeHead`. | [#223](https://github.com/flyingrobots/jedit/issues/223) | +| Open/import | `src/app/workspace/workspace-text-open-basis.ts` | migration/import | Treat host file bytes as import material for `BufferWorldline` and initial `RopeHead`. | [#223](https://github.com/flyingrobots/jedit/issues/223) | | Workspace authority state | `src/app/workspace/workspace-text-authority.ts` | causal rope authority | Track buffer id, dirty posture, receipts, checkpoints, and projections without storing authority text. | [#231](https://github.com/flyingrobots/jedit/issues/231), [#232](https://github.com/flyingrobots/jedit/issues/232) | -| Command handlers | `src/app/workspace/workspace-text-commands.ts` and `src/app/workspace/workspace-text-edit-planner.ts` | causal rope authority | Convert UI edits to `replaceRangeAsTick` requests and keep predictions separate from admitted text. | [#224](https://github.com/flyingrobots/jedit/issues/224) | +| Command handlers | `src/app/workspace/workspace-text-commands.ts` and `src/app/workspace/workspace-text-edit-planner.ts` | compatibility authority | Preserve compatibility behavior, then replace command-to-operation mapping with canonical event delivery to `jim.core`. | [#224](https://github.com/flyingrobots/jedit/issues/224), [#295](https://github.com/flyingrobots/jedit/issues/295) | | Operation sequencing | `src/app/workspace/workspace-text-operation-sequencer.ts` | causal rope authority | Preserve admission order for edit, checkpoint, and export operations. | [#231](https://github.com/flyingrobots/jedit/issues/231) | | Save/export | `src/app/workspace/workspace-save-key.ts` and `src/app/workspace/workspace-text-commands.ts` | materialized projection | Save/export from the current `RopeHead`, then record anchor/checkpoint evidence without mutating text authority. | [#226](https://github.com/flyingrobots/jedit/issues/226), [#233](https://github.com/flyingrobots/jedit/issues/233) | | Source rendering | `src/app/workspace/viewer-content.ts` and `src/ui/source-viewer.ts` | materialized projection | Render only from basis-tagged text windows and cached projections. | [#225](https://github.com/flyingrobots/jedit/issues/225), [#228](https://github.com/flyingrobots/jedit/issues/228) | | Reading cache | `src/app/workspace/workspace-text-reading-cache.ts` | materialized projection | Cache projected windows with explicit coverage and basis; never make cache entries authority. | [#230](https://github.com/flyingrobots/jedit/issues/230) | -| Cursor and coordinates | `src/app/workspace/workspace-text-position.ts` | materialized projection | Convert UI cursor/line positions to authoritative UTF-8 byte ranges through typed adapters. | [#227](https://github.com/flyingrobots/jedit/issues/227) | +| Cursor and coordinates | `src/app/workspace/workspace-text-position.ts` | compatibility authority | Convert coordinates for compatibility rendering; final cursor and range policy belongs to `jim.core` over public `jedit.text` coordinate contracts. | [#227](https://github.com/flyingrobots/jedit/issues/227), [#295](https://github.com/flyingrobots/jedit/issues/295) | | Why command | `src/app/workspace/workspace-why-range.ts` and `src/app/jedit-why-range.ts` | materialized projection | Explain ranges from rope head, leaf, blob, rewrite, diff, tick, checkpoint, and anchor evidence. | [#209](https://github.com/flyingrobots/jedit/issues/209), [#239](https://github.com/flyingrobots/jedit/issues/239) | | Gutter markers | `src/ui/source-viewer.ts` | materialized projection | Compute modified and deleted markers from rope rewrite/diff ancestry. | [#84](https://github.com/flyingrobots/jedit/issues/84), [#235](https://github.com/flyingrobots/jedit/issues/235), [#236](https://github.com/flyingrobots/jedit/issues/236) | | Footer posture | `src/app/workspace/workspace-footer-posture.ts` | materialized projection | Display durability ladder facts derived from pending intents, admitted heads, save anchors, and Git state. | [#233](https://github.com/flyingrobots/jedit/issues/233), [#234](https://github.com/flyingrobots/jedit/issues/234) | @@ -76,6 +95,10 @@ These patterns are forbidden in installed product code and enforced by - treating `materializeHotBuffer(...)` or a full text window cache as authority; - saving from an editor line array instead of a causal basis export; - computing modified lines from Git diff. +- mapping terminal commands directly to `ReplaceRange` in final production; +- advancing cursor, mode, register, or pending-operator state outside + `Jim.edict` in final production; +- adding Jim/Jedit nouns, verbs, or rope intrinsics to Echo production code. ## Open Blockers diff --git a/docs/design/jedit-echo-graph-model.md b/docs/design/jedit-echo-graph-model.md index edc86235..b9740a21 100644 --- a/docs/design/jedit-echo-graph-model.md +++ b/docs/design/jedit-echo-graph-model.md @@ -2,6 +2,16 @@ Status: design sketch +> **Ownership correction:** This sketch's phrase "jedit submits intent" is a +> compatibility-era shorthand. Final production submits canonical events to +> the `jim.core` package authored from `Jim.edict`; `jim.core` requests bounded +> optics and derives operation intents from +> its own state. Application reading and rewrite vocabulary lives in +> `jedit.text`; `jim.core` consumes and composes those Edict lawpacks without +> owning their private rope representation. Echo supplies generic admission, +> interpretation, ticks, readings, receipts, and recovery without learning +> editor or rope semantics. + Purpose: describe the exact text reading shape and rewrite semantics `jedit` wants Echo-hosted contracts to support, without assuming handwritten Echo runtime edits. @@ -50,15 +60,18 @@ request for a precise contract reading and rewrite model. The intended integration posture is optic-shaped: -- `jedit` submits intent to Echo +- Jedit submits a canonical event to the Echo-hosted `jim.core` observer +- `jim.core` requests a `jedit.text` optic and derives any application intent - Echo admits generic substrate history and returns the deterministic result / receipt envelope -- `jedit` then observes the resulting worldline state -- app code projects the observed worldline into `jedit` nouns such as +- `jim.core` handles the outcome and requests the resulting worldline reading +- Jedit rendering code projects the returned reading into visible nouns such as `BufferWorldline`, `RopeHead`, `TickReceipt`, and `WorldlineSnapshot` -So Echo stays generic causal substrate truth. `jedit` owns the app-facing -contract reading and interpretation layer. +So Echo stays generic causal substrate truth. `jedit.text` owns the app-facing +text contracts and private rope law; `jim.core` owns their editor-specific +interpretation and composition. The Jedit body only transports and renders the +resulting projections. The dynamic/static footprint split for these rewrites is defined in [0004 - dynamic-footprint-binding-contract](0004-dynamic-footprint-binding-contract/dynamic-footprint-binding-contract.md). diff --git a/docs/design/text-edit-algebra.md b/docs/design/text-edit-algebra.md index ea936756..97c7ba77 100644 --- a/docs/design/text-edit-algebra.md +++ b/docs/design/text-edit-algebra.md @@ -2,6 +2,14 @@ Status: design sketch +> **Ownership correction:** `ReplaceRange` is application-owned `jedit.text` +> law and its executable source belongs in `ReplaceRange.edict`. `jim.core` +> composes that law when settling editor commands. Echo may interpret the +> compiler-produced generic program, but Echo must not acquire a +> `ReplaceRange`, rope, split/join/balance, `Buffer`, or `TextWindow` runtime +> primitive. The schema and oracle are contracts and evidence, not executable +> semantics. + Purpose: define the causal text runtime that sits under `jedit` before more UI work hardens the wrong abstractions. @@ -31,10 +39,12 @@ For `jedit`, that implies: - Echo owns generic causal truth, scheduler-owned ticks, tick receipts, strands, admission, and replay. -- `jedit` contract code owns rope structure, anchors, range transforms, and - text edit algebra over Echo-hosted graph facts and retained artifacts. -- `jedit` owns UI, buffer lifecycle, viewport, file tree, save/open flows, - preview, and edit-group policy over ticks. +- `jedit.text` owns public text contracts, range transforms, and text edit + algebra; its private implementation owns rope structure over Echo-hosted + graph facts and retained artifacts. +- `jim.core` owns buffer-lifecycle policy, viewport semantics, and edit-group + policy. The Jedit body owns file-tree presentation, save/open adapters, and + rendering. - `git-warp` stays outside the engine as an import/export or mirroring adapter. - files on disk are projections, not the canonical truth. @@ -179,10 +189,13 @@ worldline boundary is the tick. That means: - `ReplaceRange` describes what text rewrite is lawful. -- Echo admits the jedit contract rewrite into scheduler-owned causal work. +- Edict compiles the application-owned `jedit.text` law to a generic verified + package. +- Echo admits and interprets that package as scheduler-owned causal work. - the scheduler-owned tick emits a tick receipt as the witness of the transition. -- `jedit` may group one or more ticks into an edit group for undo/history. +- `jim.core` may group one or more outcomes into an edit group for + undo/history. This keeps the canonical boundary aligned with Echo without giving jedit app code tick authority, while still letting the editor present larger diff --git a/docs/echo-application-hosting-guide.md b/docs/echo-application-hosting-guide.md index fbc8ebae..ef3e922f 100644 --- a/docs/echo-application-hosting-guide.md +++ b/docs/echo-application-hosting-guide.md @@ -1,18 +1,20 @@ # Echo Application Hosting Guide -This guide states the current Jim/Echo integration boundary. It distinguishes -the executable GraphQL/Wesley compatibility corridor from the future -Edict-native corridor. +This guide records the executable GraphQL/Wesley compatibility corridor and the +target Edict-native boundary. The compatibility walkthrough is implementation +evidence, not the final application composition. Identity rules are governed by [`docs/design/echo-identity-doctrine.md`](design/echo-identity-doctrine.md). ## Hard Rule -Application code proposes work. Echo owns admission, scheduling, ticks, -receipts, witnessed causal history, recovery, and basis-pinned observation. -Jim owns text semantics and presentation. A TypeScript map, queue, runtime, or -ledger inside Jim may not impersonate an Echo-owned authority. +`Jim.edict` is the application and proposes work. Echo owns generic admission, +scheduling, ticks, receipts, witnessed causal history, recovery, bounded +program interpretation, and basis-pinned observation. Jim-owned Edict lawpacks +own text semantics. Jedit/Bijou/native code owns terminal and process I/O plus +rendering. A TypeScript map, queue, runtime, or ledger may neither impersonate +Echo authority nor interpret Jim commands and choose application operations. Test doubles are allowed only below `spec/` or `tests/`, must be injected explicitly, and must use test-only identities. They are evidence fixtures, not @@ -43,7 +45,7 @@ causal gutter readings, and `:why` fail closed with typed obstructions. The prior raw WASM facade is deleted. It was not the product text path and no longer has a runnable side lane. -## Ownership +## Target Ownership Echo owns: @@ -55,14 +57,25 @@ Echo owns: - basis-pinned observation execution; - generic retention and causal-anchor admission. -Jim owns: +`Jim.edict` owns: + +- editor state, modes, operators, motions, cursor, selection, registers, and + pending actions; +- canonical event interpretation, observation requests, operation intents, + and outcome or obstruction handling. + +Jim-owned Edict lawpacks own: - rope, buffer, checkpoint, range, and editor semantics; -- branded UTF-8, UTF-16, and line/column coordinates; -- validation of Jim-owned requests before invoking Echo; -- interpretation of opaque Echo identities and outcomes; -- disposable line indexes and materialization caches; -- UI policy and rendering. +- application fact schemas, identities, results, and typed obstructions; +- `ReplaceRange`, `CreateBuffer`, `DeclareCheckpoint`, and `TextWindow`. + +Jedit/Bijou/native adapters own: + +- canonical event decoding and raw process transport; +- package bootstrap and addressing; +- typed artifact codecs with no application decision logic; +- disposable line indexes, materialization caches, UI surfaces, and rendering. The Wesley compatibility package currently supplies: @@ -71,18 +84,24 @@ The Wesley compatibility package currently supplies: - generated mutation-rule and query-observer host helpers; - a typed Rust binding around the transitional Jim-owned operation law. -Edict will later own the generated semantic boundary: +Edict owns the generated semantic boundary: -- deterministic operation law; +- source checking, Core IR, and authority/lawpack closure; +- target lowering and compiler-produced package construction; +- structurally separate verification; - request and outcome codecs; -- installed-operation metadata; -- generated clients for bounded observations; +- installed-operation metadata and transport stubs; - schema and version compatibility checks. Jim must not copy Echo identity, receipt, admission, scheduler, WAL, or support policy algorithms into application code. -## Production Boundary +Echo production code must not implement or branch on `ReplaceRange`, rope, +`Buffer`, `TextWindow`, or any other Jim/Jedit vocabulary. A schema and oracle +are conformance resources, not executable semantics; only a compiler-produced, +independently verified generic package may supply runtime meaning. + +## Current Compatibility Boundary ```mermaid flowchart LR @@ -107,6 +126,44 @@ flowchart LR The process adapter correlates requests and responses only. It is not text, receipt, graph, or recovery authority. +In current compatibility code, TypeScript and native Rust still derive a Jim +request before Echo admission. That is migration debt. It must not be widened +or described as the final Edict design. + +## Target Active-Observer Boundary + +Jedit normalizes physical input into one canonical event envelope with stable +event, source, ordering, normalized-input, and admission coordinates. Echo +admits and transports the envelope without inspecting Jim or Jedit fields. +Only `jim.core`, authored from `Jim.edict`, interprets editor meaning. The +complete authority and settlement contract is frozen in +[Jim: Components, Responsibilities, and Ownership](jim-component-ownership.md). + +```mermaid +sequenceDiagram + participant T as Terminal adapter + participant E as Echo authority realm + participant J as jim.core + participant W as TextWindow.edict + participant R as ReplaceRange.edict + + T->>E: canonical event envelope + E->>J: deliver opaquely under exact JimRelease + J->>E: request bounded TextWindow + E->>W: interpret compiler-produced generic program + W-->>E: basis-bound Reading + E-->>J: resume durable command attempt + J->>R: compose jedit.text ReplaceRange law + R-->>J: