Preserve ordered effect-result guards in an explicitly selected Target IR contract #218

Observable outcome

Edict can preserve a straight-line sequence of semantic effects, pure bindings, and guards when a guard depends on an earlier effect result. The selected Target IR contract must preserve source ordering and fail closed with consumers that do not support it.

This is a prerequisite of flyingrobots/jedit#296 / flyingrobots/jedit#302. It is not implementation of graph reads or an Echo rope operation.

Actual consumer RED

On Edict 77f4a91080a6c2c875fe349da6fc6a64525947a2, the public lawpack build accepts a Jim-owned readCanonicalHead(BufferId) -> HeadId semantic effect. The public application build rejects this authored body:

let canonicalHead: text.HeadId = text.readCanonicalHead(input.bufferId)
  else { missing(id) => text.FactMissing };
require canonicalHead == input.basisHeadId else text.BasisNotCanonical;
return canonicalHead;

Observed refusal: TargetLoweringFailed, UnsupportedTargetFeature, obstruction_requirement_step_output_dependency, node 1. Removing only the guard advances to the selected provider, which rejects UnsupportedSemantics. Neither variant emits a runnable package.

The source, complete lawpack, Docker reproduction, and paired control are being retained under edict/replace-range-probes/state-read/ in jedit PR #302. The proposed snapshot-read-probe intrinsic is deliberately unsupported and does not establish a runtime read ABI. The probe retains an incompatible pure provider to demonstrate the next fail-closed boundary, not to claim stateful support.

Current structural limitation

crates/edict-syntax/src/target_ir.rs stores pure bindings, requirements, and steps in separate arrays. Requirements are currently pre-step guards; lower_require_node intentionally rejects both effect-result references and guards after a target step. Existing tests explicitly protect those refusals. Deleting those checks without an ordering model is incorrect.

Scope

• Define an explicit versioned/negotiated target artifact contract for straight-line ordered bindings, effects, and terminal or supported obstruction guards.
• Preserve exact effect-result bindings, guard payloads, input constraints, basis, budgets, lawpack closure, and source order in canonical identity.
• Validate availability, types, duplicate/forward/self references, and output authority independently at the Core-to-Target boundary.
• Keep legacy artifact bytes and behavior stable unless an explicit version migration is selected.
• Prove unsupported providers reject before executable-package publication.

Exclusions

No loops, recursion, branching expansion, graph read implementation, graph writes, native callbacks, rope or editor intrinsics, runtime admission, receipt/WAL/recovery claims, or repinning the existing jedit application. Those remain under their owning issues.

Acceptance checks

• A public source/lawpack witness preserves read → guard → result ordering under the new selected artifact contract.
• Include effect → pure binding → guard, two effects separated by a guard, guard payload references, and input-only guards after an effect.
• Invalid/dangling/forward/duplicate identities fail before artifact publication.
• Reordering a valid program changes canonical identity; decoding/schema validation independently recognizes the ordered representation.
• Existing profiles retain their protected fail-closed behavior and byte identities.
• Old provider consumers cannot accept or execute the new semantics silently.
• Docker-only focused regressions and the repository verification gate pass. Topic contract, test plan, schema, fixtures, and changelog agree.

Prerequisites and safe intermediate state

The Jim witness was run on the current producer stack ending at #216 / PR #217. Preserve that compiler baseline when implementing, without merging unrelated historical WIP.

A compiler-only merge is safe if the new representation is explicitly selected and unsupported consumers reject it. It must not advertise runnable stateful Echo support. Echo #684 owns generic provider/interpreter work only after the compiler supplies real artifacts; Jim #296 still owns authored rope semantics and complete end-to-end acceptance.