Author ReplaceRange as Jedit-owned Edict source - #302

Goal

Author and prove ReplaceRange.edict as the first Jedit-owned text operation,
compiled by Edict and ultimately realized by Echo without moving rope semantics
into Echo or TypeScript.

Tracks #296.

Plan

• Publish the canonical jedit.text@1 lawpack closure through Edict's public authoring boundary.
• Check in the first real ReplaceRange.edict source and application manifest.
• Lower the source through Edict and emit an independently verified generic Echo package.
• Pin clean Edict/Echo toolchains and make lawpack reproduction non-mutating.
• Preserve distinct nominal 32-byte BufferId and HeadId contracts.
• Bind raw verifier output to a verifier-specific transitional evidence identity.
• Pin the complete Core → Target IR → projection → package → report → subject chain.
• Pin the Node/npm/CBOR validation environment and literal PR-head CI checkout.
• Make the calibrated substitution and drift attacks permanent regressions.
• Obtain a fresh independent exact-head operational audit.
• Implement Echo's generic pure runtime evaluator and the application-owned rope algorithm.
• Execute through Echo and prove agreement with the independent Jedit oracle.

Current status

The repaired package-proof candidate is published at:

• Jedit: a6673521699259abdd27be10f7c885b5c634a867
• Edict: 39a796de04b3400f569880da06878da50d8ed0ee
• Echo: 49e9efb68001dfd78563d18bac9359a87671e431

jedit.text@1 now exports deliberate nominal BufferId and HeadId
contracts over one exact 32-byte representation. Edict preserves their contract
coordinates in Core and refuses cross-assignment across the imported lawpack
boundary. Echo's lowerer and verifier consume the generic nominal Core form
without acquiring any Jedit vocabulary.

The raw Echo verifier report remains a separately identified artifact. Jedit's
canonical-JSON evidence envelope binds that report and its exact executable
subject to the provider release, verifier component, verifier contract, target
profile, report ABI, diagnostic ABI, and outcome. Changing only the verifier
identity changes the transitional VerificationReportId.

The toolchain and build locks pin exact Rust, Node, npm, Edict, Echo, provider,
cbor-x, package, lockfile, workflow, source, lawpack, Core, Target IR,
projection, executable-package, report-artifact, verifier-evidence, and
executable-subject identities. Validation uses Edict's non-mutating
checkOnly publication boundary and snapshots authoritative inputs before and
after the build.

Permanent local witnesses are green:

• rejects_non_git_toolchain_inputs
• rejects_wrong_commit_toolchain_inputs
• lawpack_check_only_rejects_drift_without_repairing_it
• rejects_package_whose_recomputed_identity_differs_from_report_subject
• preserves_nominal_exact_length_buffer_and_head_identities
• rejects_buffer_id_head_id_substitution
• verification_report_identity_is_verifier_specific
• rejects_drifted_build_and_executable_subject_locks
• rejects_drifted_executable_subject_lock
• required_ci_executes_the_exact_package_chain

The dedicated package-chain job now checks out and asserts the literal pull
request head. Ordinary matrix jobs remain separate integration evidence.
Current-head GitHub CI is green at a6673521699259abdd27be10f7c885b5c634a867.

This remains a Draft and is not a completed text mutation. No Echo evaluator
runs, no graph or rope is mutated, and no Tick is settled. The source does not
invoke the native Jedit planner, construct a caller-authored patch, or treat the
schema/oracle as executable input. Echo remains free of Jim, Jedit, rope,
buffer, range, and editor semantics.