typed Buffer consequence or obstruction + J-->>E: combined Jim-and-Buffer candidate + E->>E: atomically settle candidate or retain conflict outcome + E-->>T: projection for one declared causal view basis +``` + +A generated client in this boundary is a codec and transport stub. It may not +decide what a key means, derive a `ReplaceRange`, calculate a rope patch, or +advance cursor, mode, register, or operator state. + ## Current Intent Lifecycle ```mermaid @@ -199,15 +256,18 @@ parity by widening handwritten Rust operation APIs. The planned migration is: -1. Echo and Edict establish one natively installed generated operation. -2. Jim migrates `ReplaceRange` to the generated Edict client and operation. -3. The bespoke Wesley/Rust replacement path becomes unreachable and is - deleted. -4. Buffer creation and bounded text observation migrate next. -5. Checkpoint, save/export, undo/redo, and historical explanation are added as - generated operations and bounded observations. -6. The transitional JSONL operation protocol is deleted when generated client - invocation can replace it. +1. Author the exact Jim-owned `ReplaceRange.edict` source and closure. +2. Build it through Edict's public application-build boundary. +3. Add only the generic Edict or Echo capabilities that the honest build proves + missing; execute the exact verified package against the retained oracle. +4. Author `TextWindow.edict` and the smallest `Jim.edict` active observer. +5. Move production input to canonical event delivery and projection rendering. +6. Make direct frontend operation orchestration and the bespoke Wesley/Rust + replacement path unreachable, then delete them. +7. Migrate buffer creation, checkpoint, save/export, undo/redo, and historical + explanation as Jim-owned lawpacks and bounded observations. +8. Delete semantic JSONL operation glue once only the event/artifact membrane + remains. The acceptance bar is not an Echo-shaped interface. Every user-visible text transition and authoritative reading must be supported by first-class diff --git a/docs/jedit-echo-end-to-end.md b/docs/jedit-echo-end-to-end.md index 5b6233f4..f1cc6b72 100644 --- a/docs/jedit-echo-end-to-end.md +++ b/docs/jedit-echo-end-to-end.md @@ -1,8 +1,38 @@ # Jim + Echo End-To-End Guide -This document describes the executable production text corridor as it exists -now. It distinguishes the narrow Wesley compatibility package from the future -Edict-native operation path. +This document describes the executable Wesley production text corridor as it +exists now. It is a compatibility witness, not the target application +composition. The target is `Jim.edict` running as an Echo-realized active +observer; Jedit/Bijou/native code becomes its I/O body, and generated clients +remain semantic-free codecs and transport stubs. + +## Target Corridor + +Jedit normalizes physical input into one canonical event envelope with stable +event, source, ordering, normalized-input, and admission coordinates. Echo +admits and transports the envelope without inspecting Jim or Jedit fields. +Only `jim.core`, authored from `Jim.edict`, interprets editor meaning. See +[Jim: Components, Responsibilities, and Ownership](jim-component-ownership.md) +for the frozen ownership and causal-settlement contract. + +```text +terminal bytes +-> Jedit emits one canonical event envelope +-> Echo realm admits and delivers it opaquely under an exact JimRelease +-> jim.core interprets the event and durably retains any command attempt +-> jim.core requests jedit.text TextWindow.edict +-> Echo returns a basis-bound Reading +-> jim.core composes jedit.text ReplaceRange.edict +-> Echo privately evaluates one combined Jim-and-buffer candidate +-> one realm and epoch atomically settles Jim, Buffer, result, and evidence + or retains a distinct CandidateSettlementRejected outcome +-> Jedit renders one declared causal view basis +``` + +Echo never learns `ReplaceRange`, rope, `Buffer`, or `TextWindow` semantics. +Those are application-owned `jedit.text` law composed by `jim.core`. A direct +operation runner may exist as a test-only conformance harness, but it is not the +production editor. ## Current Truth @@ -48,12 +78,12 @@ These operations remain typed obstructions: The product remains intentionally incomplete rather than implementing those features through a second authority. -## Ownership +## Current Compatibility Ownership | Concern | Owner | | --- | --- | -| Modal UI, Vim syntax, cursor, viewport, settings | Jim | -| Rope fact schema, text ranges, replacement semantics | Jim Rust package | +| Modal UI, Vim syntax, cursor, viewport, settings | Transitional Jim TypeScript | +| Rope fact schema, text ranges, replacement semantics | Transitional Jim Rust package | | GraphQL operation declaration | Jim | | EINT codecs, operation ids, registry, host rule helpers | Echo Wesley generator | | Package verification and registration | Echo trusted host | @@ -61,14 +91,16 @@ features through a second authority. | Authoritative graph and restart reconstruction | Echo | | Bounded query execution and reading evidence | Echo | | JSONL process transport and UI mapping | Jim adapters | -| Future generated operation law and client | Edict | +| Future `Jim.edict` and application lawpacks | Jim-authored Edict source | +| Checking, lowering, packages, verification, generated codecs | Edict | | Syntax and structural projections | Graft | | Terminal loop and surfaces | Bijou | -Jim treats Echo-issued head, tick, commit, receipt, and reading identities as -opaque. It validates Jim-owned request semantics before crossing the host port, -but it does not copy Echo identity, admission, scheduler, receipt, WAL, or -support policy. +This table describes what is running, not what should remain. In the target, +`Jim.edict` owns modal state and event interpretation; Jim-owned lawpacks own +operations and optics; Jedit/Bijou/native adapters only decode events, +transport artifacts, and render projections. Jim treats Echo-issued head, tick, +commit, receipt, and reading identities as opaque. ## Build And Startup @@ -148,7 +180,7 @@ sequenceDiagram App-->>CLI: Bijou app starts ``` -## One Replacement, End To End +## One Compatibility Replacement, End To End ```mermaid sequenceDiagram @@ -195,8 +227,9 @@ sequenceDiagram ``` The UI must not render the changed text as settled before the final observation -returns. A local Vim planner may compute a proposed edit and cursor effect, but -that proposal is not authoritative text. +returns. The local Vim planner shown here is transitional semantic authority; +final production must deliver the canonical event to `Jim.edict`, which alone +interprets the command, derives the operation intent, and advances Jim state. ## Rope Authority @@ -261,13 +294,18 @@ The compatibility corridor exists to apply product pressure now, not to become permanent protocol law. The convergence order is: 1. Keep create, replace, and bounded read green through real Echo. -2. Establish one natively installed generated Edict operation in Echo. -3. Migrate `ReplaceRange` to the generated Edict client and operation. -4. Make the Wesley/Rust replacement path unreachable and delete it. -5. Migrate buffer create/open and bounded text-window observation. -6. Add checkpoint, save/export, and inverse operations through generated Edict - packages and bounded Echo readings. -7. Delete the compatibility package and transitional process protocol. +2. Author `ReplaceRange.edict` and build it through Edict's public application + boundary. +3. Execute the exact compiler-produced package with only generic Echo runtime + capabilities and compare it with the independent Jedit oracle. +4. Author `TextWindow.edict` and the smallest `Jim.edict` active observer. +5. Move production to canonical event delivery and disposable projection + rendering. +6. Make the Wesley/Rust replacement path and frontend operation orchestration + unreachable, then delete them. +7. Migrate buffer create/open, checkpoint, save/export, and inverse operations + as Jim-owned Edict lawpacks and bounded readings. +8. Delete the compatibility package and semantic process protocol. No migration step may restore local text authority to make the editor appear more complete. diff --git a/docs/jim-component-ownership.md b/docs/jim-component-ownership.md new file mode 100644 index 00000000..fb36ce34 --- /dev/null +++ b/docs/jim-component-ownership.md @@ -0,0 +1,1345 @@ +--- +title: "Jim: Components, Responsibilities, and Ownership" +date: 2026-08-22 +author: James Ross +description: "A guided map of Jim's editor mind, text capability, causal settlement, runtime, UI body, compiler, structural intelligence, compatibility layers, and external-effect boundaries." +tags: [jim, jedit, edict, echo, architecture, ownership, causal-rope] +draft: true +status: review +project: jedit +related: + - ../ARCHITECTURE.md + - BEARING.md + - jedit-echo-end-to-end.md + - stack-map.md +--- + +# Jim: Components, Responsibilities, and Ownership + +## The sixty-second orientation + +Jim is the editor personality and persistent semantic observer: the part of +the system that knows what a key means, which mode the editor is in, where the +cursor is, what an operator is waiting for, which lawful text operation to +compose, and how Jim should advance when that operation applies or refuses. +The larger Jedit application domain also contains reusable capabilities such as +`jedit.text`; Jedit's product shell supplies Jim's body. Edict is the language +and compiler used to author that application law. Echo is the generic runtime +that admits, schedules, commits, records, and recovers its verified programs. + +That distinction matters because the word "owns" can otherwise hide several +different responsibilities. Jim owns editor *meaning*. Echo owns authoritative +runtime *commit and history*. Edict owns the *compiler trust boundary* between +source and executable package. Jedit, Bijou, and native adapters own *I/O and +presentation*. Graft owns *structural intelligence over bounded readings*. +None of those roles may silently absorb another. + +The target can be summarized in one sentence: + +> Jedit is Jim's body, `jim.core` is Jim's mind, `jedit.text` is the lawful text +> capability Jim composes, Edict compiles and verifies the application release, +> and Echo realizes its worldlines without learning editor vocabulary. + +This document uses `jim.core` for the installed capability or module and +`Jim.edict` for its primary authored source. They are related artifacts, not +interchangeable names: source is compiled into a package, and an exact package +is admitted as part of a `JimRelease`. + +Today, that target is not yet the production composition. The real Echo-backed +compatibility corridor works, but TypeScript still interprets Vim commands and +derives ranges, while native Rust still plans rope changes. This document maps +both the target and that current transitional reality so that architectural +intent is never mistaken for executable proof. + +In summary, Jim is not synonymous with the TypeScript frontend, the Rust host, +the Echo runtime, the text substrate, or the whole Jedit repository. Jim is the +editor personality inside an application-owned release, and the migration is +complete only when that composition is authored in Edict and realized +generically by Echo. + +### A small vocabulary before the walkthrough + +The architecture uses a few precise terms repeatedly. They are worth defining +before following an edit through the system: + +| Term | Meaning in this document | +| --- | --- | +| Worldline | The retained causal history of one running entity, such as Jim or a buffer, as it advances through committed states | +| Basis | The exact observed state or head against which a reading, decision, or requested change is valid | +| Lawpack | A versioned, digest-bound Edict bundle containing application types, helper law, permitted effects, profiles, and typed obstructions | +| Optic | A bounded program that observes a selected view of state without becoming another authority over that state | +| Intent | A typed request to evaluate an application operation against a named basis; it is not a preapproved mutation | +| Command attempt | The durable identity of one semantic command from consumed input through terminal settlement, potentially spanning observations, conflicts, and retries | +| Candidate settlement | One privately evaluated proposal associated with a command attempt; an explicit retry may create another candidate under the same attempt | +| Tick | One atomic Echo state transition: all admitted consequences commit together, or none do | +| Settlement | The single Tick or explicitly equivalent durable protocol that makes all consequences of one completed semantic command agree | +| Obstruction | A typed, expected refusal explaining why a requested application consequence did not apply; an enclosing observer may still settle its lawful refusal or retry state | +| Reading | Evidence-carrying observed data bound to a particular basis and support footprint | +| Receipt | Echo's evidence that a particular admitted program was evaluated with a particular outcome | +| WAL | Echo's write-ahead log, which durably records enough ordered information for recovery | +| Core IR | Edict's canonical, application-neutral intermediate representation after source checking | +| Target IR | The lower-level generic program representation that Echo can interpret after verification | +| Release closure | The immutable set of exact package, schema, profile, and verifier-policy identities governing one Jim worldline | +| Authority realm | The Echo-controlled transaction domain that gives its hosted mutable worldlines one serialized history | +| Authority epoch | A monotonically distinct tenure of one realm authority; an epoch change fences former hosts from committing | +| Transaction conflict | Echo evidence that a candidate Tick could not linearize because an expected read or authority coordinate changed | +| Read set | The exact state coordinates a privately evaluated candidate relied on and requires to remain valid when Echo orders the candidate | +| Serialization point | The instant at which one authority realm orders a candidate relative to competing candidates and decides whether it can commit | +| View basis | The exact Jim, buffer, and required projection coordinates that may lawfully be presented together | +| Fencing token | An epoch-bound credential that prevents a former or competing holder from continuing to mutate a protected authority | +| Materialization guarantee | The declared strength with which an external adapter can serialize or merely observe a filesystem effect | + +Wesley's generated compatibility code also uses **EINT**, the current canonical +Echo intent-envelope encoding. EINT is a transport representation; it does not +grant Wesley, TypeScript, or Echo authority to decide what an editor command +means. + +In summary, these terms separate Jim's application decisions from the evidence +and generic machinery used to compile, run, and retain them. + +## One editing