set_run_text: wire N0c1 to the office edit surface (docx.edit/2)

[bobzhang]

The arc after #434. The unified reader retains classified, provenance-carrying projections on every mutation-safe read, and plan_whole_run_replacement (N0c1) consumes them — but nothing shipped calls it. This campaign makes ONE carefully bounded operation trust the new truth source.

Shape (design of record: the post-#434 direction consultation; matches docs/office-major-parity.md N1a→N1b): an ADDRESSED operation, semantically distinct from replace_text's literal matcher — neither a second literal-replace nor a cutover of run_rewrite.mbt (the old emitter canonicalizes w:t and deletes empty runs; N0c1 preserves properties, spellings, and suppressed content — reconciliation is a measured follow-up, not first activation).

Stages

• A1 — package boundary: plan_run_text_replacement_archive(annotated, archive, story, at_relative~, expect~, text~) → (SplicePlan, RunTextReceipt) in docx2html/docx. Projection types stay private. The resolver uses the retained projection's OWN scan for path resolution (never story_run_span — the annotation index must not become mutation authority), maps to exactly one paragraph/run (refusing zero/duplicate/ambiguous), and pins the plan to its source.
• A2 — transaction SDK: DocxEditSession::queue_run_text_replacement + office/docx/edit_set_text.mbt. One bounded target; REQUIRED expect (snapshot-relative addresses need a precondition); no mixing with literal replace/revision resolution in one program; no output on refusal; byte-equal no-op when text == expect; full affected-paragraph readback as the semantic postcondition; an explicit text-character policy decision (the edit parser rejects all C0, N0c1 permits XML-valid tab/LF/CR).
• A3 — shipped surface: docx.edit/2 with {"op":"set_run_text","params":{"at","expect","text"}}; /1 untouched; capabilities/input-contract discovery; cram + SDK + wasm + fresh-agent acceptance; both .mbti diffs intentional.
• A4 — optional consolidation (separate): differential evidence before any emitter replacement; never both emitters in production.

Release gate additionally includes the #438 XML-token-budget calibration (39/591 corpus documents currently refuse on budgets — availability work that belongs to this surface going live).

After this

• C: migrate annotation_index/annotation_spans onto the retained trace behind this contract, proving public path/warning/ordinal parity (they still run their own physical scans).
• B: N0c2 partial-boundary surgery (sub-run ranges, run splitting).

Non-goals

Public projection API; cross-run or range editing; replace_text fidelity changes; template row-clone emission changes; header/footer mutation policy widening (the package wrapper is story-aware; the office surface starts body-only).

[bobzhang]

Phase C (annotation-scan unification) is complete — four PRs, all merged 2026-08-20:

• C1a refactor(docx): last-wins WML attribute precedence in every scan mode (#462 C1a) #467: duplicate-WML-attribute precedence unified to last-wins in every scan mode (the legacy first-wins artifact had to die before adoption could be mode-independent).
• C1b feat(docx): scan-adoption prerequisites for the annotation index (#462 C1b) #468: adoption prerequisites — dormant budget plumbing, the warning-replay helper with its saturation witness (source mode's nonfatal vocabulary is exactly seven shapes; the eighth scanner warning proved structurally unreachable), and the scan-mode parity oracle.
• C1c feat(docx): the annotation index adopts retained reader scans (#462 C1c) #469: the cutover. The index adopts the retained reader-projection scans in mutation-safe mode (no fallback rescan — a missing projection refuses loudly), with the cumulative path budget created before the joined reads and charged once. Each story part is now scanned exactly once per read, and the annotation surface and mutation resolver read the same physical scan.
• C2 test(docx): consumer-agreement pins + the frozen-scan invariant (#462 C2) #470: consumer-agreement pins — every span surface, covering_comment_ids, revision_spans, and plan_run_text_replacement held to the adopted scan by value AND identity (sentinel injection + the splice-window physical proof), plus the frozen-scan invariant N0c2 must inherit.

Tolerant mode and identity-only relationship-reachable parts keep their own scans, as scoped. Next: phase B — N0c2 partial-boundary surgery.

🤖 Generated with Claude Code