Make Jim.edict the application boundary

ARCHITECTURE.md

@@ -31,9 +31,39 @@ The broader project doctrine is written down in
 - Generated contract packages
   The current compatibility corridor is authored in GraphQL, compiled to Rust
   bindings and contract-host helpers by Echo's Wesley extension, and registered
-  with Echo by Jim's trusted native host. Edict will replace the transitional
-  authored Rust operation law and invocation glue. Generated metadata without
-  Echo registration and scheduler execution is not a production substitute.
+  with Echo by Jim's trusted native host. This is migration evidence, not the
+  target application boundary. The target is Jim-authored Edict source compiled
+  through Edict's public application-build boundary into a verified generic
+  Echo package. Generated clients are codecs and transport stubs; they may not
+  contain Jim's command interpretation or operation-selection logic.
+
+## Target Ownership
+
+The final application is Jim authored in Edict and realized by Echo:
+
+- Jedit, Bijou, and native adapters are Jim's body. They decode terminal and
+  process input into canonical events, install or address verified packages,
+  transport opaque runtime artifacts, and render disposable projections.
+- `Jim.edict` is Jim's mind. It owns editor state, modes, operators, motions,
+  cursor and selection policy, registers, pending actions, input-event
+  interpretation, observation requests, application intents, and outcome
+  handling.
+- Jim-owned Edict lawpacks own application operations and optics such as
+  `ReplaceRange`, `CreateBuffer`, `DeclareCheckpoint`, and `TextWindow`, plus
+  their fact schemas, identities, results, and typed obstructions.
+- Edict owns source checking, Core IR, authority and lawpack closure, target
+  lowering, package construction, and structurally separate verification.
+- Echo owns only generic runtime authority: installation, admission, budgets,
+  scheduling, bounded program interpretation, atomic ticks, WAL, receipts,
+  readings, recovery, and evidence.
+- Graft owns structural intelligence and projections over bounded readings. It
+  has no Jim text authority and does not justify application vocabulary in Echo.
+
+Echo production code must never branch on or implement Jim/Jedit nouns or
+verbs. In particular, Echo has no `ReplaceRange` variant, rope intrinsic,
+`Buffer` or `TextWindow` semantics, native Jim planner callback,
+`MutationPlan`, or caller-authored graph patch. Application coordinates may be
+carried opaquely in packages, fixtures, and receipts.
 
 ## Non-Negotiables
 
@@ -56,10 +86,21 @@ Compile-time types are not a substitute for runtime truth.
 
 ## Contract Authority
 
-Jim's domain types record application semantics, but they are not executable
-Echo authority. Production mutation must use an Echo-installed verified
-operation. Handwritten TypeScript codecs, admission logic, receipts, local
-executors, and metadata-only descriptors are forbidden substitutes.
+Jim-owned Edict source is the executable application law. A schema, oracle,
+compiler target, and runtime receipt are distinct artifacts:
+
+- `jedit.text.schema@1` defines application fact shapes, codecs, and identity
+  rules;
+- `jedit.text.ReplaceRange.oracle@1` is independent expected-behavior evidence;
+- `ReplaceRange.edict` is the authored operation semantics;
+- compiler-produced Echo Target IR and its verified package are executable
+  meaning; and
+- an Echo receipt is evidence that one admitted package ran against one basis.
+
+Neither the schema nor the oracle is a program. Echo must not reverse-engineer
+application behavior from either one. Handwritten TypeScript codecs, admission
+logic, receipts, local executors, metadata-only descriptors, and handwritten
+packages are forbidden substitutes.
 