action, shown in full + +The best way to see every boundary is to follow one ordinary Vim-shaped edit. +Suppose the current Echo-backed buffer contains this UTF-8 text, and the cursor +is on the first byte of `beta`: + +```text +alpha beta gamma + ^ +``` + +The user presses `d`, then `w`. In normal Vim terminology, `d` begins a delete +operator and `w` supplies a word motion. For this example, the intended result +is: + +```text +alpha gamma + ^ +``` + +This example is deliberately simple, but it is not a single primitive action. +Jim must remember a pending operator after `d`, durably consume `w`, observe +enough text to resolve the motion, derive a basis-bound byte range, preserve the +deleted text in a register, compose a lawful text replacement, update cursor, +repeat, undo-group, and mode state, and finally emit a renderable view. Most of +those steps may span several Ticks. The completed command has one non-negotiable +boundary, however: its buffer and Jim-state consequences must settle as one +coherent causal cut. + +The target interaction is the following. The canonical event envelope's exact +wire schema is not frozen by this document; the invariant is that the Jedit +boundary constructs it, Echo carries it opaquely, and only `jim.core` +interprets its editor meaning. + +```mermaid +sequenceDiagram + participant U as User + participant B as Jedit body + participant E as Echo realm Q at epoch E7 + participant J as jim.core + participant W as TextWindow.edict + participant R as ReplaceRange.edict + + U->>B: terminal bytes for d + B->>E: canonical event E1 + E->>J: evaluate E1 at Jim J0 + J-->>E: pending-delete consequence + E->>E: Tick A consumes E1 and advances J0 to Jpending + U->>B: terminal bytes for w + B->>E: canonical event E2 + E->>J: evaluate E2 at Jpending + J-->>E: retain CommandAttempt C and observation request + E->>E: Tick B consumes E2 and retains C + E->>W: interpret verified optic program + W-->>E: Reading R bound to Buffer H0 + E->>J: resume C with R under JimRelease L + J->>R: compose ReplaceRange against H0 + R-->>J: Buffer H0 to H1 consequence or obstruction + J-->>E: complete C with combined Jim and Buffer consequence + E->>E: Tick C atomically settles C, Buffer, Jim and evidence in one realm + E-->>B: projection bound to coherent cut Jim J1 and Buffer H1 + B-->>U: paint the terminal +``` + +
+Figure 1 - The target `dw` active-observer round trip + +The two key events enter through Jedit's I/O membrane, but their meaning is +decided by `jim.core`. Observation may take multiple durable transitions. When +the reading arrives, Jim composes the independently specified `ReplaceRange` +law inside the parent command evaluation. One Echo authority realm settles the buffer edit, Jim +state, register, cursor, repeat recipe, undo group, command result, and evidence +together. Echo realizes those verified programs without branching on `d`, `w`, +words, ranges, buffers, or ropes. + +
+ +| Turn | Component acting | What it is allowed to decide | +| --- | --- | --- | +| Decode | Jedit/Bijou/native boundary | Which canonical input event the terminal bytes represent | +| Interpret | `jim.core` | That `d` starts a delete and `w` completes a word motion | +| Observe | `TextWindow.edict` through Echo | Which basis and bounded support the reading proves | +| Derive | `jim.core` | The operator target, register consequence, cursor policy, repeat recipe, undo group, and text-operation intent | +| Execute | `ReplaceRange.edict` through Echo | The application-owned text law and its typed result or obstruction | +| Settle | Echo realm and epoch | Whether the combined Jim-and-buffer consequence becomes one atomic Tick and correlated evidence set | +| Present | Jedit/Bijou | How a projection bound to the settled Jim and buffer bases appears on the terminal | + +Two foils sharpen the boundary. A TypeScript client that directly submits a +`ReplaceRange` request proves only operation transport; it does not prove that +Jim interpreted `dw`. Likewise, an RPC-shaped sequence in which the buffer edit +commits and Jim later updates its register and cursor is not a completed Jim +command. It permits a crash to leave `Buffer H1` paired with `Jim Jpending`. + +The settlement invariant can therefore be stated without implementation +shorthand: + +```text +CommandAttempt C under JimRelease L + bound to: + Echo realm Q at authority epoch E7 + Jim basis Jpending + Buffer basis H0 + Reading R supported by H0 + input events E1 and E2 + + privately evaluated candidate K1: + read_set_digest D + + successful settlement: + Buffer H0 -> H1 + Jim Jpending -> J1 + pending operator cleared + deleted-content register updated + cursor, repeat recipe, and undo group updated + CommandSettled(C, Applied) + one correlated evidence set + + terminal obstructed settlement: + Buffer remains H0 + Jim advances to the lawfully defined refusal state + CommandSettled(C, Obstructed(reason)) + one correlated evidence set + + retry transition: + Buffer remains H0 + Jim advances to an observation-waiting retry state + no CommandSettled fact exists yet + the same CommandAttempt remains unresolved + + candidate transaction conflict: + no Tick commits + no Jim or Buffer state advances + no CommandSettled fact exists yet + CandidateSettlementRejected( + outcome O1, + attempt C, + candidate K1, + serialization S, + read_set_digest D, + ReadSetChanged(...) + ) is retained + CommandAttempt C remains unresolved for a later Jim resolver Tick +``` + +The block describes one atomic causal cut, not a caller-authored graph patch. +`jim.core` and `jedit.text` produce typed consequences by composing verified +law; one Echo realm and epoch alone admits the candidate and either commits its +generic target program or records a distinct transaction conflict. + +The obstruction branch describes an application result whose enclosing Jim +settlement successfully committed. The transaction-conflict branch is +different: it is Echo evidence about a candidate that never became a Tick, so +it cannot emit a Jim outcome. A later Jim resolver consumes the identified +conflict outcome at most once. At most one terminal result may ever exist for +the retained attempt; eventual terminal settlement additionally depends on the +realm progressing and the pinned release and required evidence remaining +available. + +In summary, `dw` belongs to Jim even though several other components carry, +compile, execute, persist, and display its consequences. The owner of a +decision is the component allowed to choose its meaning, while the settlement +boundary prevents those correctly owned decisions from becoming a torn editor +state. + +## What "ownership" means in this architecture + +Ownership in Jim is intentionally split into distinct kinds because no single +component should control meaning, compilation, execution, durability, and +presentation. The split is a safety property: each component receives enough +authority to perform its job and no more. + +| Ownership kind | Question it answers | Owner | +| --- | --- | --- | +| Semantic ownership | What does this event, state, operation, fact, or domain result mean to the editor? | `jim.core` plus Jedit application capabilities such as `jedit.text` | +| Compilation ownership | Is the authored law well-typed, authority-closed, canonical, lowerable, and independently verified? | Edict | +| Runtime authority | May this verified program run now, with this basis, release, realm, epoch, budget, and footprint, and may its consequence commit? | Echo authority realm | +| Durable-history ownership | Which Tick, conflict outcome, reading, receipt, and recovery record actually exists? | Echo realm WAL or consensus history | +| I/O ownership | How do terminal, process, filesystem, and package bytes cross the application boundary? | Jedit/Bijou/native adapters | +| Projection ownership | How is witnessed state cached, indexed, highlighted, laid out, or painted? | Jedit/Bijou, with Graft for structural projections | +| Evidence ownership | What independently demonstrates expected application behavior? | Jim/Jedit schemas, oracles, tests, and conformance harnesses | + +This division means two true statements can coexist. The Jedit application +domain owns the meaning of a text edit, while Echo owns whether the edit and +its Jim-state consequences were lawfully committed. The text capability owns +the meaning of a checkpoint declaration, while Echo owns the Tick and receipt +that witness its persistence. Jedit owns a screen cache, while neither that +cache nor the screen becomes text authority. + +> **Intuition to carry forward:** semantic ownership and storage authority are +> different powers. Jim decides what command to perform, the text capability +> defines what the text operation means, and Echo decides whether their +> combined verified consequence becomes durable history. + +In summary, "owns" should always be read with a qualifier. Most architectural +confusion in this system comes from treating semantic, runtime, storage, and +projection ownership as if they were the same thing. + +## Jim from the inside out + +`jim.core` is the planned persistent active observer at the center of the +system. It has not yet been authored, so the names below describe stable +responsibilities rather than claiming that these are already checked-in Edict +modules. The important design constraint is that every editor-semantic decision +has exactly one final home inside Jim or a named application capability. + +| Jim responsibility | What Jim owns | What Jim delegates | +| --- | --- | --- | +| Persistent editor state | Active buffer, mode, cursor, selection, registers, marks, pending operator, pending chord, repeat state, search state, and command-attempt state | Echo persists the realized worldline; Jedit renders projections | +| Event interpretation | Meaning of canonical key, text-input, paste, command, agent, or automation events | Jedit normalizes raw input; Echo admits and delivers envelopes | +| Modal state machine | Normal/insert behavior, operator-pending transitions, counts, registers, motions, and text objects | No semantic delegation | +| Observation policy | Which bounded text or structural reading is needed and at which basis | Echo schedules readings; `TextWindow.edict` defines the optic; Graft may supply structural projections | +| Operation selection | Whether the next application intent is `ReplaceRange`, `CreateBuffer`, `DeclareCheckpoint`, another Jim operation, or no operation | Edict compiles the selected law; Echo admits and executes it | +| Command settlement | Which Jim-state consequences must settle atomically with a selected text consequence | `jedit.text` supplies the text consequence; one Echo realm and epoch commits the combined Tick | +| Result handling | How normal domain results, typed obstructions, admission rejections, and external failures affect Jim | Echo supplies witnessed evidence without collapsing result categories | +| Undo and repeat policy | Which forward compensating command or semantic recipe should be constructed from retained history | Echo supplies retained history and basis-bound evidence | +| Render intent | Which coherent causal view basis the body should display | Jedit/Bijou chooses terminal layout and paint; stale optional projections are withheld | + +Jim does **not** own scheduler order, WAL identifiers, receipt formation, +runtime recovery rules, direct graph mutation authority, terminal escape +sequences, filesystem syscalls, Git operations, or syntax-parser internals. +Those are dependencies Jim may invoke through bounded contracts, not hidden +parts of Jim's mind. + +In summary, Jim's internal boundary contains every editor policy that must +survive a change of UI toolkit, transport, compiler backend, or runtime host. +If changing TypeScript or Rust can silently change what `dw` means, the semantic +boundary has not yet been completed. If a crash can preserve the text edit +without the corresponding Jim consequences, the causal boundary has not been +completed either. + +## The application is a pinned release, not one giant Jim module + +Jim should compose independently specified application capabilities rather +than absorb their private representations. That makes `jim.core` the editor +personality and `jedit.text` a reusable lawful text substrate, while an +immutable `JimRelease` pins their exact composition for execution and recovery. + +```text +JimRelease L +├── jim.core +│ ├── persistent Jim state +│ ├── input interpretation and modal grammar +│ ├── motions and text objects +│ ├── registers, cursor, repeat, and undo policy +│ └── command-attempt and settlement composition +├── jedit.text +│ ├── Buffer, RopeHead, slice, diff, and range contracts +│ ├── ReplaceRange +│ ├── TextWindow +│ ├── CreateBuffer and DeclareCheckpoint +│ └── private rope representation and structural invariants +├── jim.external-policy +│ ├── import and export policy +│ └── external-conflict and reconciliation policy +└── exact transitive executable closure + ├── every application package and lawpack dependency + ├── exact edict.std.