Integrate release recovery, semantic review, coverage and Windows packaging

harness/release-semantic-keyed2.md

@@ -0,0 +1,104 @@
+# Independent Annotation / Binding review and semantic recovery
+
+Implemented on integrated DATA baseline `c091f80`; current working-tree changes
+remain under integration and are not release acceptance evidence.
+
+## Contract and implementation
+
+The existing semantic core planner remains the authority for scopes, reference
+mapping, validation, historical observations, induced changes and atomic commands.
+The desktop now exposes independent `Annotation` and `Binding` facet selectors
+alongside Members/Literals. A message annotation key is the complete `(path,field)`;
+a scenario binding key is its reused scenario's `referenced` lifeline. An explicit
+OA/SA pair stages a row and its key reference correspondence. It creates no model
+objects. Changing a key requires separate removal/addition and explicit resets of
+overlapping historical observations.
+
+Keep retains the target row; Take maps typed source references and preserves
+expression prose literally; Candidate sets exact presence plus expression or local
+lifeline. A missing source key preserves a target-local row. An explicit source key
+whose row is absent can remove its mapped target row. Full candidates compose only
+the selected row, leaving sibling rows intact. The core validates the result again.
+
+`semantic_review/keyed_rows.rs` owns the closed row adapter, raw multiline
+expression/local-lifeline drafts, complete path pairs and context-specific choices.
+`view.rs` exposes paged carried-field browsing, recursive descent, source/destination
+key choice, exact history scope and candidate controls. Drafts survive decision
+changes, temporary exclusion, staging removal and invalid values. Binding choices
+distinguish reused keys from local scenario lifelines and follow candidate ownership.
+
+## Independent findings
+
+The behavior-review agent found two concrete issues by read-only review:
+
+- Local binding choices followed original ownership during a Header Parent
+  candidate. Fixed by walking from the combined candidate's parent.
+- Generic display substituted a UUID-shaped expression when its text matched a
+  referenced field UUID. Fixed with typed annotation rendering: names apply only
+  to path/field; expression text is shown literally.
+
+Both have focused regression tests. The reviewer inspected the corrections and
+reported no additional material finding in the bounded keyed-row review.
+
+## Semantic checkpoint extension
+
+Independent review of root's recovery integration found that pending semantic
+workflow drafts were absent from both dirty detection and checkpoint snapshots.
+The root assigned the semantic adapter extension here and owns App/checkpoint wiring.
+
+`State::recovery_snapshot` / `State::from_recovery` preserve authored decisions,
+reference mappings, exact resets, staged keys, presence, scalar and constructor
+raw inputs, cached constructor alternatives, row drafts and unfinished pair picks.
+Plans and proposed models are recomputed. Restore verifies the accepted Project UUID
+and complete core project fingerprint (the persistent model revision, not a transient
+Document counter); changed models reject. Invalid numeric inputs remain recoverable
+and cannot apply until repaired. Constructor contexts are recalculated and group
+editing mode restored. No GUI pointer state or credentials are serialized.
+
+`Workflow` wraps all adapters in a strict externally tagged record. Relationship
+drafts retain names, multiline conditions, kind, direction, endpoints and item
+choices; manual traces retain exact names and counterpart picks. Transition review
+stores its typed request and recomputes the core plan. Port workflows retain kind,
+orientation, incoming/outgoing items, endpoints, selected boundary, split-side
+choice and generated identity; their plans are rebuilt too. Every adapter checks
+the original accepted model fingerprint. No saved computed command is replayed.
+App dirty/restore integration remains root-owned.
+
+## Core ordering correction
+
+Focused GUI tests exposed a core mutation defect: replacing or merely retaining
+an Annotation/Binding removed the existing row and appended it. A Keep decision
+alongside an unrelated Header candidate therefore changed authored row order and
+could fail the planner's unselected-facet check. The bounded `semantic/mutate.rs`
+fix replaces a changed row in place, skips identical rows, removes only requested
+rows, and appends only genuinely new rows. New GUI rows compose in destination-key
+order, matching the core's canonical new-slot application. Existing rows retain
+their authored positions. Core regressions cover both row families and directions.
+
+## Verification status and next gates
+
+Owned rustfmt completed successfully. With the user-local Rust 1.98.1 GNU LLVM
+toolchain, the full desktop test suite passed **431 tests, 0 failures, 0 ignored**
+(`.local/keyed2-desktop-test.log`, 31.72 seconds). The core `r3_semantic` integration
+suite passed **35 tests, 0 failures** (`.local/keyed2-core-test.log`). This includes
+the narrow core correction, GUI row composition, all workflow recovery adapters,
+and the independently corrected typed StateAction canvas test. The earlier focused
+desktop semantic run passed 58 tests before the last new-row composition test was
+added; the complete 431-test result supersedes that focused checkpoint.
+
+The added tests cover both OA→SA and SA→OA, Keep/Take/Candidate combinations,
+coexisting scalar candidates, sibling preservation, literal UUID expressions,
+raw draft retention, recursive qualified-field selection, local/reused binding
+choice separation, candidate ownership, exact reset requirements, missing-key versus
+absent-row behavior, unresolved reference rejection/repair, invalid local binding
+rejection/repair, exact source/model/history Undo/Redo and reopening, and recovery
+against unchanged/changed models. Native operation remains root-owned and pending.
+
+The shared Cargo target has been released to root for native binary builds.
+Workspace formatting, strict Clippy, broader workspace checks and native acceptance
+remain root-owned gates; the test results above do not claim release acceptance.
+
+Run native message-value and scenario-use reviews at normal and minimum size,
+including long qualified paths, reverse review, absent/new rows, overlapping
+history reset, multiline expressions, Save/reopen and recovery of invalid input.
+Other ordered/attached/artifact/multi-source GUI facets remain outside this slice.