 The current narrow production corridor is:
 
@@ -73,12 +114,39 @@ Jim command
 -> basis-pinned bounded observation
 ```
 
-Only buffer creation, single-range replace/insert/delete, and bounded text-window
-observation use this corridor. Checkpoint, save/export, multi-range editing,
-range explanation, causal gutter readings, and undo/redo still fail closed.
+Only buffer creation, single-range replace/insert/delete, checkpoint
+declaration, and bounded text-window observation use this compatibility
+corridor. Save/export, multi-range editing, range explanation, causal gutter
+readings, and undo/redo still fail closed. Do not widen this path or mistake it
+for the target.
+
+At the target boundary, Jedit normalizes physical input into one canonical
+event envelope with stable event, source, ordering, normalized-input, and
+admission coordinates. Echo admits and transports that envelope without
+inspecting Jim or Jedit fields. Only `jim.core`, authored from `Jim.edict`,
+interprets editor meaning. The exact wire schema belongs to the event protocol
+ADR; the ownership invariant is frozen in
+[Jim: Components, Responsibilities, and Ownership](docs/jim-component-ownership.md).
+
+The target corridor is:
+
+```text
+terminal bytes
+-> Jedit adapter emits one canonical event envelope
+-> Echo realm admits and delivers it opaquely under an exact JimRelease
+-> jim.core interprets the event and durably retains any command attempt
+-> jim.core requests a jedit.text bounded optic such as TextWindow.edict
+-> Echo returns a basis-bound Reading
+-> jim.core composes jedit.text law such as ReplaceRange.edict
+-> Echo privately evaluates one combined Jim-and-buffer candidate
+-> one realm and epoch atomically settles Jim, Buffer, result, and evidence
+   or retains a distinct CandidateSettlementRejected outcome
+-> Jedit renders one declared causal view basis
+```
+
 The GraphQL/Wesley package is a deliberately narrow compatibility path until
-Edict can provide generated operation law and invocation. Do not restore the
-deleted Node-host Wesley projections, local runtime, or local storage authority.
+the active-observer corridor replaces it. Do not restore the deleted Node-host
+Wesley projections, local runtime, or local storage authority.
 
 ## Identity Doctrine (Locked)
 
@@ -161,14 +229,19 @@ What Graft should own:
 - symbol occurrences and rename preview
 - structural diff, semantic summary, and anchor-affinity style snapshot mapping
 
-What `jedit` should own:
+What `Jim.edict` should own:
 
 - buffer lifecycle over Echo-backed rope heads
 - cursoring, selection state, and undo/redo over edit groups grounded in ticks
 - edit-group and undo policy over ticks
 - Vim-shaped mode semantics and input interpretation
+- observation requests, operation intents, and outcome handling
+
+What Jedit/Bijou/native adapters should own:
+
 - panes, panels, focus, and lens lifecycle
-- save/open flows and workspace interaction policy
+- terminal decoding, process bootstrap, raw I/O, and rendering
+- file import/export adapters invoked under Jim-authored policy
 - paint decisions and terminal-specific rendering
 
 Why the boundary exists:

docs/BEARING.md

@@ -1,8 +1,9 @@
 # BEARING
 
-Current bearing: operate one real Echo-hosted text corridor now, keep every
-unsupported feature obstructed, and replace transitional Wesley/Rust operation
-glue with generated Edict operations when Edict is ready.
+Current bearing: keep the real Wesley compatibility corridor honest, author
+Jim's first operation as real Edict source, and converge on `Jim.edict` as an
+Echo-realized active observer. Do not add editor vocabulary to Echo or move
+Jim's semantic state machine into a generated TypeScript client.
 
 This document records current repository truth. Historical implementation
 claims belong in git history and design retrospectives.
@@ -25,10 +26,12 @@ claims belong in git history and design retrospectives.
   Narrow edits path-copy touched nodes and retain untouched subtree identity.
 - Restart reconstructs witnessed submissions, graph state, and receipts from
   Echo's filesystem runtime WAL. The recovered host can continue editing.
-- TypeScript owns only the JSONL process adapter, Jim request/result mapping,