* standard-library packages + ├── schema and codec packages + ├── entry-point identities + ├── target instruction-set semantics + ├── Echo execution and authority profiles + ├── verifier-policy identity + ├── effect-protocol versions + ├── migration packages + └── structural-provider packages whose readings affect command meaning +``` + +This tree is a composition map, not a repository-layout mandate. Its +load-bearing property is that `jim.core` may understand public text concepts +such as buffer identity, head, range, slice, content reference, result, and +obstruction without understanding `RopeLeaf`, `RopeBranch`, tree height, +balancing, split/join mechanics, or path copying. Those representation details +remain private to `jedit.text`. + +The release closure also prevents ambient upgrades. A retained event or +interrupted command attempt must never be resumed under “the latest” Jim law. +Every evaluation records `JimRelease L`; an upgrade from `L1` to `L2` is an +explicit, admitted Jim transition with a migration result and receipt. +Historical commands remain governed by the release that originally interpreted +them. There is no ambient current `edict.std.collections`, target instruction +set, effect protocol, or structural provider when its reading changes command +meaning. + +Identity alone is insufficient for reenactment. Every release manifest and +package byte sequence reachable from retained history intended for reenactment +remains available in a content-addressed artifact store. A digest may prove +which absent object once existed, but it cannot execute that object during +recovery. + +The first release-upgrade protocol uses strict quiescence rather than +accidentally creating a multiversion runtime: + +```text +ActivateRelease L1 -> L2 is admissible only when: + no unresolved CommandAttempt exists + no observation request remains pending + no external effect remains prepared but unresolved + no queued event is pinned to L1 + the migration accepts the complete current Jim state + the complete L2 closure is retained, installed, and verified +``` + +Repeat recipes and undo metadata are part of the current Jim state, so the +migration must explicitly preserve, transform, or reject them. Work begun +under `L1` does not quietly finish after the worldline activates `L2`. +Supporting that later would require a deliberate multiversion protocol. + +| Layer in the release | Public to `jim.core` | Private responsibility | +| --- | --- | --- | +| `jim.core` | Jim state and semantic command results | Editor personality and command policy | +| `jedit.text` | Buffers, heads, ranges, slices, content references, diffs, and typed text outcomes | Rope nodes, balancing, path copying, and text-model invariants | +| `jim.external-policy` | Logical external identities and observed external results | When import, export, conflict, or reconciliation is appropriate | +| `JimRelease` | Immutable release identity | Exact transitive closure of packages, profiles, schemas, entry points, and verifier policy | +| Artifact store | Content-addressed bytes and manifests reachable for reenactment | Retention, integrity, and availability of the exact executable closure | +| Upgrade protocol | Explicit `L1 -> L2` transition and migration receipt | Quiescence, closure installation, state migration, and activation admissibility | + +In summary, the application domain owns both Jim and its text substrate, but +Jim does not own rope internals. The immutable release closure binds their +collaboration so replay and recovery cannot reinterpret old events under new +law, while retention and quiescent activation make that identity executable +rather than ceremonial. + +## The complete cast and each component's territory + +Jim operates inside a larger system whose components have intentionally narrow +territories. This table is the primary ownership map: it states both the +positive responsibility and the forbidden expansion for each participant. + +| Component | Responsibility | What it owns | What it must not own | Current posture | +| --- | --- | --- | --- | --- | +| Jedit product shell | Compose the application, adapters, UI surfaces, and package/bootstrap lifecycle | Product configuration, ports, panes, panels, lenses, process wiring | Jim's final command semantics or text authority | Exists; still contains compatibility semantic orchestration | +| Bijou | Terminal UI substrate | Terminal event decoding support, surface lifecycle, focus, layout, paint | Modes, motions, rope law, causal truth | Exists and remains part of the target body | +| Native adapters | Process bootstrap and raw host capabilities | Echo process lifecycle, filesystem import/export, declared materialization guarantees, package transport, raw I/O | Native Jim planner callbacks or exaggerated filesystem authority in the final composition | Exists; the current Rust host still contains compatibility rope law | +| `jim.core` / `Jim.edict` | Active observer and editor mind | Persistent editor state, event interpretation, observation requests, operation choice, command settlement composition, result handling | Rope representation, scheduling, WAL, receipt identity, terminal or filesystem mechanics | Target only; source not yet checked in | +| `jedit.text` Edict capability | Reusable application-owned text model, operations, and optics | Buffer and head contracts, `ReplaceRange`, `CreateBuffer`, `DeclareCheckpoint`, `TextWindow`, slices, diffs, rope invariants, and typed text outcomes | Jim modes, commands, registers, cursor policy, Echo admission, host syscalls | Schema and oracle are frozen; executable sources are not yet authored | +| `jim.external-policy` | Jim's policy for external authorities | Import, export, provider selection, expected-fingerprint, guarantee-class, conflict, and reconciliation decisions | Ambient paths, raw syscalls, or claims that an external effect committed or was authored without matching evidence | Target contract defined here; no executable provider protocol yet | +| `JimRelease` | Immutable executable application composition | Complete transitive package, standard-library, schema, codec, entry-point, instruction-set, execution-profile, verifier, effect-protocol, migration, and command-relevant provider closure | Ambient “latest package” lookup or reinterpretation of historical events | Target contract defined here; exact manifest schema, artifact store, and activation protocol remain unimplemented | +| Edict | Language, compiler, package builder, and verifier boundary | Parsing, typing, authority closure, Core IR, Target IR lowering, canonical package construction, independent verification | Running Jim, choosing events, or committing graph state | Generic prerequisites have landed; Jim is the next real consumer | +| Echo | Generic causal runtime | Package installation, admission, footprints, budgets, scheduling, private evaluation, atomic Ticks, WAL, receipts, readings, recovery | `Jim`, `Buffer`, `Rope`, `ReplaceRange`, `TextWindow`, Vim policy, native planner callbacks | Real production authority already exists through the compatibility host | +| Echo authority realm | Serialized current-head authority for commit-time mutable read and write preconditions during one epoch | Realm identity, authority epoch, hosted-worldline membership, transaction order, and authoritative WAL or consensus history | Independent contradictory commits by multiple hosts or claims of atomic revalidation over another realm's mutable head | Target shared-worldline contract; not yet proven by the current per-process composition | +| Graft | Structural intelligence over bounded text | Syntax spans, folds, outlines, parser diagnostics, cursor-node context, structural selections and diffs | Text mutation authority, Jim state, or a reason to specialize Echo | Adapter/projection role; not the editor kernel | +| Wesley | Transitional contract compiler and generator | GraphQL-derived codecs, EINT operation identities, registry evidence, host rule helpers, query observer scaffolding | Final Jim semantics, runtime policy, or application state | Active compatibility dependency; scheduled for retirement from semantic execution | +| Canonical-event adapter | Normalize physical input without deciding editor commands | Stable event identity, source principal, source order, normalized key/text/paste/resize/pointer payload, composition boundaries, capability context, and payload digest where applicable | Turning `d` plus `w` into delete-word | Target contract not yet frozen | +| Generated clients | Typed syscall-style stubs | Canonical encoding/decoding, package addresses, event and artifact transport | Command interpretation, range derivation, rope patches, optimistic authority | Allowed in target only as non-semantic membrane code | +| Filesystem | External file storage and ecosystem interchange | Bytes at paths under operating-system authority | Current in-editor buffer truth after import | Import source and export destination, not canonical editor state | +| Git | External version-control ecosystem | Repository commits, refs, index, and worktree projections | Jim's causal edit history or live buffer authority | Optional adapter/export boundary | + +The table also explains why “Echo runs Jim” is acceptable while “Echo +implements `ReplaceRange`” is not. A CPU can execute an editor without knowing +what an editor is. Echo should have the same relationship to the complete +`JimRelease`: generic program interpretation and causal authority, with +application vocabulary remaining inside compiler-produced data. + +In summary, every component has both a job and a refusal. The refusal column is +as important as the responsibility column because it prevents a convenient +adapter or runtime from becoming a second, contradictory Jim. + +## Jim's rope and who owns which part of it + +The Jedit text capability's rope is the persistent text model behind an open +buffer. A buffer keeps a stable application identity while each admitted edit +creates a new immutable head. The head names a tree of text nodes; an edit +path-copies only the touched region, reuses untouched subtree identities, +records the rewrite and diff, and advances the buffer's canonical head in the +same Echo Tick that settles the completed Jim command. + +The current compatibility implementation demonstrates the intended invariants +in native Rust. It validates the expected basis, byte-range ordering, bounds, +UTF-8 boundaries, content identities, arithmetic, and rope structure; splits +the old tree; builds replacement text; rejoins the retained pieces; emits a new +head, rewrite, diff, and buffer fact; and returns typed obstruction codes for +invalid cases. That implementation is a valuable oracle and migration witness, +but it is not the final ownership boundary. + +| Rope concern | Final owner | Why | +| --- | --- | --- | +| Meaning of buffer, head, rewrite, diff, checkpoint, range, and text-obstruction facts | `jedit.text` lawpacks | These are application-domain text concepts, reusable independently of Jim | +| Algorithm expressed by `ReplaceRange.edict` | `jedit.text` source | The rope algorithm is application-owned law, not a `jim.core` or Echo intrinsic | +| Command decision that composes `ReplaceRange` | `jim.core` | Modes, motions, registers, cursor, repeat, and undo policy belong to the editor personality | +| Typechecking and lowering that algorithm | Edict | Compiler correctness and package identity belong at the language boundary | +| Generic graph reads and staged writes | Echo target profile | These are application-neutral runtime primitives | +| Admission, footprint enforcement, combined atomic Tick, receipt, WAL, and recovery | Echo | These are generic causal-runtime powers | +| Materialized lines, line indexes, scroll windows, and screen cells | Jedit/Bijou | They are rebuildable projections | +| Syntax tree, folds, symbols, and structural selections over a reading | Graft | They are structural projections, not rope authority | +| Current native split/join/plan implementation | Compatibility Rust host | It exists today but must become unreachable and then be deleted from production | + +> **Intuition to carry forward:** Echo may store and transform opaque rope facts +> by interpreting a generic program, just as a database stores application +> rows. That does not give Echo a rope operation or editor ontology. + +A second foil is useful here. Graft may parse the whole visible buffer and know +where every function begins, yet deleting Graft's snapshot must not delete or +rewind the buffer. The syntax tree is a projection over one rope head, not a +competing text store. + +In summary, the Jedit application domain owns the text law, but `jedit.text`, +not `jim.core`, owns rope representation and algorithms. Jim consumes its +public buffer, head, range, slice, diff, and result contracts. Edict translates +the composed law, Echo makes the combined Jim-and-buffer settlement real, and +Jedit and Graft see projections of that authority. + +## How Jim sees source files + +A source file is not the live editor buffer. It is an external byte sequence at +a filesystem path that may be imported into Jim and later receive an exported +projection. Once imported, the authoritative current text is the Echo-backed +buffer worldline head, not whatever bytes happen to remain at the path. + +The source lifecycle looks like this: + +```mermaid +flowchart TD + F["Filesystem file
external bytes at a path"] + A["Jedit file adapter
import and export I/O"] + C["CreateBuffer law
jedit.text plus Jim import policy"] + H["Echo-held buffer worldline
canonical rope head"] + T["TextWindow reading
basis-bound bounded text"] + J["Jim worldline
editor state and decisions"] + G["Graft projection
syntax and structure"] + X["Export reading
selected witnessed head"] + Q["EditorProjection
one declared causal view basis"] + P["Bijou projection
terminal cells"] + + F -->|import bytes| A + A --> C + C --> H + H --> T + T --> J + T --> G + H --> Q + J --> Q + G -.->|only at matching basis| Q + Q --> P + H --> X + X --> A + A -->|write projection| F + + style H fill:#d4edda,stroke:#2e7d32 + style F fill:#d1ecf1,stroke:#31708f + style T fill:#d1ecf1,stroke:#31708f + style G fill:#d1ecf1,stroke:#31708f + style Q fill:#d1ecf1,stroke:#31708f + style P fill:#d1ecf1,stroke:#31708f +``` + +
+Figure 2 - A file is an import source and export projection + +The filesystem participates at the boundary. Import creates or associates an +Echo-backed Jim buffer; subsequent editing advances rope heads independently +of the path. Saving selects a witnessed head and exports its bytes. Text +windows, syntax trees, coherent editor projections, and terminal cells are +derived views and can be recreated without changing canonical history. A Graft +view joins the editor projection only when it names the rendered buffer head. + +
+ +| Situation | Authoritative fact | Consequence | +| --- | --- | --- | +| Before first import | Filesystem bytes at the selected path | Jedit may read them through an adapter under Jim policy | +| After buffer creation | Echo-backed buffer identity and canonical rope head | The path is provenance and projection metadata, not live text authority | +| While editing | Latest admitted rope head plus Jim state | A stale disk file cannot overwrite the buffer silently | +| While rendering | A declared causal view basis plus basis-matching optional projections | Deleting a cache or pane changes no text history; stale Graft data is withheld | +| During save/export | A selected witnessed rope head | The adapter writes a projection and records which basis was materialized | +| After external file change | Two potentially divergent authorities are observed | Jim must apply an explicit import, rebase, conflict, or refusal policy | + +This model also prevents a common false shortcut: reading a file immediately +before every command does not make the filesystem an Echo reading, and writing +the UI's current lines does not prove a lawful save. Both operations need an +explicit boundary and a named basis. + +A save is an external-effect protocol because Echo and the filesystem do not +share one transaction. Jim first commits an export intent naming immutable +content and the expected prior external fingerprint. The adapter then performs +the host write and reports what it actually observed: + +```text +ExportIntent { + intent_id, + logical_destination, + selected_buffer_head, + exported_content_ref, + expected_prior_external_fingerprint, + idempotency_key, + adapter_capability +} + +ExportObserved { + outcome_id, + intent_id, + idempotency_key, + resulting_external_fingerprint, + observed_content_identity, + result: DesiredStateObserved + | DivergentStateObserved + | NotAppliedObserved + | Indeterminate + | Unsupported, + guarantee: CausallyAdmitted + | CooperativeSerialized + | OptimisticObserved + | None, + effect_evidence: ProviderReceipt + | CooperativeLeaseReceipt + | ObservationRecord + | None, + authorship: Correlated | Unattributed | NotClaimed +} +``` + +The logical destination is durable application vocabulary; a machine-specific +path is resolved by the adapter or workspace membrane. A fingerprint check +followed by ordinary replacement is not compare-and-swap: another writer can +replace the destination after the check and before the rename, and an ordinary +rename may then destroy that intervening state. The adapter must therefore +declare the materialization guarantee it actually provides. + +| Guarantee | Authority and protection | Honest claim | +| --- | --- | --- | +| `CausallyAdmitted` | Destination mutation participates in a transactional authority such as WARP-mediated storage | The provider can correlate the admitted operation with the materialization receipt | +| `CooperativeSerialized` | Authorized adapters share a destination lease and fencing protocol | Cooperating materializers serialize; uncooperative external tools remain outside the guarantee | +| `OptimisticObserved` | Adapter checks before and observes after without exclusive authority | The desired state was observed, but an intervening writer could not be prevented | +| `Unsupported` result | The required provider behavior is unavailable | Refuse before mutation rather than exaggerate the guarantee | + +A cooperative provider uses a lease coordinate such as: + +```text +MaterializationLease { + destination_identity, + materializer_identity, + authority_epoch, + fencing_token, + expiration_or_revocation_rule +} +``` + +The fencing token prevents an expired or superseded cooperative materializer +from continuing under its old authority. Effect evidence may come from a +causally admitted provider receipt, a cooperative lease receipt, an operation +identity transferred in filesystem metadata or an extended attribute, or a +plain observation record. Authorship is a separate coordinate: a lease proves +participation in cooperative serialization but does not by itself prove that +the operation authored the final bytes. Ordinary matching bytes prove neither. + +The adapter performs the write protocol appropriate to its declared class—or +returns `Unsupported` before mutation—then observes any attempted result. If +the host crashes after the filesystem state changes but before Echo records +`ExportObserved`, recovery re-observes the destination using the idempotency +key, content identity, and provider evidence instead of guessing or blindly +overwriting it. + +| Recovery observation | Meaning | Jim policy choice | +| --- | --- | --- | +| Provider-backed causal evidence proves this intent did not apply, and the destination retains the expected prior state | `NotAppliedObserved` | Retry under the declared provider protocol or settle a typed not-applied result | +| Destination currently matches the expected prior fingerprint without provider-backed non-application evidence | `Indeterminate`; the export could have applied before that state was restored | Keep the intent unresolved and do not automatically retry or record non-application | +| Destination contains the exact intended content without correlated provider evidence | `DesiredStateObserved`; who authored it is unknown | Record state equivalence and `authorship: Unattributed` without claiming this intent wrote it | +| Destination contains the intended content plus evidence correlated to this intent | `DesiredStateObserved` with provider-backed effect evidence | Record `authorship: Correlated` only to the strength justified by the provider | +| Destination differs from both expected and intended state | `DivergentStateObserved`; bytes alone do not identify the author or cause | Preserve the divergent evidence and apply conflict or reconciliation policy | +| Observation cannot establish the resulting state after an effect may have started | `Indeterminate`; the effect may or may not have happened | Keep the intent unresolved and do not blindly retry or claim not-applied | + +An indeterminate export remains causally live. A later save must either +reconcile it first or create an explicitly related superseding intent; it may +not reuse the original intent identity or attribute a later observation to the +wrong operation. Exact supersession and reconciliation schemas belong in the +external-materialization ADR, but stable intent and outcome identities are +required here. + +The same separation applies to import: the adapter observes bytes and external +identity, while Jim policy decides whether they create a buffer, reconcile with +an existing head, or produce a conflict result. Echo history retains logical +external identities, immutable content references, intents, and observations; +it does not acquire ambient host paths as application authority. + +In summary, Jim sees source files as external coordinates and import/export +surfaces. Jim edits an Echo-backed buffer worldline; the path is not the buffer, +and the saved file is one observed materialization of a chosen head. Durable +intent plus re-observable, idempotent effect evidence makes the crash window +recoverable without pretending that every filesystem offers compare-and-swap +or that observed matching bytes prove operation authorship. Indeterminate +effects remain explicit unresolved evidence rather than being mislabeled as +not applied. + +## The artifacts that must never be collapsed + +Jim's application law travels through several artifacts, each with a distinct +owner and evidentiary role. Treating any two as interchangeable is how schema +definitions or test oracles accidentally become fake runtime implementations. + +| Artifact | Owner | What it proves | What it does not prove | +| --- | --- | --- | --- | +| `jedit.text.schema@1` | Jim/Jedit | Canonical application fact shapes, codecs, coordinates, and identity rules | Executable behavior | +| `jedit.text.ReplaceRange.oracle@1` | Jim/Jedit test evidence | Expected results and obstructions for retained cases | An algorithm or package | +| `ReplaceRange.edict` | `jedit.text` source | Authored operation semantics | Its dependency closure, successful compilation, installation, or execution | +| Lawpack | Jedit application domain | Versioned application dependency bundle and permitted law | Canonical compiler output or an installed executable composition | +| Core IR, Target IR, package, and verification report | Edict | Canonical compiler output and structurally separate acceptance | That Echo installed the package or admitted a particular run | +| `JimRelease` manifest | Jedit application domain plus Edict-produced identities | Exact transitive identities and lifecycle coordinate intended to govern one Jim worldline | That every required byte remains retained, installed, verified, or active | +| Content-addressed release closure | Artifact store | Exact package and manifest bytes remain available for installation and reenactment | That Echo activated the release or a command committed | +| Installed release record | Echo | One complete closure was retained, installed, verified, and activated for a worldline under an explicit transition | That a particular command committed | +| Tick, conflict outcome, reading, receipt, and recovery evidence | Echo realm | What happened under one release, realm, epoch, basis, and admitted or rejected execution | What Jim should decide next | + +The schema and oracle are already frozen under +`contracts/jedit/lawpacks/replace-range-v1/`. `ReplaceRange.edict` and its +complete application-owned lawpack closure do not yet exist in Jedit. Neither +does the release manifest that would bind `jim.core`, `jedit.text`, their entry +points, and the relevant profiles. Edict's generic application-owned lawpack +authoring and bounded-control prerequisites have landed, but only the real +application source can reveal the next honest compiler or target-profile gap. + +In summary, the artifact chain moves from application definition, to authored +source and lawpack closure, to compiler-produced package, to installed release, +to runtime evidence. No stage may be invented from the stage before or after +it, and “package” must not be used as a synonym for the whole chain. + +## What exists today and where it diverges from the target + +The current system is not fake: it uses a real native Echo host, real +WAL-acknowledged admission, scheduler-owned Ticks, graph-rope facts, receipts, +bounded observations, and restart recovery. The divergence is ownership. Jim's +semantic state machine is still split across TypeScript and native Rust rather +than authored as `jim.core` composed with `jedit.text` under a pinned release. + +```mermaid +flowchart TD + subgraph CURRENT["Current Wesley compatibility corridor"] + C1["TypeScript
Vim parsing, motion and range decisions"] + C2["Generated Wesley package
codecs and operation identity"] + C3["Native Rust host
rope planner and operation handlers"] + C4["Echo
admission, Tick, WAL and receipt"] + C1 --> C2 --> C3 --> C4 + end + + subgraph TARGET["Target Jim-on-Edict corridor"] + T1["jim.core
event interpretation and state"] + T2["jedit.text
operations, optics and text law"] + T3["JimRelease
retained verified composition"] + T4["Echo realm and epoch
one coherent generic settlement"] + T1 --> T2 --> T3 --> T4 + end + + style C1 fill:#f8d7da,stroke:#c0392b + style C3 fill:#f8d7da,stroke:#c0392b + style T1 fill:#d4edda,stroke:#2e7d32 + style T2 fill:#d4edda,stroke:#2e7d32 +``` + +
+Figure 3 - The semantic-authority cutover + +The current route already reaches Echo, but application meaning enters through +TypeScript command planning and native Rust rope handlers. The target keeps +Echo's generic authority while replacing those semantic owners with checked-in +`jim.core` and `jedit.text` Edict source, a retained pinned release closure, and +one coherent command settlement inside an explicit authority realm and epoch. + +
+ +| Concern in the `dw` example | Current owner | Target owner | +| --- | --- | --- | +| Parse the `d` and `w` chord | TypeScript Vim grammar and executor | `jim.core` | +| Remember pending delete state | TypeScript editor state | `jim.core` | +| Resolve the word motion | TypeScript over projected `EditorState.lines` | `jim.core` over a basis-bound reading | +| Convert UI coordinates to UTF-8 byte offsets | TypeScript compatibility planner | Public `jedit.text` coordinate contracts composed by `jim.core` motion law | +| Choose insert/replace/delete operation | TypeScript workspace command orchestration | `jim.core` | +| Split, join, validate, and emit rope facts | Native Rust compatibility planner | `jedit.text`'s `ReplaceRange.edict`, compiled to generic target operations | +| Settle buffer, Jim state, command result, and evidence | Not yet one application-authored causal cut | Echo executing the composed `JimRelease` program inside one realm and epoch | +| Reject a candidate whose read set changed | Current compatibility behavior does not yet prove the final Jim protocol | Echo conflict outcome followed by a separate idempotent `jim.core` resolver Tick | +| Admit, schedule, persist, receipt, recover | Echo | Echo | +| Read the resulting bounded text | Generated/native `TextWindow` observer | `TextWindow.edict` through Echo | +| Install lines into the editor and paint | TypeScript/Bijou projection code | Jedit/Bijou projection code | + +The current GraphQL contract declares four operations: create a buffer +worldline, replace a range as a Tick, declare a checkpoint, and read a bounded +text window. Wesley generates codecs, identities, registry evidence, and host +helpers from that schema. The actual operation law still appears in +`native/jedit-echo-host/src/contract.rs` and its rope modules. TypeScript's +`vim-chord-syntax.ts`, `vim-motion-resolver.ts`, +`vim-command-executor.ts`, `workspace-text-edit-planner.ts`, and +`workspace-text-commands.ts` still perform active compatibility semantics. + +> **Intuition to carry forward:** “Echo-backed” and “Jim authored in Edict” are +> separate milestones. The compatibility route genuinely proves Echo runtime +> authority, but it does not prove the final application boundary. + +In summary, the migration preserves the already-real Echo corridor and changes +who supplies application meaning and how a complete command settles. We do not +need to teach Echo about ropes; we need to replace TypeScript and native Rust +semantic authority with a compiled, pinned application release whose Jim and +buffer consequences become one causal cut. + +## Echo authority realms serialize shared worldlines + +Atomic settlement requires one authority to order every mutable worldline in +the Tick. Two independent Echo processes with independent WALs do not race over +one history; they create two histories. The target therefore introduces an +Echo authority realm and epoch before claiming that multiple Jim instances can +edit one shared buffer serially. + +The conceptual realm coordinate is: + +```text +EchoAuthorityRealm { + realm_identity, + authority_epoch, + hosted_worldlines, + transaction_order, + WAL_or_consensus_history +} +``` + +`WAL_or_consensus_history` means one authoritative ordered record, whether it +is retained by one local write-ahead log or by a future replicated agreement +protocol. Replication may change how the order is hosted; it does not create a +second valid order for the same realm and epoch. + +The type does not make Echo globally singular. It makes mutation authority +singular for a declared set of worldlines during one epoch. Every mutable +worldline belongs to exactly one authoritative realm during that epoch. Every +mutable worldline whose current head participates in a candidate's commit-time +read or write preconditions belongs to that same realm and epoch. + +Cross-realm state may enter a candidate only as immutable, witnessed evidence. +For example, Realm A may consume a reading bound to `Realm B Buffer@H7` as a +historical fact. Realm A cannot claim “commit only if Realm B is still at H7” +because Realm A cannot atomically revalidate Realm B's mutable head at its own +serialization point. That stronger claim requires an explicit cross-realm +protocol. The committing realm **MUST NOT** represent cross-realm mutable state +as an atomically revalidated current-state read. + +For the first production composition, `echod`—the local Echo daemon—should be +one workspace-scoped authority service: + +```text +one local echod per workspace +├── Jim session A worldline +├── Jim session B worldline +├── shared Buffer worldlines +└── one serialized transaction authority +``` + +Multiple Jedit processes may connect as clients. Echo may later replicate or +move a realm across processes, but those hosts participate in one authoritative +order rather than independently committing contradictory histories. + +Here “WARP-style” means an explicit, evidence-carrying operation that relates, +merges, rebases, or adopts histories across authority domains. It is not an +atomic cross-realm Jim command. + +| Situation | Authority rule | Result | +| --- | --- | --- | +| Two Jim clients share one buffer in one realm and epoch | One realm serializes both candidate settlements | At most one candidate based on `H0` can commit as the next buffer transition | +| A mutable read or write