-  coordinate branding, and disposable UI projections. It does not construct
-  Echo identities, admission evidence, receipts, graph patches, or scheduler
-  outcomes.
+- TypeScript currently owns the JSONL process adapter, request/result mapping,
+  coordinate branding, and disposable UI projections. Its request mapping is
+  explicit migration debt: in the target corridor TypeScript normalizes
+  canonical events and transports artifacts, but has zero semantic authority
+  to interpret commands, choose operations, derive ranges, advance Jim state,
+  or optimistically mutate visible text.
 - Buffer open/create, insert, replace, delete, checkpoint declaration, and
   bounded text-window reads are implemented. Multi-range edit, save/export,
   `:why`, causal line-diff, and undo/redo return typed obstructions.
@@ -73,14 +76,47 @@ Jim command
 
 The target Edict corridor is:
 
+Jedit normalizes physical input into one canonical event envelope with stable
+event, source, ordering, normalized-input, and admission coordinates. Echo
+admits and transports the envelope without inspecting Jim or Jedit fields.
+Only `jim.core`, authored from `Jim.edict`, interprets editor meaning. See
+[Jim: Components, Responsibilities, and Ownership](jim-component-ownership.md)
+for the frozen ownership and causal-settlement contract.
+
 ```text
-Jim command
--> generated Edict client
--> Echo-installed verified operation
--> Echo admission and scheduler-owned tick
--> opaque Echo outcome and bounded observation
+terminal bytes
+-> Jedit adapter emits one canonical event envelope
+-> Echo realm admits and delivers it opaquely under an exact JimRelease
+-> jim.core interprets the event and durably retains any command attempt
+-> jim.core requests jedit.text TextWindow.edict
+-> Echo returns a basis-bound Reading
+-> jim.core composes jedit.text ReplaceRange.edict
+-> Echo privately evaluates one combined Jim-and-buffer candidate
+-> one realm and epoch atomically settles Jim, Buffer, result, and evidence
+   or retains a distinct CandidateSettlementRejected outcome
+-> Jedit renders one declared causal view basis
 ```
 
+A generated client may encode events, install or address verified packages,
+transport readings/outcomes/receipts, and decode typed projections. It is a
+syscall stub, not Jim. A direct generated-client invocation of `ReplaceRange`
+is permitted only in an explicitly test-only operation conformance harness.
+
+## Artifact Boundaries
+
+These artifacts are intentionally not interchangeable:
+
+| Artifact | Role |
+| --- | --- |
+| `jedit.text.schema@1` | Application fact shapes, codecs, and identity rules |
+| `jedit.text.ReplaceRange.oracle@1` | Independent expected-behavior evidence |
+| `ReplaceRange.edict` | `jedit.text`-authored operation semantics composed by `jim.core` |
+| Echo Target IR and verified package | Compiler-produced generic executable meaning |
+| Echo receipt | Evidence of one admitted execution against one basis |
+
+The oracle is never a program. Echo must not synthesize an evaluator or package
+from the schema or oracle.
+
 Runtime identity follows
 [the Echo identity doctrine](design/echo-identity-doctrine.md). Jim must not
 copy Echo identity domains, admission policy, scheduler behavior, WAL evidence,
@@ -92,16 +128,24 @@ or support-policy logic.
    Echo-owned WAL, admission, scheduling, graph state, receipts, and restart
    recovery.
 2. Avoid restoring broad editor feature parity through transitional APIs.
-3. Have Echo and Edict establish one natively installed generated operation.
-4. Migrate `ReplaceRange` to the generated Edict client and operation.
-5. Make the Wesley/Rust replacement path unreachable, then delete it.
-6. Migrate create/open and bounded text-window observation.
-7. Add optional causal-anchor association as a proposition separate from
+3. Check in Jim-owned `ReplaceRange.edict` with its complete lawpack closure.
+4. Build it through Edict's public application-build boundary and let the first
+   honest compiler or target-profile failure route work to its owning repo.
+5. Extend Echo only for generic bounded-program capabilities proven necessary
+   by the compiler-produced package; prove the result against the independent
+   Jedit oracle.