precondition spans different realms | One realm cannot atomically revalidate the other's current head | Move authority, weaken the remote input to immutable witnessed evidence, or use an explicit cross-realm protocol | +| A realm moves to a new host | Authority epoch changes and the old epoch is fenced | A former host cannot continue committing after handoff | +| Two independent realms import the same basis | Each may advance its own branch | `H1A` and `H1B` are explicit branches, not competing commits to one history | +| Branches must reconcile | Use a witnessed WARP-style merge, adoption, or rebase operation | Reconciliation becomes named causal history rather than a hidden Jim command | + +The current compatibility deployment proves real Echo authority inside its +existing host boundary, but it does not yet prove this shared-realm contract +across independent Echo processes. Shared-buffer races remain target behavior +until realm identity, epoch fencing, hosted-worldline membership, and +serialization are executable. + +In summary, Echo is not one global server, but each shared mutable history has +one authoritative realm and epoch. Independent realms branch; one realm +serializes; authority movement fences the past host; cross-realm reconciliation +is explicit. + +## The active observer is a durable protocol + +The arrows around Jim describe retained protocol states, not in-memory +callbacks. Every input, observation request, reading, command attempt, outcome, +and settlement needs stable identity, causal correlation, and idempotent +consumption so restart can resume at any boundary without losing or duplicating +editor meaning. + +A canonical input event is therefore structured but semantically opaque to the +body and Echo. Its contract preserves at least: + +| Event field | Why the protocol needs it | Who interprets it | +| --- | --- | --- | +| Stable event identity | Deduplicates redelivery and proves consumption | Echo tracks delivery; `jim.core` assigns semantic consequences once | +| Source principal and input source | Distinguishes terminal, agent, automation, or another admitted producer | Admission policy and `jim.core` | +| Source sequence or ordering coordinate | Preserves order while Jim waits for a reading | Echo scheduling under the declared protocol | +| Normalized physical input | Represents `Key`, `TextInput`, `Paste`, `Resize`, `Pointer`, or another body-level event | Jedit normalizes; `jim.core` decides editor meaning | +| Composition or paste boundary | Prevents text composition and bracketed paste from becoming accidental command chords | Jedit observes the physical boundary; `jim.core` applies modal policy | +| Capability or admission context | Proves which source was authorized to submit the event | Echo admission | +| Payload digest where relevant | Binds large or separately stored payload bytes | Transport and Echo evidence | + +Normalizing an escape sequence into `Key("d")` is body-level decoding. +Combining `Key("d")` and `Key("w")` into delete-word is application semantics +and belongs only to `jim.core`. + +The retained protocol states make progress and recovery explicit: + +| Protocol state | Durable evidence | Permitted next step | +| --- | --- | --- | +| Event admitted | Event identity, source order, release identity | Commit at most one semantic consumption against the named Jim basis and progress under the protocol's liveness conditions | +| Operator pending | Consumed `d` event and new Jim basis | Accept later input in declared order | +| Command attempt waiting | Consumed `w`, `CommandAttempt C`, requested observation and correlation identity | Deliver a matching reading or a typed observation failure | +| Reading available | Reading basis, support footprint, correlation identity | Resume exactly `C` under the same release closure | +| Command ready | Jim and text consequences evaluated privately under a candidate identity and read-set digest | Attempt one combined settlement against all expected bases | +| Candidate rejected by Echo | Outcome, attempt, candidate, realm, epoch, serialization, read-set, and conflict-reason identities | Retain the attempt unresolved and admit a later Jim resolver Tick that consumes the outcome identity at most once | +| Command settled | Applied, normal-domain, or obstructed result plus correlated evidence | Render its coherent causal cut or begin another command | + +Two independent Jim instances may legitimately race on `Buffer H0` only inside +one authority realm and epoch. Their candidates are conditional on exact Jim +bases, buffer basis `H0`, reading support, release identity, event identities, +budgets, and footprints. One combined Tick may advance the buffer to `H1` and +its Jim instance to `J1`. At the serialization point, Echo rejects the other +candidate because its read set expected `H0` and now observes `H1`. + +The initial protocol deliberately separates this Echo conflict from Jim's +application outcome: + +```text +CandidateSettlementRejected { + outcome_id: O1, + attempt_id: CB, + candidate_id: K1, + realm, + authority_epoch, + serialization_coordinate, + read_set_digest, + reason: ReadSetChanged(Buffer, expected=H0, current=H1) +} + +later Jim resolver Tick chooses exactly one branch: + retry: + consume outcome O1 for CB at most once + keep CB unresolved + advance Jim into an observation-waiting retry state + request new basis-bound evidence + emit no CommandSettled record + + refusal: + consume outcome O1 for CB at most once + leave Buffer at H1 + advance Jim JBpending -> JBstale + emit CommandSettled(CB, Obstructed(StaleBasis(H0, H1))) +``` + +The rejected candidate was not a Tick and emits no application settlement. +The durable `CommandAttempt CB` remains unresolved until the later resolver +Tick commits. A transactional conditional branch at Echo's serialization point +could someday choose between applied and stale Jim consequences atomically, +but that is a separate generic runtime capability; the initial architecture +does not assume it. + +One semantic attempt may produce a later candidate after explicit +re-observation or retry, so attempt identity and candidate identity are not +synonyms. The outcome identity deduplicates delivery of the exact rejection; +the candidate identity identifies the privately evaluated proposal; and the +serialization coordinate places that rejection in the realm's authoritative +order. + +Terminal settlement has separate safety and liveness rules: + +```text +Safety: + At most one terminal CommandSettled record may exist + for one CommandAttempt. + +Liveness: + While the authoritative realm continues to make progress + and the attempt's pinned release and required evidence remain available, + every unresolved CommandAttempt MUST eventually receive one of: + CommandSettled(Applied) + CommandSettled(NormalResult(...)) + CommandSettled(Obstructed(...)) + CommandSettled(Cancelled(...)) +``` + +Runtime conflicts, redelivery, and crashes cannot manufacture a second terminal +record. A stopped realm, unavailable release closure, missing required +evidence, or permanent runtime fault may prevent progress, so unconditional +eventual settlement is not claimed. An explicitly admitted cancellation is a +terminal result when the liveness conditions hold and Jim policy chooses not to +retry. No winning buffer consequence can be paired with the losing command's +register or cursor consequence. + +The durable uniqueness key is the `CommandAttempt` identity in realm-governed +state. A terminal resolver candidate may commit only while that attempt's +terminal-settlement slot is empty. Recovery and authority-epoch transfer retain +the attempt worldline and its filled or empty slot; a new host cannot reopen a +terminal attempt merely because the authority epoch changed. The exact generic +Echo compare-and-commit shape belongs in the realm transaction ADR. + +> **Intuition to carry forward:** an active observer is a recoverable state +> machine whose messages are facts with identities. It is not an object waiting +> on a promise in a private heap. + +In summary, multiple transitions may admit input, request observations, and +resume work, but every transition is retained and correlated. The completed +command crosses one settlement boundary. A rejected candidate remains an Echo +transaction outcome until a separate Jim resolver settles the application +meaning. At-most-one terminal settlement is unconditional safety; eventual +terminal settlement is liveness under named realm, release, and evidence +availability conditions. + +## Undo, repeat, and results are forward semantic actions + +Undo and repeat must preserve causal history instead of pretending a mutable +editor can rewind time. Jim constructs new commands from retained evidence: +undo proposes a compensating edit against the current basis, while repeat +reapplies a semantic recipe against a new reading. + +| Feature | Jim retains or derives | What it must not do | +| --- | --- | --- | +| Undo | Edit-group identity, originating command receipts, affected heads, removed and inserted content identities, and enough evidence to construct a compensating command | Move Echo's canonical head backward or assume an old inverse still applies | +| Repeat | A semantic recipe such as “delete one word under word-policy P” plus the governing release identity | Reuse the stale byte range from the previous buffer head | +| Redo | A forward semantic recipe derived from the relevant undo group and current basis | Replay opaque graph patches outside current law | + +A compensating command may obstruct when intervening changes make its old +evidence inapplicable. That is honest forward history: the earlier edit remains +a fact, and the attempted compensation becomes another witnessed fact. + +The word “obstruction” also needs a narrow type boundary. Otherwise unrelated +failures become one junk drawer and Jim cannot apply lawful policy: + +| Result class | Examples | Owner | +| --- | --- | --- | +| Normal Jim domain result | Search miss, user cancel, empty motion, nothing to do | `jim.core` | +| Typed text or observation obstruction | Stale basis, invalid range, invalid UTF-8 boundary, insufficient reading support | `jedit.text` or the relevant optic, interpreted by `jim.core` | +| Echo transaction outcome | Candidate read-set change, footprint conflict, fenced authority epoch, or serialization rejection | Echo; a rejected candidate is not a Jim settlement | +| Admission or verification rejection | Missing authority, invalid package, unsupported target profile, exhausted admission budget | Edict verification or Echo admission | +| Compiler diagnostic | Ill-typed source, unclosed lawpack authority, lowering failure | Edict | +| External-effect result | Desired, divergent, not-applied, indeterminate, or unsupported materialization with declared guarantee, effect evidence, and authorship classification | Adapter observation plus `jim.external-policy` | +| Runtime fault | Internal evaluator, WAL, or recovery invariant failure | Echo fault boundary, not an application obstruction | + +In summary, undo, redo, and repeat advance history through new semantic +commands, and result types retain their layer of origin. This keeps recovery +explainable and prevents “obstruction” from hiding compiler, runtime, or +external-effect failures. + +## Rendering consumes one coherent causal cut + +Rendering is disposable, but the bases of the projection are not arbitrary. +Every Jim state declares the buffer head against which its semantic coordinates +are valid, and every editor projection identifies one coherent view basis. A +shared command settlement is one way to establish that basis, but ordinary +cursor, mode, and pending-operator transitions must also remain renderable when +the buffer does not change. + +```text +JimState J { + active_buffer, + presentation_buffer_head, + cursor_basis, + selection_basis, + pending_command_basis, + ... +} + +EditorProjection { + jim_basis, + buffer_head, + structural_basis: Graft@buffer_head | absent, + viewport_basis, + projection_version +} + +EditorProjection is current iff: + projection.jim_basis resolves to JimState J + projection.buffer_head == J.presentation_buffer_head + every required semantic coordinate in J is valid at that head + every required projection names that same view basis + optional projections either match that head or are absent +``` + +For the successful `dw`, `Jim J1` and `Buffer H1` come from one combined +settlement. A later cursor movement may lawfully produce `J2/H1`, and entering +visual mode may produce `J3/H1`; no text edit is required for those pairs to be +coherent. Each Jim transition declares that its cursor, selection, mode, and +pending-command coordinates still refer to `H1`. + +If another Jim session advances the shared buffer to `H2`, the local state +`JB7/H1` does not become valid over `H2` automatically. The local Jim may keep +presenting the coherent historical pair `JB7/H1` while indicating that a newer +shared head exists, or it may observe `H2` and settle a reconciliation such as: + +```text +JB7/H1 + -> observe H2 + -> reconcile cursor, selection, pending command, and viewport + -> JB8/H2 +``` + +Optional Graft intelligence may lag. Jedit withholds syntax decorations, folds, +or structural selections whose basis does not match the rendered buffer head. +It does not mix `Graft@H0` with text from `H1` merely because both caches are +locally available. + +| Available projection state | Rendering rule | +| --- | --- | +| Jim and buffer came from one combined edit settlement | Render their declared coherent view basis | +| Jim advanced cursor or mode without changing the buffer | Render the new Jim basis over the unchanged declared presentation head | +| A shared buffer has a newer head than local Jim coordinates | Keep the coherent historical pair or reconcile Jim before presenting the new head | +| Graft basis matches the rendered buffer head | Add matching structural decoration | +| Graft is absent or stale | Render without that optional decoration and request a new projection | +| Jim coordinates are not valid at the proposed buffer head | Refuse to present the combination as current editor state | + +In summary, the screen is not a bag of whichever caches updated most recently. +It renders one declared causal view basis. Shared settlement can establish that +basis, but the general rule is that Jim's semantic coordinates are valid at the +named presentation head and optional projections are either basis-matched or +absent. + +## Five non-negotiable causal clauses + +The detailed model reduces to five normative clauses. These clauses are the +review boundary for later design and implementation: a convenient API or +platform limitation may refine the mechanism, but may not silently weaken the +meaning. + +1. Every mutable worldline whose current head participates in a candidate's + commit-time read or write preconditions **MUST** be governed by the same Echo + authority realm and authority epoch. Cross-realm state may enter only as + immutable, witnessed evidence; independent realms produce branches, not + competing commits to one history. The committing realm **MUST NOT** represent + cross-realm mutable state as an atomically revalidated current-state read. +2. A failed candidate Tick **MUST NOT** emit an application settlement. Echo + transaction conflicts and Jim command outcomes are distinct evidence + classes. +3. Every current editor projection **MUST** identify one coherent view basis. + Jim semantic coordinates **MUST** be interpreted against the exact buffer + head named by that basis. +4. Every external-effect receipt **MUST** identify the materialization + guarantee, result certainty, effect evidence, and authorship classification + actually provided. Observed state equivalence **MUST NOT** be represented as + proof of operation authorship, and an indeterminate effect **MUST NOT** be + represented as not applied. +5. `JimRelease` **MUST** identify and retain the complete transitive executable + closure. Release activation **MUST** follow an explicit lifecycle protocol; + there is no ambient latest dependency or implementation. + +| Clause | Failure it rules out | +| --- | --- | +| Realm and epoch | Two independent WALs both claiming to have atomically validated or changed mutable current heads in one transaction | +| Conflict versus outcome | A rejected, nonexistent Tick leaving a ghost Jim obstruction | +| Coherent view basis | New text rendered with an old cursor, selection, pending command, or syntax projection | +| Materialization guarantee | Matching bytes being reported as authorship, optimistic rename being described as compare-and-swap, or an indeterminate effect being mislabeled as not applied | +| Retained release lifecycle | Recovery replaying old events under new or unavailable application and standard-library law | + +In summary, these clauses freeze the authority, evidence, projection, external +effect, and executable-identity boundaries. Any implementation that cannot +demonstrate them remains a compatibility or experimental composition rather +than the canonical Jim architecture. + +## Known claims gaps and active review questions + +The architecture is deliberately under review because several written claims +still need reconciliation with executable reality. Naming these gaps makes the +document useful as a review instrument rather than another source of confident +but contradictory prose. + +| Review question | Current evidence | Required resolution | +| --- | --- | --- | +| Can one command tear across Jim and buffer state? | Earlier target prose showed `ReplaceRange` committing before Jim advanced | Freeze a combined command-settlement contract and prove one Tick or an explicitly equivalent durable protocol over Jim state, buffer state, command result, and evidence | +| What serializes mutable read and write preconditions? | Independent Echo processes and WALs can each advance their own imported `H0`; one realm also cannot revalidate another realm's mutable head | Define and prove authority-realm identity, hosted-worldline membership, transaction order, epoch fencing, immutable cross-realm evidence rules, and explicit branch reconciliation | +| What does the losing candidate produce? | A failed candidate cannot both abort and emit a Jim stale-basis settlement; one attempt may generate multiple candidates | Retain an identified Echo rejection outcome with attempt, candidate, realm, epoch, serialization, and read-set coordinates; keep the attempt unresolved; preserve at-most-one terminal settlement safety and conditional liveness | +| Is the text substrate part of Jim? | Earlier prose grouped rope law under “Jim-owned lawpacks” | Separate `jim.core` editor semantics from reusable application-owned `jedit.text` representation and operation law | +| Can restart resume every active-observer boundary? | Target arrows imply event, reading, and outcome delivery but do not yet define retained protocol facts | Freeze stable event, attempt, correlation, reading, settlement, ordering, deduplication, and recovery identities | +| Which law interprets replayed work? | Lawpacks are digest-bound, but no retained full Jim release closure exists | Define the transitive `JimRelease`, retain every reachable byte needed for reenactment, pin work to it, and require an explicit quiescent migration before activation | +| How does save survive a host crash or intervening writer? | The file is correctly described as an export projection, but no executable effect provider or compare-and-swap contract exists | Define stable intent and outcome identities, fingerprints, immutable content references, idempotency keys, guarantee and certainty classes, effect evidence, authorship classification, indeterminate supersession, leases and fencing where available, and recovery decisions | +| Can the UI combine inconsistent bases? | Projections are disposable, but the current target has no canonical view-basis contract | Make every Jim state declare its presentation head and coordinate bases; render only a valid view basis and withhold optional Graft data when its basis differs | +| Are all unhappy outcomes obstructions? | Current prose and contracts emphasize typed obstructions | Freeze separate normal-domain, obstruction, admission, compiler, external-effect, and runtime-fault result classes | +| Is checkpoint declaration supported today? | The native host registers, admits, persists, and returns `RopeCheckpointDeclared` evidence; `docs/BEARING.md` records it as implemented | Remove stale claims that checkpoint always fails closed; retain the distinction from causal anchors and text mutation | +| What exactly is a canonical event envelope? | The target sequences require one, but the final wire schema is not yet frozen | Define one opaque transport contract: Jedit decodes raw input, Echo carries the envelope without interpreting Jim fields, and only `jim.core` assigns editor meaning | +| Which TypeScript paths still own semantics? | Vim parsing, motion resolution, coordinate conversion, operation selection, and transition planning are executable today | Classify them explicitly as compatibility authority, not merely import or migration plumbing | +| Who owns text and rope contracts in target prose? | Some older documents say “Jedit” broadly, while the first draft grouped them under Jim | Name `jedit.text` as the application-owned text capability, `jim.core` as its semantic consumer, and Jedit as the product/body composition | +| Do documentation tests prove the canonical section? | Some policy tests search required phrases anywhere in a document | Scope tests to the named ownership sections and assert the complete contract, including test-only direct `ReplaceRange` invocation | +| Does the target exist in code? | `Jim.edict`, `ReplaceRange.edict`, `TextWindow.edict`, `JimRelease`, authority realms, durable conflict resolution, and materialization guarantee providers are absent or unproven | Keep every target statement labeled as target until compiler, runtime, recovery, and external-effect evidence exists | + +There is also a procedural gap. The clean architecture worktree is one commit +ahead of current Jedit `main`, and PR #300 carries these ownership corrections, +but it remains blocked by five unresolved review threads. This document is a +review draft on that branch; it is not merged architecture doctrine and must +not be cited as production evidence. + +In summary, the remaining disagreements are not about whether Echo should +learn Jim vocabulary. They are about making every document and executable +guard describe one pinned-release, durable-event, split Jim/text semantics, +realm-serialized, conflict-honest, coherent-view, guarantee-labeled, +generic-Echo model. + +## How the ownership map was audited + +This map was built by comparing canonical architecture claims with the code +paths that currently make decisions. Documentation alone was insufficient, +because the open architecture PR itself contains a stale checkpoint statement +and under-classifies some compatibility authority. + +The audit followed these evidence layers: + +1. `ARCHITECTURE.md`, `docs/BEARING.md`, `docs/stack-map.md`, and + `docs/jedit-echo-end-to-end.md` supplied the declared target and current + runtime corridor. +2. `contracts/jedit/echo-text.graphql` supplied the current operation surface. +3. `src/app/workspace/editor/model.ts`, `vim-chord-syntax.ts`, + `vim-motion-resolver.ts`, `vim-command-executor.ts`, + `workspace-text-position.ts`, `workspace-text-edit-planner.ts`, and + `workspace-text-commands.ts` showed where TypeScript currently decides + editor meaning. +4. `native/jedit-echo-host/src/contract.rs`, `host.rs`, and the `rope/` + modules showed where native Rust currently supplies operation law. +5. The frozen schema, codec vectors, and oracle under + `contracts/jedit/lawpacks/replace-range-v1/` established what exists without + pretending those artifacts are executable semantics. +6. Live PR and issue state established that PR #300 is blocked, Jedit #296 is + the first operation slice, and the relevant generic Edict prerequisites have + landed. + +One earlier line of thought treated a generic native rope capability as the +likely answer. That was rejected because it would preserve application law +outside the Jedit domain and tempt Echo or a native host to acquire rope +ontology. The correct model is a `jedit.text` algorithm compiled into generic +Target IR, composed by `jim.core`, and interpreted by Echo's +application-neutral primitives. + +The first draft of this map then made a subtler mistake: its boxes were owned +correctly, but its `dw` sequence committed `ReplaceRange` and advanced Jim in +apparently separate transitions. Independent architecture review demonstrated +the torn-command schedule and also exposed that “Jim-owned rope law” conflated +the editor personality with the reusable text capability. The corrected map +therefore adds one coherent settlement, separates `jim.core` from +`jedit.text`, and pins both inside an immutable release closure. + +A second review then tested the new causal protocol at its boundaries. It +found that the two-Jim race assumed a shared transaction authority that the +document had not named; a rejected candidate was still being described as if +it could emit a Jim outcome; projection coherence was tied too narrowly to text +edits; matching file bytes were overstated as export authorship; and the release +identity omitted retention and lifecycle rules. The final amendment introduces +authority realms and epochs, separates Echo conflict evidence from later Jim +resolution, generalizes rendering to a declared view basis, labels external +guarantee, certainty, effect evidence, and authorship classification, and makes +the complete executable closure both retained and explicitly activated. + +In summary, the audit worked from decisions in executable code outward to +ownership claims in prose. Whenever the two disagreed, the document records the +gap instead of choosing the more attractive story. + +## Verification and what mature looks like + +The ownership model is mature only when it is executable, independently +verified, and destructive of the compatibility path it replaces. A green +operation transport or a plausible diagram is insufficient. + +The planned proof sequence is: + +| Stage | Required proof | Ownership consequence | +| --- | --- | --- | +| Jedit #296 | Check in real `jedit.text` `ReplaceRange.edict` and its complete application-owned lawpack closure; build through Edict; execute the exact verified package through Echo; agree with the independent oracle | Removes native Rust as the owner of one text operation without calling the text substrate Jim | +| Jedit #297 | Author the `jedit.text` `CreateBuffer`, `TextWindow`, and `DeclareCheckpoint` lawpacks | Moves the remaining text operation and optic vocabulary into reusable application-owned source | +| Protocol design gate | Freeze canonical events, durable attempts/readings/outcomes, combined settlement, authority realms and epochs, candidate conflict identities, settlement safety and liveness, retained `JimRelease` lifecycle, coherent view bases, and external certainty, guarantee, evidence, authorship, and supersession classes | Prevents the observer implementation from encoding an RPC-shaped, fork-blind, ambient-version, or filesystem-overclaiming protocol | +| Echo realm and conflict gate | Host all mutable commit-time preconditions in one explicit realm and epoch; reject a stale candidate without emitting a Jim outcome; recover, consume the identified conflict outcome at most once, and prove conditional resolution liveness | Supplies the serialization and evidence boundary required by combined command settlement | +| Jedit #301 | Host the smallest persistent `jim.core` observer under a pinned release and prove one combined Jim-and-buffer command settlement plus the separate conflict-resolver path | Moves mode, event interpretation, observation requests, operation choice, and outcome handling into Jim without permitting torn or ghost commands | +| Jedit #298 | Make frontend operation orchestration, native Jim callbacks, and Wesley compatibility execution unreachable, then delete them | Leaves one production semantic authority | + +For the running `dw` example, “done” means all of the following are true: + +- [ ] Jedit turns terminal bytes into a canonical event envelope without + deciding that they mean delete-word. +- [ ] Each event has stable source, ordering, admission, and deduplication + identity, and Echo delivers it under an exact `JimRelease`. +- [ ] The complete transitive release closure is retained content-addressably, + including standard-library, target, effect, verifier, migration, and any + command-relevant structural-provider identities and bytes. +- [ ] Release activation is refused until the initial quiescence conditions and + migration checks hold. +- [ ] Jim persists the pending delete after `d`. +- [ ] Jim durably consumes `w` into a correlated command attempt and requests a + basis-bound bounded reading. +- [ ] Jim resolves the motion, byte range, register update, and cursor policy. +- [ ] The selected `ReplaceRange.edict` package is compiler-produced and + independently verified. +- [ ] `jim.core` composes the public `jedit.text` operation without knowing rope + nodes, balancing, or split/join mechanics. +- [ ] One explicit Echo realm and authority epoch govern every mutable current + head used as a commit-time read or write precondition; cross-realm inputs are + immutable witnessed evidence rather than atomically revalidated state. +- [ ] Echo evaluates privately, enforces budget and footprint, and—when the + candidate can linearize—atomically settles the buffer head, Jim state, + register, cursor, repeat recipe, undo group, command result, and correlated + evidence. +- [ ] A candidate invalidated at serialization produces only an Echo transaction + conflict with stable outcome, attempt, candidate, serialization, and read-set + identities; a later idempotent Jim resolver consumes the outcome at most once. +- [ ] Recovery proves at most one