+6. Author `TextWindow.edict`, then the smallest `Jim.edict` active observer.
+7. Move production Jedit to canonical event submission and disposable
+   rendering; make frontend operation orchestration and the Wesley/native
+   planner route unreachable, then delete them.
+8. Migrate create/open and checkpoint lawpacks under the same ownership model.
+9. Add optional causal-anchor association as a proposition separate from
    checkpoint declaration only when a concrete consumer requires it.
-8. Add save/export through generated operations, then derive undo/redo
+10. Add save/export through Jim-authored operations, then derive undo/redo
    candidates from retained Echo history and invoke generated inverse
    operations through basis-pinned Echo observations.
-9. Delete the remaining compatibility host package and JSONL invocation glue.
+11. Delete the remaining compatibility host package and semantic JSONL glue;
+    retain only raw event/artifact transport required by the final membrane.
 
 ## Hard Gates
 
@@ -114,6 +158,10 @@ or support-policy logic.
   authority beside Echo history.
 - Do not widen the handwritten compatibility protocol for feature parity.
 - Do not describe the Wesley compatibility package as the final Edict design.
+- Do not put `ReplaceRange`, rope operations, `Buffer`, or `TextWindow`
+  semantics in Echo production code.
+- Do not let TypeScript map commands to operations in final production
+  composition.
 
 ## Verification
 

docs/data-model.md

@@ -1,18 +1,20 @@
 # jedit Data Model
 
-> **Cutover note (2026-07-16):** The Wesley schemas, generators, generated
-> TypeScript projections, local graph-rope executor, and in-memory structural
-> history runtime described in older sections of this document have been
-> deleted. They remain design history only. The next executable mutation path
-> is a generated Edict client invoking an installed Echo operation and consuming
-> opaque Echo receipts plus basis-pinned observations.
+> **Cutover correction (2026-08-18):** The Wesley schemas, generators,
+> generated TypeScript projections, local graph-rope executor, and in-memory
+> structural history runtime described in older sections of this document are
+> design history or compatibility evidence. The target is not a TypeScript
+> application invoking operations through a generated Edict client. The target
+> runs `Jim.edict` as an Echo-realized active observer: Jedit submits canonical
+> events, Jim-owned Edict lawpacks define operations and optics, and generated
+> clients carry bytes but make no application decisions.
 
 ## Doctrine
 
-jedit owns the **editor contract** and product nouns. Echo owns **generic
-runtime execution**, admission, scheduler-owned ticks, receipts, readings, and
-retained evidence. Edict will compile Jim-owned operation law into generated
-clients and verified operations that Echo installs and executes.
+Jim-owned Edict source owns the **editor contract** and product nouns. Echo owns
+**generic runtime execution**, admission, scheduler-owned ticks, receipts,
+readings, and retained evidence. Edict compiles Jim-owned application law into
+verified generic packages plus semantic-free codecs and transport stubs.
 
 The rope model is jedit contract law hosted through Echo's generic graph and
 contract-host surfaces. Echo must not implement a privileged jedit rope engine.
@@ -115,7 +117,13 @@ history, the boundary is wrong. That is the trap detector.
 
 ***
 
-## TypeScript model
+## Transitional TypeScript model
+
+The model below documents compatibility-era shapes and projections. It must not
+justify final TypeScript command interpretation, operation choice, range
+derivation, rope patch calculation, or Jim state advancement. Those semantics
+move to `Jim.edict` and Jim-owned Edict lawpacks. TypeScript remains an
+event/artifact codec, raw transport adapter, and disposable renderer.
 
 ```ts
 // ---------- identity types ----------
@@ -668,7 +676,10 @@ boundary; a `head_id` crosses it only as an opaque Jim fact reference inside a
 
 ***
 
-## Sequence: `replaceRange`
+## Compatibility Sequence: `replaceRange`
+
+This sequence records the running Wesley corridor. It is not the target
+`Jim.edict` observer loop described in [BEARING.md](BEARING.md).
 
 ```mermaid
 sequenceDiagram