terminal settlement per attempt, and proves + eventual terminal settlement only while the realm progresses and the pinned + release and required evidence remain available. +- [ ] Restart resumes from every retained event, observation, attempt, and + settlement boundary under the same release closure. +- [ ] Undo constructs a forward compensating command, and repeat reevaluates a + semantic recipe against a new basis. +- [ ] Every Jim state declares its presentation head and semantic-coordinate + bases; Jedit renders one valid causal view basis and withholds stale optional + Graft projections. +- [ ] Export uses an idempotent intent-and-observation protocol capable of + distinguishing desired, divergent, not-applied, indeterminate, and + unsupported recovery states; labels its materialization guarantee and effect + evidence; and classifies authorship without inferring it from state + equivalence. +- [ ] An indeterminate export remains unresolved until reconciled or explicitly + superseded, and stable intent and outcome identities prevent later + observations from being attributed to the wrong effect. +- [ ] No production TypeScript command planner, native rope planner, handwritten + package, fake transport, `MutationPlan`, or compatibility fallback can satisfy + the production gate. +- [ ] The superseded semantic paths are deleted rather than left as an + undocumented second Jim. + +The most important review questions for this document are therefore concrete: + +1. Is Jim's semantic boundary drawn narrowly enough to exclude terminal, + compiler, scheduler, WAL, filesystem, Git, and rendering mechanics? +2. Is the rope correctly split among `jim.core` command policy, + `jedit.text` representation law, and Echo-owned generic runtime authority? +3. Is a source file correctly treated as import/export material rather than + live buffer authority? +4. Is Graft clearly structural intelligence rather than editor or text + authority? +5. Is Wesley clearly useful compatibility evidence rather than the final + application architecture? +6. Does one completed semantic command have exactly one settled causal cut? +7. Does one authority realm and epoch govern every mutable current head in the + candidate's commit-time read and write preconditions, while cross-realm + inputs remain immutable evidence and independent realms create branches? +8. Can a rejected candidate be resolved without inventing an application result + from a Tick that never committed? +9. Are every event, release, external effect, and rendered projection bound to + enough durable identity for deterministic recovery? +10. Does every external receipt state its actual guarantee, certainty, effect + evidence, and authorship classification; preserve indeterminate effects; + and avoid claiming authorship from matching bytes alone? +11. Can every reenacted historical command still obtain its exact retained + executable closure, and can releases activate only through the declared + lifecycle? +12. Does every current-vs-target statement make shipped behavior unmistakable? + +In summary, maturity is not “Jim can call Echo.” It is one continuous, +recoverable active-observer protocol in which `jim.core` decides editor +meaning, `jedit.text` defines reusable text law, Edict turns their pinned +and retained composition into verified packages, one Echo realm and epoch +serializes coherent generic settlements, transaction conflicts remain distinct +from Jim outcomes, and Jedit provides the body through which the user interacts +with a valid causal view basis and honestly classified external effects. diff --git a/docs/releases/v0.1.0/quickstart.md b/docs/releases/v0.1.0/quickstart.md index 2f4286aa..3b140c6f 100644 --- a/docs/releases/v0.1.0/quickstart.md +++ b/docs/releases/v0.1.0/quickstart.md @@ -58,4 +58,9 @@ Jim command ``` Edict will replace the Wesley/Rust compatibility operation. Nothing shorter -than the full path above may be described as Echo-powered. +than the full path above may be described as Echo-powered. This is not the +target application composition: final production delivers canonical events to +`Jim.edict`, which requests bounded readings, derives Jim-owned operation +intents, handles outcomes, and advances editor state. Generated clients remain +semantic-free transport stubs, and Echo remains unaware of editor or rope +vocabulary. diff --git a/docs/stack-map.md b/docs/stack-map.md index c247dc57..18db2d0a 100644 --- a/docs/stack-map.md +++ b/docs/stack-map.md @@ -1,9 +1,12 @@ # Stack Map -> **Cutover note (2026-07-16):** References below to Wesley-generated Jim -> operation metadata or local structural-history execution are historical. Jim -> now loads a real Echo kernel and fails text operations closed. Edict-generated, -> Echo-installed operations are the only accepted replacement. +> **Cutover correction (2026-08-18):** References below to Wesley-generated Jim +> operation metadata or local structural-history execution are historical or +> compatibility evidence. The target is not a frontend invoking a collection of +> Echo-installed operations. `Jim.edict` is the application and active observer; +> Jim-owned Edict lawpacks define operations and optics; Edict compiles and +> verifies generic packages; Echo realizes them without learning application +> vocabulary; Jedit/Bijou/native code supplies I/O and rendering. ## Doctrine @@ -23,9 +26,12 @@ product pressure | Layer | Job | Sends down | Receives up | | :--- | :--- | :--- | :--- | -| jedit | Product/editor pressure | intent, observation requests, product constraints | readings, receipts, product-shaped evidence | -| Echo | Runtime substrate truth | admitted runtime effects, observed readings | contract intent, observation requests | -| Wesley | Contract/compiler authority | generated artifacts, codecs, operation metadata | authored contracts | +| Jedit/Bijou/native | Jim's I/O body | canonical events, package addresses, raw adapter results | render projections, typed artifacts | +| `Jim.edict` | Editor mind and application state machine | observation requests, operation intents | canonical events, readings, outcomes, obstructions | +| Jim Edict lawpacks | Application operations, optics, facts, and obstructions | authored law and declared closure | typed application values | +| Edict | Language, checking, lowering, packaging, and verification | verified generic packages and semantic-free codecs | Jim-authored source and lawpack closure | +| Echo | Generic runtime substrate truth | admitted effects, readings, receipts, recovery evidence | verified programs, events, observation requests | +| Wesley | Transitional compatibility compiler | generated artifacts, codecs, operation metadata | authored GraphQL contracts | | Graft | Structural intelligence | spans, outlines, syntax/semantic structure | buffer snapshots or text surfaces | | Bijou | Terminal UI substrate | input/render events | screen output and interaction state | | Continuum | Deferred publication/protocol layer | shared protocol families, once earned | proven local seams | @@ -34,8 +40,10 @@ product pressure | Layer | Must never know | | :--- | :--- | -| jedit | worldline ids, scheduler internals, runtime substrate lore | -| Echo | panes, cursors, Vim semantics, editor UX | +| Jedit/Bijou/native | command meaning, operation choice, Jim state transitions, scheduler internals | +| `Jim.edict` and lawpacks | scheduler internals, WAL identities, direct graph mutation authority | +| Edict | runtime state, transport timing, editor policy | +| Echo | Jim, Buffer, Rope, ReplaceRange, TextWindow, panes, cursors, Vim semantics | | Wesley | runtime state, transport timing, editor policy | | Graft | causal truth, mutation authority | | Bijou | causal semantics | @@ -53,9 +61,10 @@ jedit-shaped bytes ``` The old Stack Witness text fixture is historical. Echo no longer contains -hardcoded `createBuffer`, `replaceRange`, or `textWindow` semantics; the next -real proof must install jedit-owned generated mutation handlers and query -observers through Echo's generic contract-host boundary. +hardcoded `createBuffer`, `replaceRange`, or `textWindow` semantics. The next +real proof begins with Jim-owned `ReplaceRange.edict`, built through Edict's +public application boundary and interpreted as a verified generic program by +Echo. The retained Jedit oracle is expectation evidence only. The current Echo `v0.1.0` release-gate proof starts from the implemented structural-history contract: diff --git a/docs/technical-teardown.md b/docs/technical-teardown.md index a83d45ab..c4eb585e 100644 --- a/docs/technical-teardown.md +++ b/docs/technical-teardown.md @@ -2,6 +2,18 @@ > **Terminal-first text and Markdown editing, built on Bijou and shaped around causal history through Echo.** +## Architecture Correction + +This teardown contains detailed snapshots of the GraphQL/Wesley compatibility +implementation. Its TypeScript planners, direct `replaceRangeAsTick` requests, +native Jim rules, and generated observer plans are migration evidence, not the +target composition. Final production delivers canonical events to `Jim.edict`; +Jim-owned Edict lawpacks define application operations and optics; Edict emits +independently verified generic packages; and Echo supplies only generic runtime +authority. Generated TypeScript is a codec/transport stub and renderer, not +Jim. See [ARCHITECTURE.md](../ARCHITECTURE.md) and +[BEARING.md](BEARING.md). + This document is a progressive, end-to-end technical explanation of `jedit` aimed at a reader with no prior knowledge of this codebase, its domain vocabulary, or the surrounding runtime stack. Each section builds on the last. ## Maintenance Posture diff --git a/spec/design-cycle-policy.spec.mjs b/spec/design-cycle-policy.spec.mjs index 3abcc7ff..b4d7d86c 100644 --- a/spec/design-cycle-policy.spec.mjs +++ b/spec/design-cycle-policy.spec.mjs @@ -242,18 +242,36 @@ test('HT-0149 graph runtime RED matrix declares all Slice 4 witnesses', () => { } }); -test('BEARING records the real Echo-hosted generated text corridor', () => { +test('BEARING distinguishes the compatibility corridor from Jim.edict', () => { const bearing = readRepoFile(BEARING_PATH); + const currentTruth = sectionBetween(bearing, '## Current Truth', '## Authority Boundary'); + const authorityBoundary = sectionBetween(bearing, '## Authority Boundary', '## Artifact Boundaries'); - assert.match(bearing, /Production startup launches `jedit-echo-host`/); + assert.match(currentTruth, /Production startup launches `jedit-echo-host`/); assert.match( - bearing, + currentTruth, /Buffer open\/create, insert, replace, delete, checkpoint declaration, and\s+bounded text-window reads are implemented/, ); - assert.match(bearing, /Multi-range edit, save\/export,\s+`:why`, causal line-diff, and undo\/redo return typed obstructions/); - assert.match(bearing, /checkpoint declaration and an Echo causal anchor remain separate\s+propositions/); - assert.match(bearing, /Wesley-generated EINT and installed package/); - assert.match(bearing, /generated Edict client/); + assert.match(currentTruth, /Multi-range edit, save\/export,\s+`:why`, causal line-diff, and undo\/redo return typed obstructions/); + assert.match(currentTruth, /checkpoint declaration and an Echo causal anchor remain separate\s+propositions/); + assert.match(authorityBoundary, /Wesley-generated EINT and installed package/); + assert.match(authorityBoundary, /canonical event envelope with stable\s+event, source, ordering, normalized-input, and admission coordinates/); + assert.match(authorityBoundary, /Echo realm admits and delivers it opaquely under an exact JimRelease/); + assert.match(authorityBoundary, /Only `jim\.core`[^\n]*interprets editor meaning/); + assert.match(authorityBoundary, /combined Jim-and-buffer candidate/); + assert.match(authorityBoundary, /atomically settles Jim, Buffer, result, and evidence/); + assert.match(authorityBoundary, /CandidateSettlementRejected/); + assert.match(authorityBoundary, /renders one declared causal view basis/); + assert.match(authorityBoundary, /syscall stub, not Jim/); + assert.match( + authorityBoundary, + /direct generated-client invocation of `ReplaceRange`\s+is permitted only in an explicitly test-only operation conformance harness/, + ); + assert.match(bearing, /oracle is never a program/); + assert.match( + bearing, + /Do not put `ReplaceRange`, rope operations, `Buffer`, or `TextWindow`\s+semantics in Echo production code/, + ); assert.match(bearing, /Do not reintroduce an in-process text authority/); }); diff --git a/spec/echo-application-hosting-guide.spec.mjs b/spec/echo-application-hosting-guide.spec.mjs index 90eac310..2ea0abb8 100644 --- a/spec/echo-application-hosting-guide.spec.mjs +++ b/spec/echo-application-hosting-guide.spec.mjs @@ -7,12 +7,42 @@ import test from 'node:test'; const REPO_ROOT = process.cwd(); const GUIDE_PATH = path.join(REPO_ROOT, 'docs', 'echo-application-hosting-guide.md'); +function sectionBetween(documentText, startHeading, endHeading) { + const start = documentText.indexOf(startHeading); + const end = documentText.indexOf(endHeading, start + startHeading.length); + + assert.notEqual(start, -1, `${startHeading} missing`); + assert.notEqual(end, -1, `${endHeading} missing`); + + return documentText.slice(start, end); +} + test('Echo application hosting guide states the real authority boundary', () => { const source = readFileSync(GUIDE_PATH, 'utf8'); + const targetBoundary = sectionBetween( + source, + '## Target Active-Observer Boundary', + '## Current Intent Lifecycle', + ); - assert.match(source, /Echo owns admission, scheduling, ticks/); + assert.match(source, /`Jim\.edict` is the application/); + assert.match(source, /Echo owns generic admission,\s+scheduling, ticks/); assert.match(source, /Wesley compatibility package currently supplies/); - assert.match(source, /Edict will later own the generated semantic boundary/); + assert.match(source, /Edict owns the generated semantic boundary/); + assert.match(targetBoundary, /canonical event envelope with stable\s+event, source, ordering, normalized-input, and admission coordinates/); + assert.match(targetBoundary, /Echo authority realm/); + assert.match(targetBoundary, /deliver opaquely under exact JimRelease/); + assert.match(targetBoundary, /jim\.core/); + assert.match(targetBoundary, /basis-bound Reading/); + assert.match(targetBoundary, /combined Jim-and-Buffer candidate/); + assert.match(targetBoundary, /atomically settle candidate or retain conflict outcome/); + assert.match(targetBoundary, /projection for one declared causal view basis/); + assert.match(targetBoundary, /generated client in this boundary is a codec and transport stub/); + assert.match(targetBoundary, /It may not\s+decide what a key means, derive a `ReplaceRange`, calculate a rope patch, or\s+advance cursor, mode, register, or operator state/); + assert.match( + source, + /Echo production code must not implement or branch on `ReplaceRange`/, + ); assert.match(source, /Launch `native\/jedit-echo-host`/); assert.match(source, /Recover the graph and continue editing/); assert.match(source, /typed obstructions/);